I watched the NOVA episode Rise of the Hackers on PBS this week and I highly recommend it just to help you see how hackers find twisted ways into your security:
[
amazon.com...]
It's a real eye opener as I knew some of this stuff but they even surprised me with some of the hacks they explained.
All I can say is: WOW
Anyway, it reminded me of a real world hack that happened to a customer of mine when we were hosting their ecommerce sites a few years back.
Credit cards used on their web site kept showing up used elsewhere, often very soon after the purchase from their site, and we're talking LOTS of customers, not just a few.
Like all of our ecommerce servers, everything was hardened to hell, access to certain protocols like SSH and SFTP was restricted to just our network and the client's network, it was a completely walled garden except for SMTP and HTTP.
I checked everything, there were no changes to any scripts, there was no access by any IPs other than ours or the clients, and for the days the CCs were stolen there was ZERO access from our company to the server which meant it wasn't any of our employees stealing them. Whew ;)
Additionally, they did their credit card processing offline, not in real time, so every time they downloaded them we erased them from the website. The CC's did not persist on the server.
While the website is usually the prime suspect, in this case there was absolutely nothing on the server, not a thing, it was clean as a whistle.
I told them they needed to check their side, which was behind a hardware firewall, etc.
What it turned out to be was a hacker from Canada was eventually caught by the feds. He had sent emails targeting their employees and when they opened those emails, the file attachment installed malware on the client machines inside their firewall that was then used to access the website from inside the firewall. It's also possible they just grabbed the downloaded file off the clients machine. I was never given the exact specifics of how he got the data except that is was from the clients machine inside the firewall.
Therefore, you just learned a valuable lesson here that no amount of sever hardening, firewalls, or security does a damn bit of good as long as you have one weak link in the process: a human. Human's can be tricked into doing things many ways and a couple explored on the NOVA video I referenced above include people leaving malware infected flash drives and CD's laying around that are specially designed to make nosy people insert them into a computer and thanks to auto-run files the computer is HACKED! just that quick.
Watch the video with an open mind because while the attacks they describe may not specifically be applicable to your situation, the concepts could easily be revamped and make you a target as well.
People need to be alert, don't open file attachments you don't know, don't insert flash drives and CD's you know don't.
Common Sense is the biggest tool in computer security. Sadly, common sense is lacking for most and the laissez-faire attitude people have regarding computer security is why botnets are so prolific.
When I hear people claim they don't run AV software and never have, I want to take a flame thrower to their computer to make sure it's clean.
See my other post about using VM sandboxes to possibly try to solve this malware issue:
[
webmasterworld.com...]
