Page 1 of 1

Restoring a defaced site?!

Posted: 20 Mar 2006, 02:51
by Lyecdevf
I guess this is a noob question. I was wondering why is that when a site is defaced it can not be restored back with ease?

So what I am wondering is wether a hacker can do more than just temporary damadge and how easy or difficult is it to restore the site? I have alway been under the impression there is nothing that can not be undone it these sort of things.

Posted: 20 Mar 2006, 06:19
by bad_brain
well, it the person which defaced the site is a honorable one he just moves the index.html and replaces it without doing any real damage to the site and also gives the admin a hint where the vulnerability is. but well, many morons on the net, so often the sites are heavily damaged too by erasing the database or something like that....some people are afraid of sex and this is their way of mental masturbation.
well, another point is how "deep" the server has been compromised: has the intruder gained access to the webspace only or has the whole server been compromised? in the second case the potential damage is much higher of course.
and not to forget: many admins are too lazy to do backups.

so, restoring a defaced site is not just restoring the old state again, it´s about:
- how was the site accessed by the intruder?
- what damages have been done?
- how can further access be avoided?

a big help is to run an IDS (Intrusion Detection System) on the server, best with the logs piped to different server to prevent them from being manipulated by the intruder, and also a program like Tripwire with which file manipulations can be uncovered.
:wink:

p.s. have your question something to do with an affiliated site?

Posted: 20 Mar 2006, 08:29
by Lyecdevf
I was wondering what was the point of hacking if the admin simplly takes a copy of his back up and restores the site. Since you say that some are to lazy of making one that makes more sense if the data you erase will be gone for good.

I have seen a long time ago a satanic site hacked by muslim hackers and I happened to wonder how difficult is it to delate the message left by a hacker on your website that says "Alah is the only God." NO, it does not have any thing to do with an affiliate.