Security Center:Defend against trojan attacks

What is a trojan attack

A trojan attack (also called a horse attack) injects malicious code into a server or website by disguising it as legitimate software. Attackers trick users into downloading or executing the code through iframes, JavaScript, HTML bodies, CSS, or other methods.

Common attack vectors include system vulnerabilities, SQL injection, and file upload vulnerabilities.

Impact of trojan attacks

A successful trojan attack gives the attacker access to your website and sensitive data such as user accounts, passwords, and business data. Visitors to the compromised website may also be infected, exposing their bank accounts, social media credentials, and other personal data.

Trojans can also destroy disk data, causing significant information loss. Overall, trojan attacks damage your website reputation, damage user systems, and leak user data.

Defend against trojan attacks

Fix vulnerabilities on your website and web servers promptly. Attackers exploit vulnerabilities in tampered web pages, browsers, and operating systems to inject trojans, then download and run additional malicious programs to expand the attack scope.

Protect your website with a layered security architecture as shown below.

Apply security measures at the following levels:

• Network security level

  • Use ECS security groups, CLB whitelists, and Cloud Firewall to minimize Internet-exposed service ports.

• Host system level

  • Use Bastionhost to manage ECS logon methods and grant O&M personnel only necessary permissions.

  • Configure strong passwords for your Alibaba Cloud account (at least 8 characters with mixed case, digits, and special characters) and change them every few months. Use multi-factor authentication (MFA) or SSH keys to log on to ECS instances.

  • Obtain security vulnerability information and regularly detect and fix vulnerabilities on your website and web servers. Install patches to operating systems and applications promptly.

  • Activate Security Center to detect and handle security risks, configuration risks, OS vulnerabilities, and middleware vulnerabilities on your servers.

  • If you use a third-party content management system (CMS) such as WordPress, DedeCMS, or Discuz!, make sure to promptly update to the latest versions and security patches released by the CMS vendor. Third-party CMS programs are widely used, and their known vulnerabilities can be easily exploited by attackers for malware injection attacks. We recommend that you:

    • Regularly visit the official CMS website to check for new versions or security patches, and download and update them in a timely manner.

    • Update the third-party plugins and themes used by your CMS to ensure they are also up to date.

    • Avoid using CMS versions that are no longer maintained, and upgrade to supported versions as soon as possible.

    • Back up your website files and database before updating to prevent issues during the update process.

  • Restrict file system access to only necessary permissions. Limit access to sensitive directories and restrict script execution.

• Database level

  • Do not use web-based tools to manage databases or expose your database management system to the Internet.

  • Allow only application servers to access database services. Block database ports from the Internet.

  • Configure strong passwords for the database services.

• Application security level

  • Harden web application middleware.

  • Perform code security tests and white-box tests before deploying to production.

  • Use Security Center vulnerability management to scan for and fix vulnerabilities before deploying your web system.

  • Fix program vulnerabilities promptly. Youcan use Web Application Firewall (WAF) to protect your web applications from external attacks.

Detect and remove trojan files

Use Security Center to automatically detect and remove trojan files. Manual identification among the large number of OS and application files is impractical.

Methods to remove trojan files:

• Delete web shells. Use Security Center to scan web directories and the agentless detection feature for a full scan. For more information, see Configure alert settings and Use agentless detection.

• Verify all vulnerabilities are fixed using the vulnerability management feature. For more information, see Manage vulnerabilities.

References

• Security Center detects and helps you fix security risks, configuration risks, OS vulnerabilities, and middleware vulnerabilities on your servers. For more information, seePurchase Security Center.

• Scan for and fix vulnerabilities promptly. Vulnerability management overview.