For this implementation we are using DHIS2 version 2.12 build 11312. This version will be upgraded to version 13 this evening.
Java version 1.7.0_25 OpenJDK 64 bit server Ubuntu 12.04.2. On Thu, Feb 6, 2014 at 12:00 PM, Knut Staring <[email protected]> wrote: > Hannan, which build of DHIS2 ? Which Java version? Ubuntu? > > Sent from my mobile > On Feb 6, 2014 6:29 AM, "Hannan Khan" <[email protected]> wrote: > >> Dear experts >> >> Our main DHIS2 implementation (mishealth) for the health sector was >> hacked yesterday evening, around 4:30 PM local time. After login by any >> user it showing the attached message. We immediately stop the tomact7 >> service and check the database. We find the database is intact. >> >> After investigation I find that the hacker inserted three files to do >> this. >> >> First file "index.html" contain an alert "alert("Admin, You Are Hacked by >> Malaysia Hacker!")" and a body text <h1>Hacked by BadCat</h1>. Which was >> placed in the application folder /tomcat7/webapps/mishealth/. >> >> Second files "index.html" contain another script which redirects to " >> pastebin.com/raw.php?i=LZEdbBz6" was placed in >> the /tomcat7/webapps/mishealth/dhis-web-commons/security/. >> >> Third file "guige.jsp" is contain a script was placed in >> the /tomcat7/webapps/mishealth/dhis-web-commons/security/. >> >> For our server, it seems that only first file is executing after login. I >> find few more suspicious files which I am investigating and will share with >> the experts in next few days. >> >> I configured the server with only external open port is 8080. Other two >> ports (SSH and WEBMIN) are open for internal IP only. External access is >> possible only through VPN client. According to the firewall maintaining >> vendor, that hacker might access through 8080. How we prevent and secure >> that? >> >> I configure the database in other server and that server is only >> accessible through one private IP block. The tomcat server, the backup >> servers and our administrator/development team are in that block. >> >> Now please suggest how can we secure our servers more. >> >> Regards >> >> Muhammad Abdul Hannan Khan >> -------------------------------------------------- >> Senior Technical Advisor - HIS >> Priority Area Health >> Deutsche Gesellschaft für Internationale Zusammenarbeit (GIZ) GmbH >> House10/A, Road 90, Gulshan 2, Dhaka 1212, Bangladesh >> >> T +880-2- 8816459, 8816412 ext 118 >> M+88 01819 239 241 >> M+88 01534 312 066 >> F +88 02 8813 875 >> E [email protected] >> S hannan.khan.dhaka >> B hannan-tech.blogspot.com >> >> >
_______________________________________________ Mailing list: https://launchpad.net/~dhis2-devs Post to : [email protected] Unsubscribe : https://launchpad.net/~dhis2-devs More help : https://help.launchpad.net/ListHelp
