Unauthorised access

[rincewind44]

Hi,
Is there any way for someone to access your web site server and change files without your permission.
I ask because I am working on a trucker site and the main page contains certain adds. Today the adds were replaced by other trucker adds without my permission (or the permission of any one else in the company). The page code affected consists of javascript (to preload and rotate the images) and the a html table which creates the layout for the adds. Only the html code was changed, the javascript was not. The original adds were not deleted from the server, the new adds were just added to the folder and the page code changed.
Aswell as the code pointing to the images being changed, the following code was added just before the </body> tag
<p>
------------------------------------------------------
<!--webbot bot=&quot;HitCounter&quot; b-reset=&quot;TRUE&quot; u-custom i-image=&quot;4&quot; i-resetvalue=&quot;42589&quot; PREVIEW=&quot;&lt;strong&gt;[Hit Counter]&lt;/strong&gt;&quot; i-digits=&quot;6&quot; startspan --><strong>[Hit Counter]</strong><!--webbot bot=&quot;HitCounter&quot; endspan i-checksum=&quot;10367&quot; --></p>
-------------------------------------------------------

Has anyone encountered this before and more importantly how do I prevent it from happening again?
Thanks

 

[wbg34]

Yes it is possible to do that there are a number of known exploits available that can do this depending on which webserver you use. Can you post the name of the webserver and the version that you have installed. It will be easier to point you in the right direction with that info.

 

[rincewind44]

Thanks for the help,
the server is a Windows 2000 server running IIS v5.0. is that the info you need? I'm more web design than a server person, (I deal with a tech support team to control the server)

 

[wbg34]

Well, you're in for alot of reading then. Fortunately theres a good deal of info out there on securing Windows IIS. Your first step should be to make sure your server is up to date on it's patches. Windows update is a good place to start.

http://v4.windowsupdate.microsoft.com/en/default.asp

You can then check Security focus to read up on the latest vulnerabilities and necessary patches.

http://www.securityfocus.com/

Microsoft has a good set of guides on securing IIS

http://www.microsoft.com/technet/tr...ecurity/prodtech/Windows/SecWin2k/Default.asp

But I really like the NSA's guides and policy templates for Windows 2000.

http://www.nsa.gov/snac/win2k/download.htm

 

[rincewind44]

Thanks for the info.
Is there anything I can do as I web designer or should I just contact my server tech support people and ask them to take the necessary steps?

 

[wbg34]

You can go to windows update to see if there are any glaring IIS patches that are needed (You dont have to install them but you will have an Idea of what is needed). I would contact your server techs as soon as possible because the next break in you get may not be a simple change to your web page.

 

[rincewind44]

Nice1 thanks,
I'll get started on it now,
Thanks again