Is My Site Hacked?

Data Breach? Privilege misuse? Stolen money? Do you really think that your web application has never been breached? Here are ways to find out.

Not all data breaches make it to the newspaper headlines. Some remain dormant and hidden for years. Hackers use them as backdoors to collect and circulate information or to look for other loopholes. The questions here are- How would you know if an application has been hacked?

Log Entries Have Unexplained Entries

When application log messages are checked and monitored properly, they tell a lot about access, location, and time. Most companies are either too busy to scan through these logs or just do not care. The following are some of the signs that can help find out if there is something wrong with the application.

• Multiple errors within a short span of time are a big sign of someone snooping around the web application. The hacker might have found SQL injection loopholes. Locate where the queries are coming from and make sure that inputs are validated.
• Log information on internal file transfers and web servers communicating to user machines is critical too. While security experts place all their focus on external threats, it can be a sign of someone already in the network through the application and now moving inside.
• Application log should ideally create entries for admin activities, user account setups, and changes. It ensures you log everything even when attackers create random backdoors and accounts.

Web Application Performance Change

The easiest way to find and report an application breach is to monitor what it is supposed to do. Comparatively slower request processing, increased time in loading pages, a sudden surge in traffic, or a number of orders are some of the red flags every website owner should be aware of. While such indicators do not necessarily point towards a hacking incidence, it is never a bad idea to look at what’s wrong rather than waiting for the obvious signs.

• Is the application redirecting website users to a different or unknown page? Look for malware that can alter page function. Also, check if something in the database has been changed.
• Slow or failed page loads may also be a result of a hacking attempt. Other than that, distributed denial-of-service (DDoS) can also affect application performance.
• Decide what’s normal behavior for an application and make sure that anything unexpected should be flagged. This should include business logic flaws that you can deal with Total Application Security.

Unknown Processes and Users

Process monitoring for web servers should be a critical task for administrators. Much like with our computers, processes tell us whether unusual tasks are being created to carry on specific jobs. More often than not, it’ll unveil hacking attempts at a very early stage.

• Check server processes at random, unusual times. If there are processes associated with an application that you cannot explain it’s time to get down deep.
• Make sure that you keep a tab on the number of users added, dormant accounts, and their privileges. Often hackers make use of stolen credentials or use brute force to reveal the admin passwords.
• Windows servers’ scheduled tasks and Linux servers’ crontabs help to find additional tasks and processes.

Frequent Warning Messages.

If some pages of your website are redirected, defaced, or hosting any kind of worm/malware, there are chances that popular browsers and search engines will pop warning messages. Google Safe Browsing is one of the tools that can help bring out such issues on the website.

• Set the blacklisting and other warning alerts at high priority in the administrator inbox. Make sure that they are addressed accordingly.
• While blacklisting is a sure-tell that there is something wrong with the website, it is advised that you do not wait for such warning messages. It is never easy to turn to blacklist around, plus it always damages the reputation of the company. Stop blacklisting with regular app scans.
• Proactive listening to customer complaints through social media and emails can also provide warning signals if some customers complain of malware or forged access to their user accounts.

Changed Web Application Files

Timestamps on web application files help you find out if it has been edited or deleted recently. In most hacking cases, security experts find that files that are untouched for years suddenly have a new edit date. If developers and website administrators look for such changes and then compare the newer and earlier version, it reveals application vulnerability or malware on the server.

• Too many new files on the server or in webroot should be investigated further. These files can use the application to redirect users or even run scripts on their systems.
• Whenever third-party variables are involved with the applications, it is important to ensure that updates and other downloads aren’t automatic.
• In some of the recent data breach incidences, hackers have created completely new directories on the server and installed a new application. Make sure such changes are addressed proactively.

Emergency Alerts

Web application firewall (WAF) is one of the better ways to gain attack insights and ensure that hackers cannot use these methods ever again. IP reputation check, incoming bot traffic, sudden high volumes are some of the key red flags used by WAF to detect hacking incidences.

• Scan firewall logs, especially web application firewalls to run an IP check. If a large number of requests are coming from IPs with a bad reputation, you can block it.
• Intelligent web application firewalls also provide insights into bot traffic. High volumes of such requests can be identified and blocked.
• Apart from protection, the web application firewall is an integral part of the learning process. It helps monitor evolving attack patterns and develops smart policies to protect applications.

Stay tuned for more relevant and interesting security articles. Follow Indusface on Facebook, Twitter, and LinkedIn.