Yesterday, WhyDoWork.com was taken down by a group of hackers.  We were the next target on their list after crashing a large children’s website where the main page was replaced with some choice profanities. This particular group seeks out programming flaws and exploit websites, their only reward being a few insignificant praises from their community and knowing that the websites hacked will likely take a closer look at security.

Hackers are almost always your stereo typical computer tough guy.  Unless you can rationalize vandalism then you aren’t going to be able to rationalize their behavior, so don’t bother.  Anyone who has been a victim of any type of crime knows the frustration and anger that accompanies it.  In the real world your first reaction is to inform the police, but this is the Internet.  So what do you do?

Prevent

First lets take a step back and try and prevent this from happening to begin with:
  1. Have Your Server on Guard – Make sure your hosting provider has some type of firewall software running.  If you are very large you may even want load balancers and other hardware to handle DOS attacks.
  2. Know How to Code – Make sure your programmers are preventing against SQL injection, the most common type of attack.  Any time external data is used in a query it needs to be cleaned up and special characters removed.
  3. Stay Up To Date – If your site is powered by a piece of software it needs to be upgraded as new releases are published.  Once a flaw is found it becomes publicly known.  You want to ensure you stay on top of all security fixes.

Plan

You have to assume that one day your site will get hacked as a growing site often does.  Make sure there is a game plan.
  1. Backups – Ensure both your site and database are backed up on your server and remotely.  You need to be equipped to grab those backups and have them restored quickly.  Note: Most hosting providers do not automatically provide a backup service, this is something you should look into.  If you are unable to restore the site yourself you should ensure you have access to a support team to handle the task 24/7.
  2. Passwords – Make sure the password you use is different everywhere.  This is very important so don’t get lazy here.  You will want your db, server and user accounts to have different passwords.  The first thing a hacker will do once they find one password is test whether it works everywhere (including your personal email).
  3. Encryption – Ensure your user’s passwords or any highly sensitive information be encrypted in the database.  This way, even if your database is exposed the hackers cannot exploit your users.

React

In the event of an attack its time to stay calm and figure out how to get the site back online and ensure it stays online.  Once an attack has been published you are going to be a target for a follow up.
  1. Reach out to the Hackers – Hackers take pride in their work, keep that in mind while you deal with them.  Don’t try and fight with them, its a losing battle  If you try and cooperate they may tell you how your site was exposed.
  2. Restore – Obviously the first thing you want to do is kick off a site restoration procedure.  Even if only your database seemed to be exposed you may want to restore an old code base to ensure nothing was secretly modified.
  3. Fix the Problem – You need to find the security hole and plug it.  Count on the hackers installing back door access to your site.  Find that and remove it as well.
  4. Change Your Passwords – This one should be obvious but you want to change all passwords to your site, as well as potentially your personal email and other accounts if they were the same.
  5. Assure Your Members – Be honest about the attack.  If private data was exposed the important thing to do would be to inform your members so they can protect themselves.  If there is nothing to be concerned about, let them know that.  They will be wondering what happened and whether the site can still be trusted.

Report

Can we let these jerks get away with this?  Unfortunately this type of crime is very difficult to stop. If someone walks up to you on the subway and punches you in the teeth claiming your lack of self defense skills is a “vulnerability”, it’s likely they’ll get arrested fairly quickly.  Most hacker groups are hosted in the most unregulated countries where authorities have trouble existing but there are some measures to try.
  1. Report to the FBI – Here is a link to the Internet Crime Complaint Center: http://www.ic3.gov/default.aspx
  2. Email their hosting provider - Try running a report on http://network-tools.com/ for the domain where the attack came from.  Often you will see an email address from their hosting provider where malicious behaviour can be reported (ie: abuse@hostingprovider.com).  With some luck these guys will shut the site down at least temporarily.

If you have any other tips please share!

If you enjoyed this post, make sure you subscribe to my RSS feed!