0

I own a content publishing website developed using CakePHP(tm) v 2.1.2 and 5.1.63 MySQL. It was developed by a freelance developer who kept remote access to the database which I wasn’t aware of. One day he accessed to the site and overwrote all the data. After the attack, my hosting provider disabled the remote access to our database and changed the password. But somehow he accessed the site database again and overwrote some information. We’ve managed to stop the attack second time by taking the site down immediately. But now we’re suspecting that he’ll attack again.

What we could identified that he’s running a query and changing every information from the database in matter of a sec.

Is there any possible way to detect the way he’s accessing our database without remote access or knowing our Cpanel password? Or to identify whether he has left something inside the site that granting him access to our database?

2 Answers 2

1

Do you have multiple accounts for the database and did you reset the passwords for them all? Perhaps he made himself a second account to utilise that you haven't spotted?

Next on the list would be something like a SQL Injection vulnerability in one of your sites that he was aware of and is exploiting. For that to be the case though, the credentials in the code would have to be valid which takes me back to my first point.

I assume that when you mention speaking with your host that he doesn't have physical access to the host server? If he has that, there probably isn't much you can do remotely.

1

We are 2016 now so I assume this was solved or they went out of business but for the benefit of a fireside chat...

My professor used to have a saying - "it's always the 5cent solution that undoes you" (He was talking about always keeping handy little cables and attachments but I expanded upon it with my program debugging)

I've been developing since 1995 - Always look for the simplest answer ("Occam's razor") - When looking for causes - If the cause has no fix, THEN THAT'S NOT THE REASON - Engineers will grill me for this but think about it, WHY would you be spending resources looking at a cause that would mean months of work when your project is due in two weeks. IF IT IS THAT YOU'RE PRETTY MUCH SCREWED ANYWAY - move on and use your time wisely.

You're talking about the security of a server that millions of people have used for Years - Remotely accessing a server that is used by large companies. Do you really believe that the Freelancer has figured out a way to get around that? USE YOUR CRITICAL THINKING - If he COULD do that he wouldn't be working for you he would be working for the NSA...

NO

He's not accessing it - He's left something in your system that accesses a key on his server or there is a time delayed script that is running which he had been regularly disabling. Does the event happen at regular intervals? Did the second event happen immediately after the next day?

Changing the password and stopping remote access becomes irrelevant if something was done to your code before this was implemented.

Always apply context to a problem - Critical thinking. "Explain it to me like I'm a four year old". Most engineers always seem to be looking for complicated reasons because they think that way. I always ask the graphic artists what they think and by the time I've explained it to them the solution often either presents itself or they have thought of something that most Engineers would not have come up with.

...Think of the story of the truck wedged under the bridge and the little boy that suggests "Why not just deflate the tyres?"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.