You've Been Hacked. Now What?

Detect, disable and recover from a network attack

From the October 2004 Edition
of Windows IT Pro
Alan Sugano
Cover Story
InstantDoc #43875
Windows IT Pro

Identifying the hack. I opened the Microsoft Management Console (MMC) Active Directory Users and Computers snap-in and looked at the user accounts. Someone had created a rogue user account that was a member of the Administrators group. I knew an intruder had hacked the network, so I shut down all external connections and started looking for a compromised computer. It didn't take long. My client had two Web servers in the demilitarized zone (DMZ). One server ran the company's Web page; the other ran timekeeping software. I checked the registry Run subkeys and investigated suspicious batch files on the C drives of both servers. The server running the timekeeping software was severely compromised. It held rogue FTP and SMTP programs with multiple root kits. This server connected to a Microsoft SQL Server system on the LAN side and allowed only SQL Server traffic to pass from the DMZ to the LAN. The server was running Win2K with Service Pack 2 (SP2) and was missing a lot of critical Win2K updates.

Repairing the damage. I rebuilt the server from scratch, moved the server to the LAN side of the firewall, and eliminated public access to it. I then reconnected the external lines and monitored them closely for suspicious activity.

Previous 1 2 [3] 4 Next

I will definately use some of the information from the article.

horseman69 October 12, 2004 (Article Rating:

)

h

Anonymous User October 22, 2004 (Article Rating:

)

good article

seco November 01, 2004 (Article Rating:

)

Table 1 is missing in the online version. Is there anyway to get Table 1 included? It lists the typical XP ports as described in the article.

RWB-IT November 05, 2004 (Article Rating:

)

Table 1 is still missing!!!!Why?????????

JunLiu November 15, 2004 (Article Rating:

)

Do you people want some cheese with your whine? If the site's broken, send them an email about it. It doesn't help much to cry about it on some reader comments section.

Anonymous User November 16, 2004

A wonderful article with extremely useful information. Hope we can have more of this kind.

stphxu December 22, 2004 (Article Rating:

)

You must log on before posting a comment.

If you don't have a username & password, please register now.