PAP Community Foundation's website hacked by 'The Messiah': report

For sensitive public website, some good design will help :-

(1) Server and Operating system hosting sensitive public web - should be hardened - whereby all sensitive files must be locked for readonly and not writable and unessential services are properly disable. This prevent malware from infiltrating and attempt to alter system files, change registry parameters and settings, steal information, change password, take control of servers, alter web page without authorisation etc.

(2) Servers are connected through 2 sources - inband (that are public facing) - read only and not writable or very limited write access for eTransaction only. Out-of-band (OOB) - that are only accessable by Administrator with full access right. OOB is internal for server and web management - and not accessible by the public. Public - can only access via inband connection with limited or no write access - that why cannot deface the web page.

Alteration of web pages and services can only by done through OOB and not in-band.
(Note:- Inband and OOB are not routable to one another.)

(3) Use jump server or internal dedicated station to do updating of web services or perform admin function to the servers. Remote administration are disallowed and will be revoked. Thus no way for hackers to hack.

(4) Introduction of 2-factors authentication - even if hackers are able to steal the admin id and password, it still will not be able to access the server and web services to do damaged because another factor of authentication is required.

(5) Make use of directory services with another machines issuing digital certificate to authorise access. Hackers even though can hacked into the directory services with admin right will not have the right digital certificate as it is issued by another machine acting as Certificate Authority.

(6) Use CSP - Critical System Protection - to detect unauthorised hacking, do protection of all server files, detect malware infiltration, do intrusion detection and prevention, prevent web defacement etc.

Hackers who are able to deface a web page in 9 minutes means hackers is able to break and access the server with root admin password (unless the server did not change the factory default admin password) - taking full control of the server in minutes.

Hackers is also able to break the web page admin password - usually no default admin - which means this hackers is very skillful - could be using hacking tools that crack password.
(Oops sorry, with full admin right to the server, hackers will just replace the original web page with his own defaced web page - no need to crack the web page admin password. Think to deep and give the hackers too much respect.)


(After note :-

Of course doing all will be costly - which is meant for eCommerce.

With limited budget, doing some of those mention above - without the use of CSP will be very cost effective - and good to prevent or mitigate what the hackers can do.)