The document provides steps to take if a TYPO3 website has been hacked, including immediately taking the site offline, preparing a forensic analysis by backing up files and data, and restoring the site from backups after updating security. It also outlines information to gather about the incident and questions to consider, as well as recommendations for staying secure going forward such as changing passwords, keeping software updated, and hardening the server configuration.

1. TYPO3 website hacked - where to start, what to do - by Marcus Krause <marcus@t3sec.info>

2. Example: defacement

4. Prepare forensic analysis

5. Restore website

6. Information gathering

7. Report

8. Stay secure in future

10. Inform administrator or web hoster

11. Scan you PC for malware/spyware

12. No publicly discussion (forums, mailing lists; there is no help anyway)

14. Backup filesystem

15. Backup database

16. Backup logs

18. Restore website from backup

19. Clean up infected website if no backup is existing

20. Hire someone who will clean infected website

21. Update server environment / web applications (TYPO3 core, TYPO3 extensions)

23. Collect as much information as possible and report to TYPO3 Security Team

25. New attack vector?

27. What happened? (defacement, etc)

28. Where has it happened? (shared hosting, dedicated server)

29. When has it happened?

30. Strange data or behaviour?

31. Any other web application besides TYPO3?

32. Up to date in regards to TYPO3 advisories?

33. Versions of TYPO3 core & TYPO3 extensions?

35. web server access logs

36. PHP error logs

37. modsecurity logs

38. list of unexpected files or files with a strange access/modification time

39. OS logs (auth, audit, messages, secure)

40. IDS logs

41. AIDE/tripwire reports

42. Report [email_address]

44. Stay up to date in regards to advisories

45. Keep local PC clean

46. Use secured file transfer (FTPS, SFTP, SCP)

47. Use SSL / sysext:rsa to access administration interface

48. Harden your server (SELinux, chroot, CGI PHP, FCGID, suEXEC, Open Basedir, ModSecurity, PHPIDS, TYPO3 Security Cookbook)