hey welcome back Tech later today I
wanted to talk about the various ways
that have been hacked
throughout the years running my own
websites and servers and though this is
not an invitation for you to try to hack
me I'm sure you probably could just
launch a DDoS distributed you know
service attack on my servers and that's
one easy way to just take down anybody's
projects although you know the hacking
generally is illegal but when you start
operating a website and you put
essentially a public IP address website
onto the network then you're exposing
that machine to the world to both good
and bad people you can see actually when
I tried to log into my server there have
been 6160 two failed attempts just
within the last day pretty much and you
know these are essentially just bas
they're just trying to every single
password combination that they can and
on my other server there were over a
hundred eighty-six thousand that failed
attempts in just three weeks so this is
going to be a bit of a technical talk
but could be useful if you ever plan on
running your own the web servers so
let's get into it
quick pause this video is sponsored by -
Lane - Lane is a password manager
endorsed by the Wall Street Journal in
New York Times Forbes a wired and more
they make it easy to manage everything
and fills your personal info like
addresses credit cards and passwords
they're top-rated on the iOS App Store
and recommended by both Apple and Google
get 10% of premium for the first 200
people at - Lancome / tech lead all
right so the first question you may have
is well our attackers actually tried to
accomplish here do they just want to
bring down your website your random
small little stupid project probably not
do they just want your additional
computing power maybe they're gonna run
some cryptocurrency mining BOTS know
they can just buy that what they're
really after here is your IP address in
order to send mail to other people in my
opinion many of them have been mail
spammers if they're trying to take
control of many other web servers out
there and then use those to just send
spam mail and so by sending spam email
through your reputable IP address
they're able to get better
deliverability on their emails and that
is where a lot of the value has been and
so this is the first way I've been
hacked and consistently almost every
time I tried to set up a custom mail
server using programs like send mail XM
some attacker always happens to try to
find a way to gain access into it
usually if I miss configured the
passwords authentication for our Waze
reports then someone manages
start sending tons of spam mail through
those then I get a notice from my server
company accusing me of abuse and they
give me 24 hours to either fix the
situation or they shut everything down
so this is usually what happens when you
tried to run your own mail server I
don't generally recommend it and so
these days usually what I do is I just
go through Amazon SES simple email
service and let them take care of other
security and authentication the sending
limits the reputation and just let them
handle all of the security issues with
that so let's get into the second hack
that I've dealt with and this was a
pretty tricky one and this was an ssh
hat now it's still not entirely clear to
me how the attacker gained access to the
system there could have been a zero-day
exploit maybe they managed to get into
the password I'm running tons of scripts
on my websites maybe one of them was not
secured properly they gained access
somehow but I found at the bottom of
several of my PHP scripts there was a
piece of code just added there that I
did not write and it was quite obscure
but it seemed like it could have
provided the attacker a backdoor access
into the system and I would have to
patch every single one of these scripts
otherwise the attacker could just use
any of these to gain access and so
that's what I did I just did find on all
of the system files and look for
anything that was weird and fix all the
scripts and so I thought that fixed it
but the next thing I knew next time I
logged into the system it was there
again and I thought okay well that's
where let me just fix everything again
but every time I logged into the system
I realized that the scripts would be
appended and so that's when I realized
that the whole SSH daemon that I was
using had been compromised I took a look
around the system and I realized there's
some zero-day exploit in which the
attacker could install a fake version of
SSH daemon so that every time I logged
in it would grant the attacker access
and not only that they had accessed the
password file et Cie / password and
added themselves as a user in this
system the name was something like sshd
it didn't sound very bad at all so
unless you have a very good
understanding of all the processes and
under workings of Linux and UNIX we look
at these and start looking for issues
it's not immediately clear to you where
the issue may be what's good what's bad
so here's what I did to try to remedy
the situation first I set up a dashboard
is like a website a script that would
check a bunch of internal files systems
processes and make sure everything was
running smoothly and that I could just
glance I quickly to make sure that there
were no malware running now this is a
good practice to have anyways I have a
dashboard I still check to this day
every single day just to make sure all
of my websites and projects are running
smoothly
I changed the port's that you can login
through to usually your SSH in through
say port 22 by default lot of these
malware machines they're just checking
on these certain ports so I just changed
that to another random port I made that
so you can only access the machine from
a certain IP address which is just the
area within my vicinity and I disabled
password access instead using private
and public key files which are stronger
and cannot be guessed as easily and none
of this is helped by the server being 10
years old by then I had acquired that a
long time ago I didn't keep things up to
date and so over time what I eventually
did was I just got rid of the server
upgraded it to a brand new one got the
latest security updates and the OS
locked down all the ports that SSH
access disabled the password
authentication system and through that I
was finally rid of that stubborn hack
now the third hack I've seen has to do
with the security through obscurity
where you may not see certain files
folders URL paths but an attacker can
try to guess at certain URLs and gain
access into a system that way so one
common practice I've seen is that
usually there's like a gift path within
your directory if you're using the get
to provisioning control system and the
type of will just go to your URL and
access slash git and if you did not
secure your git repository then they'll
be able to get access to all of the
source code and I've received security
reports from thankfully friendly
researchers who I think what they do is
they just scan the internet for all the
URLs and check for these security
exploits and email the web administrator
about these so that they did get those
fixed throughout the internet now the
fourth hack I've seen may be something
you're familiar with as well as
sanitizing user input so anytime you
have like a website or project where
you're allowing the user to input
something maybe they can tweet something
well if you don't send that as the input
then you could be allowing anyone to
input code into your system it could be
as simple as say some HTML codes to just
both or italicize some text and use your
contractor is your a sequel injection
attack where
they use a quote to escape out of the
user input area and then append
additional commands to modify the
database are getting access into it and
I've seen some people they can actually
gain terminal access SSH access into a
system if the user input is used for
some internal shell command the best way
to secure yourself against this is to
make sure that you're sanitizing all
user inputs but even at that rate you
could be four therefore you can miss one
line here and there and then your whole
entire system could be compromised which
is why you may opt in for like a web
framework that will sanitize all user
inputs for you automatically so there'll
be less of a risk moving on to our fifth
security hack this is about passwords
and it's really more of a tip that if
you're storing passwords you should not
be storing them in plain text usually
what you want to do is hash them such
that if your database ever becomes
compromised you're not just leaking the
raw plaintext passwords of all of your
users when you hash it you can at least
obscure some of the details and
especially if you're using a password
salt so you first append some string
that you know to the users password and
then you hash that whole set together
that really obscures that such that even
if the hashes get leaked and another
website somewhere else is using the same
hashing algorithm that the password saw
at least will be unique to your own
domain your own project and so that will
protect the users credentials from being
leaked at least elsewhere beyond your
own website and even if you have a
password authentication system attackers
may sometime try to just brute force
their way in by randomly guessing a
number of common passwords so in this
scenario you can either rate limit the
passwords or implement like a CAPTCHA
system overall though my recommendation
may be to not even implement a user
authentication system if it works for a
project just use like google firebase
authentication Apple ID Facebook Connect
something like that and then you don't
have to deal with the headaches of
securing your authentication system now
my sixth security tip has to do with
making a website more secure for your
users especially anytime you're trying
to collect the payment you want to make
sure that that connection is encrypted
over HTTPS so these days many websites
are served over HTTPS but if they're not
just using standard HTTP then that
Internet traffic is unencrypted
and the attacker can be sniffing on that
Network and read all of the Internet
traffic you said they like your
passwords credit card details so one way
to quickly secure your web application
is to get an SSL certificate personally
I use this open source project SSL and
they just get free certificates from
let's encrypt so then you can enable
your web application for HTTPS
encryption over the Internet
now moving on to the seventh way I've
been hacked and this may have happened
to some of you as well if you've ever
installed your own WordPress blog
website they you know that WordPress has
so many security issues and every now
and then one of your WordPress websites
or blogs they just get compromised and
then they usually issue some security
patch but it's a lot of maintenance and
especially if you install some WordPress
blog or website and then you forget
about that you don't go back to it
you've essentially installed a security
loophole into your system what I've done
is I've gone through and scrubbed my
entire system of WordPress blogs
websites and plugins and any other
projects like free bulletin board
systems free blog websites and so my
overall recommendation here is well you
can also just pay WordPress a small fee
and they'll host your blog for you and
they'll make sure that it is completely
secure you don't necessarily want to be
the person managing running and updating
all of your own email servers your
websites your blogs
chat servers because that could be a
security risk and if you do run these
services then you need to be willing to
put in the time to keep these updated
and maintained and one more tip cents
you never really know if you're secure
there could be zero day exploits then it
may help to make backups so get another
machine copy all of your data user data
project files over to this machine such
that even if one machine is compromised
then you're still going to have your
data and you'll be able to restore it in
the worst case scenario your data is one
of your most important assets so secure
it with dashlane a top password manager
endorsed by The Wall Street Journal and
New York Times - Lane generates super
secure passwords plus auto password to
store are encrypted making it a super
safe place to store your information
here's why it's so secure - Lane stores
and decrypt your information locally on
your device using your master password
so even if someone did manage to hack -
Lane itself it would be like breaking
into a bank but not being able to open
any of the vaults because not even -
Lane has the keys only you have the key
to the vault
so unless you go around
your master password your information is
always safe this is their patented zero
knowledge architecture they also have a
VPN so you won't be tracked when you're
browsing the Internet and can access
content in any country and they monitor
the dark web for password leaks alerting
you if any of your personal information
may be available to spammers and hackers
so check them out and get 10% of premium
for the first 200 people at - line.com
slash tech lead so they'll do for me for
now and I would appreciate if you don't
try to hack me because I don't need the
additional work and let me know if
you've ever been hacked or have any good
security tips if you enjoyed the episode
please give it a like and subscribe
follow me over on the Instagram at tech
lead HD and I'll see you next time
thanks bye