Dear all,
I just wanted to share a little story/discovery with you that I just made.
A few years ago I set up two servers for a project/web-shop that a friend of mine was starting. He was a PHP guy so all my alarms went off when he said that he wanted to take care of the servers. Being friends since school-time I offered to install and secure them so that he could focus on the coding. That was back when Debian 4.0 was new
We had it all, GRsecurity-kernel, chrooted-Webserver, you name it.
About two years ago he sold the project to some other guy I don't really know who took over the whole thing. That's when I stopped caring about the boxes, they were no longer my business. When that guy came into financial trouble and asked me if I could somehow lower the server-costs I virtualized the two boxes onto one new host which saved him a bunch of money. Don't ask me why but I somehow did that for free although it was quite some work.
Fast forward to today: He migrated the shop to a managed server and last weekend we also migrated his email service. Checking out the VMs one last time before shutting them down for good I wonder why the load on the web box is 1.00 although it is no longer in production. Turns out somebody root'ed it with an Exim exploit (that's why I usually install qmail !). It was also talking to some random IRC server and probably trying to break some hashes or mining bitcoins. Who ever did this didn't put much effort into hiding his trails. The last log shows some german DSL/dial-up IP, there is a second sshd running on port 50000-something and "ps" and "netstat" seem to be fully functional (I didn't bother to check the signatures).
Morale of the story: It doesn't matter how secure your system is when you deploy it. If you put zero effort into keeping it secure you will be caught with your pants down one day.
