Who faced bitcoin ransomware database?

Question

Burglary protection

In general, yesterday in the morning I was knocked from the bottom, having lost the databases on the server, and leaving a note instead of the old databases:

INSERT INTO `WARNING` VALUES (1,'To recover your lost data : Send 0.05 BTC to our BitCoin Address and Contact us by eMail with your server IP Address or Domain Name and a Proof of Payment. Any eMail without your server IP Address or Domain Name and a Proof of Payment together will be ignored. Your File and DataBase is downloaded and backed up on our servers. Backups that we have right now: biysk,blawknox,belgorod,albajar,alaskadiesel,ashok,avia,barber-green,auwaerter,blog,bernard,buffalospringfield,armavir,belarus,caterpillar,balakovo,baycityshovel,bova,balashiha,adams,austinhealy,benford,bolens,bautz,bentley,berdsk,bluebirdbody,autodiesel,bantam,benfra,abg,bryansk,ausa,aveling-barford,agriful,agrale,belaz,casagrande,acura,bray,angarsk,ag-chem,bandit,carrier,bristol,astrahan,abakan,bell,bharatearth,american-motors,buick,bw-lathrop,ceccato,bataysk,austin-western,benati,blagoveshhensk,barnaul,braud,arzamas,ahlmann,brunogenerator,ankai,bmw,autokraz,astra,bedford,bitelli,allis-chalmers,akerman,ayyedekparca,achinsk,almetevsk,albaret,berezniki,cbt,audi,bratsk,blount,atlasweyhausen,carraro,arhangelsk,cadillac,bussing,camc,catalog,bks,athey,asiamotorwork,aksa,bmc-trucks,agco,baudouin,avant,allison,ayerbe,beibentruck,best-winner,artem,ammann . If we dont receive your payment,we will delete your databases.','1HXnLWN8Bi8nKAhTg1YqtGWZ2KttHhiDZF','[email protected]');

At the same time, when I started to figure it out, I saw the GRANT PROXY privilege for the root user, which these sodomites also created, thank God I make backup copies every day, I restored them, cut off access completely from the outside, removed the presence of a grat proxy from the root, changed passwords for everyone accounts, everything was fine exactly one day, today I was knocked for the second time having already lost 100 databases, in the vastness of Google there are a lot of abuse reports on this topic, but there are no solutions to eliminate the root of evil anywhere, the question can anyone encountered such a problem?
Enabling general_log in mysql generally gives little information

Answer 1

Have you been hacked and not qualified to investigate a hack?
We make an image of the switched off system from the outside and back it up for ourselves (why? Perhaps you will find someone who can investigate)
We take a list of software and remove from it everything that is not required for the service to work
- phpmyadmin, ftp, just examples of such software
We demolish the OS (consider that it is compromised root and all the OS tools)
And we install according to a good manual with a fair amount of paranoia (most often one article will not help - take your notes during installation) We
isolate everything from everything
as
much as possible client and server side)
Your cms and scripts should be updated regularly
Keep track of the logs - often hacking occurs within a few days and a simple grep on the logs will show who you need to ban by ip and where to put the captcha
The fact that you have backups makes your situation many times better

Answer 2

Close all access to the database from the outside. MySQL should only listen on local addresses.
Access to the server should be only via ssh with a key, not a password.
Remove PHPMyAdmin, set up SQLWorkbench with access via ssh tunnel.

Answer 3

In general, there is zero information in the post, but I see there is a phpmyadmin tag, maybe it's in it? there is some holey version. However, I don't understand how to use it at all.

Answer 4

So the hole is not in the passwords, but most likely they break through the CMS or in some other way gaining root privileges.
Disconnect the server from the tyrnet. From the word at all, leave only the console.
Merge the system image for further study.
If a host with a raid - disassemble the raid and reassemble it with a different order of disks, recreate it with raid formatting.
Reinstall the system, take only text configs from backups, and then after they have been viewed. Distrib merge from the original server with rechecking the checksums.
(All of this is to ensure a clean installation machine and a clean distribution)
As few services as possible outside, all services on non-standard ports, everything that is authorized by keys or certificates - you need to use only with keys / certificates
Constantly look at the logs - there will probably be more attempts.
Yes, some points give away paranoia :) But healthy paranoia is better...

Answer 5

lord these crypto-ransomware in tyrnet to the bulb.
Perhaps you need to set up a security system ??
to prevent the left from going where it is not necessary.
or not ??

Answer 6

https://www.phpmyadmin.net/security/PMASA-2019-2/

Answer 7

As far as I understand, from your story, the attackers created a user who was given root rights. You were hacked using SQL injection, and they injected something like this:

CREATE USER 'intruder'@'localhost' IDENTIFIED BY 'intruder_password';
GRANT PROXY ON 'admin'@'localhost' TO 'intruder'@'localhost'

completely cut off access from the external network, removed the presence of a grat proxy from the root, changed passwords on all accounts, everything was fine exactly one day ...

These actions did not help you, because you did not eliminate the reason - the possibility of injecting SQL code. To do this, you need to configure the filtering of incoming data and requests. For example, using the built-in PHP functions:

$_POST[$_post] = mysql_real_escape_string($_POST[$_post])

And in this way you need to filter out all the "weak" places in your code. You can find them using the SQLMAP utility for linux or use an online scanner like METASCAN , it will show not only SQL vulnerabilities, but also check the site for XSS, noSQL, CMS vulnerabilities, and also check the entire infrastructure as a whole.