I’m curious if any other customers are using any type of 3rd party hacking monitoring service? We’ve unfortunately been dealing with a few of our sites getting hacked repeatedly, and the question was asked if there was some way to do some advanced monitoring of a website and logs to see if a site gets hacked, and potentially be able to fix the issue proactively.
I’ve only found a few places, like sucuri.net, that seem to offer roughly what we’re looking for. But was curious if anyone else has any suggestions.
A free solution if you don’t mind doing it manually is to use a combination of Freefilesync and Netdrive to check for changed files. I run that on a couple of sites every few days and it spots any changes, either by file content or date, which is okay for me as I will recognize changes on those sites that are not legitimate. I also run an ASP script that checks for recently changed files and sends me an email every day. Hackers seem to have gotten around date-stamping by not showing a new date when they change a file though, on Windows machines at least, so the file content option in Freefilesync is more useful. A useful extra advantage is that you should always have a full recent backup of the site if you do spot changes.
It’s not a real solution, though. Removing hacked files daily won’t stop them and they’ll continue to be a PITA for the rest of your life. Best if you’re prepared to spend the time and inconvenience to move to a new server that isn’t hacked, as long as you can check all your files carefully to make sure you’re not bringing any backdoors along with it.
Servers changes dont help in most cases as it isn’t the server that is the issue at the core. It is the way they got there in the first place, which is normally via script injection. There have been a few cases on 2003 where some IIS problems have allowed mass writes outside of the user isolated permissions zones, which is among the core reasons we are working very hard to get off 2003 (there are no patches for these issues, and to resolve it would mean breaking most ASP sites), but most are purely site level matters, or account level matters.
The biggest issues I have seen are when people load up a lot of domains in one account and make pinpointing the problem very hard to impossible as you have 100’s to 1000’s of log files to go through if they dont find it immediate (say 12 domains, and day is known, 12 logs, but if day is unknown it may be 30x12 just checking a month back) And there are some people with well more than 12 domains in an account.
In my case moving sites off 2003 servers cured the problems completely (touch wood), so regardless of the reasons I would have to regard those servers as ‘hacked’. Asking for permissions to be updated wasn’t a permanent fix. Support were able to move accounts on request without disrupting any email, logins, or database setups, which was excellent. I have also cut a couple of customers loose, reluctantly, who weren’t willing to keep their older CMSs updated or upgrade them, and one who I suspected had their own PC hacked and causing problems that way. Lost a few bucks a month, but it was well worth it to get rid of the hassle.
For me, we do not have many domains under a single account, most are a 1:1 ratio. I don’t think a manual check of all our sites is going to work, which is why I was looking more for something automated. I already do weekly scripted FTP backups so I at least have a copy sitting local on my drives, as JH only keeps a few days worth, and doesn’t do weekly/monthly backups if the customer doesn’t notice the hack for a while.
I would agree with Stephen in that moving servers doesn’t 100% cure it, but I know that some of my sites, in the past, got hit because they were on 2003 servers where other sites got hacked, which led to some of mine getting hacked. The bad thing, trying to get help from the JH regular tech support staff seems nearly impossible. All I usually get are copies of log files, and when I ask for help finding out how the hack happened from those logs, they don’t see any issue or that the site was hacked. This is in both FTP and WEB logs. I see, or rather, don’t see, the same thing, that the logs aren’t showing how the hacker changed the content of the files. So how exactly are the files getting hacked?
Which is what is leading me to try to help myself, and my customers, by getting some type of software or online service that can help monitor the site in some way to see if content got changed, or a bunch of malware links show up, etc. I already monitor all the sites from another server I run, but that is basically just for ping and that it responds on HTTP. This doesn’t help me when the site content gets changed and has a ton of links to malware sites..
It sounds like complete content monitoring with a remote login service (requires a level of trust for sure) with md5 hashing of data and a backup service would be a great platform to offer as niche market complete service. It is sadly something out of my range of ability to create, but would support it if possible
When I wrote the file-change script my original intention was to upgrade it to a database-based application that would do just that. i.e. automatically check for all edits and record the actual changes made to each file. Never got around to it, but it would be a commercially sound business, I think, as long as the price was reasonable. (I don’t want to double my hosting costs.) Some sites are updated so often by clients that I’d still need to manually check whether those changes were legitimate, though. I could send the email to the client to check, but the chances are they wouldn’t do it carefully enough, and I could actually lose their business because of it. Hackers have mostly moved from basic defacing to subtle link additions for black-hat SEO purposes, so their edits don’t always jump out at you. A more sophisticated method of spotting hacker-type additions would be required. At least, they don’t normally break the site completely these days, so quite often the client doesn’t notice right away (not until they’re informed their site is advertising designer shoes or whatever on Google, anyhow.) Only a matter of time before those security holes are used for something more malicious, though, so it’s a constant battle.
If you already have a local copy of backups, just start saving them by date, and then make a basic script with winmerge to get a diff output: Command line - WinMerge 2.16 Manual
