News for hackers. Stuff that matters.

A comment on One of my Drupal sites was hacked. Parent comment

Re:One of my Drupal sites was hacked by _asciiker_ on Wednesday April 30, 2014 @03:19PM (#7675674)
While I agree in principle that when owned one should start from scratch, my advice would be to learn something. Often I am asked to analyse attacks and I now have a collection of about 15 malware scripts that not only show me the intent but they are also useful (and remarkably well coded) for my daily admin tasks.

So, fresh start but at least get something out of it!

[ Parent | on HN ]
Re:One of my Drupal sites was hacked by midas007 on Wednesday April 30, 2014 @05:08PM (#7676456)
"and the 'sploit can be mitigated before bringing it online to the outside world"

You should read more carefully.

Also, keeping people waiting without an ETA for a down service because you're learning isn't going to result in happy customers.

Furthermore, whomever is running these boxes needs to deploy NIDS and HIDS and properly secure their boxes, because clearly they don't understand what an attack surface is.

[ Parent | on HN ]
Re:One of my Drupal sites was hacked by tptacek on Wednesday April 30, 2014 @06:55PM (#7677035)
Yes, whatever your security problem is, I'm sure some NIDS will clear it right up.
[ Parent | on HN ]
Re:One of my Drupal sites was hacked by midas007 on Wednesday April 30, 2014 @06:56PM (#7677049)
What a flippant, uncivilized, unconstructive comment.

Defense in-depth, every little bit helps.

[ Parent | on HN ]
Re:One of my Drupal sites was hacked by tptacek on Wednesday April 30, 2014 @08:33PM (#7677445)
Disagree, both in spirit and to the letter; for starters, I'm pretty sure there's still validity in a very long blog post I wrote about NIDS back in 1998:

http://insecure.org/stf/secnet_ids/secnet_ids.html

People running SAAS apps probably shouldn't waste much time with NIDS.

[ Parent | on HN ]
Re:One of my Drupal sites was hacked by fyrabanks on Wednesday April 30, 2014 @07:36PM (#7677229)
I'd assume s/he would isolate that machine for post-mortem and spin up a new service on a different box, unless we're talking poverty IT.
[ Parent | on HN ]