Web Hosting Talk : Web Hosting Main Forums : Hosting Security and Technology : preventing being hacked by "V4 team"

[chamelion]

just got some sites hacked for a second time by this V4 team.

Hack3d

Your System 0wned By V4 TeAm

V.4 Crackers

Contact :

Dj_moad@hotmail.fr

Attack Method : uid=0(root) gid=0(root) groups=0(Root)

Attack Reason : Revenge against that websites

GrEetz To All V4 TeAm Members

==>>V4 TeaM<<==

links to http://members.lycos.co.uk/moadis


i've run every security setting i can picture, including CSF, firewalls, restricting php access, suexec and what not.

any ideas how these a**holes keep coming in? using WHM11.

[Servax]

What kernel are you running, and which OS?

[chamelion]

centos
2.6.9-55.ELsmp

[sh4ka]

Well.. that kernel is old, that may be one reason to explain why you were exploited.

[optikalus]

Have you ran a rootkit checker?

Is your /tmp filesystem executable?

If you've not run a rootkit checker since the first attack, then it is possible that even though you've secured the server better, they're still getting in through the backdoor they created.

[IH-Chris]

I recommend contacting a firm to actually go through your server. It would be impossible to tell you how it was done without looking at it.

Contact Rack911.com and ask for Steve. He always seems to be eager to assist for reasonable rate. They may be booked up, but worth a shot.

[askjim]

Had the same problem where all the websites under my hosting package were compromised by these annoying *r*eholes.

After going through log files and checking for rootkits etc it was discovered that one of the sites under my hosting package was running an old 2007 version of OS Commerce which had a security hole.
After a forced attack to gain access to the admin console, the hacker was able to modify the logoff.php file which enabled him to go up a directory to the main root of where all my sites were.
Luckily for me, mostly all files were still there however they had replaced the index.htm files with their own or added an index.html file or an index.php file.

I'm in the process of rebuilding the OS Commerce site with a more secure and up to date version however deleting the site (or deleting the logoff.php file) removed the threats.

I hope this helps...