help with a hacking problem. please

Noobaside · 20 Dec 2011 at 11:30

for the past week weve had a hacker trying to gain access to one of our servers and we have been blocking it quite easily but hes just started another attack on the server but its not showing any ip adddress any idea

1 what hes doing to mask it and 2 a way to stop it as its rather annoying

Noobaside · 20 Dec 2011 at 11:55

well he managed to gain entry to the server last week due and setup a porn hosting site on the server so im pretty sure its being targeted. <--- has been rectified.

its a ftp server so theres always people trying to access it

its a dos attack

and the security logs show incoming failed password attemps as originationg from ip: - just a single dash before they where originating from proxys.

EDIT: hopefully thats enough info sorry for the lack of info in op am currently really busy at work only an it aprentice atm

everyones out of office as a creditcard companys servers we look after went boom

Noobaside · 20 Dec 2011 at 12:06

we told em not to use ftp but some crappy software they use needs it and they wont change

and there passwords are audidted they just got lucky

Noobaside · 20 Dec 2011 at 12:25

the server died because we told them it had adequet failovers they wanted to test it so they pulled out power from back of the server while it was starting up and corrupted it luckily the failover did work

Noobaside · 20 Dec 2011 at 12:26

he logged on using an old account of somebody who had left who didnt have any admin powers

Noobaside · 20 Dec 2011 at 12:39

any idea how hes masking the ip though am curious gotta learn all i can

Noobaside · 20 Dec 2011 at 12:48

there not gonna change untill there forced to by some hacker who destroys there system .

Noobaside · 20 Dec 2011 at 13:24

ide love to learn how you lot do all this network security stuff is facinating to me

Noobaside · 21 Dec 2011 at 13:12

but its how to apply what knowledge i already have and knowing what gaps i need to fill in with research and asking questions.

Noobaside · 22 Dec 2011 at 10:13

KIA said:
Start experiment using a virtual machine.

i may just have to try that any suggestions on os's

Noobaside · 22 Dec 2011 at 16:06

oo never played around with linux might have a go with it weve got pretty much every type of microsoft server at work and one or 2 linux ones but never been envolved with the linux ones

but surely any password will be cracked if you leave the right program running long enough theres a finite combination of combinations you can have of the letters a-z and 0-9 even if you use caps

Noobaside · 23 Dec 2011 at 10:53

assuming its the last password it trys it could take 10 seconds

Noobaside · 4 Jan 2012 at 16:36

fixed admin acount has been deleted and a new one set up with a diff name

theyve got a new fibe connection now so the attempts that still trying to log onto the admin account arnt making any impact on the service