Over the years of working on ColdFusion servers for CF Webtools I have encountered many servers that have been breached (hacked). In most cases the cause was for lack of better description "user error". I say user error because no one properly secured the server when it was installed, no one maintained the server over the years of use and no one was checking to see if anyone had tried hacking the server.
Then something BAD happened that caused EVERYONE to notice the server was breached. Maybe it was your credit card processor informing you that customer cards are being stolen when they purchased from your online store? Maybe it was your servers IP being black listed because it was spewing tens of thousands of spam emails? Maybe you were notified that your medical website had been breached? Maybe it was a notice from the FBI that your server was part of a list of servers that were known to have been breached. Those are NOT good days!
Many times these companies contact CF Webtools for our expertise in resolving breached servers. When they do Mark Kruger, aka. ColdFusion Muse sends me in to investigate, record any data/forensics that I can and mitigate the situation while we simultaneously build a new server for the client. Usually this is what it takes to recover from a breach.
Over time I have collected a large number of 'hack files' that contain the code to breach a website and steal credit cards, entire databases, or even load malware onto an unsuspecting users computer. These files are typically found in an unsecured CFIDE folder. Here are a couple examples.
If you happen to see anything that looks like those files then the server has been breached. If your team is properly securing and maintaining your ColdFusion servers you should never see anything like this. However, if you are seeing files like this in your CFIDE folder or files in your website that are unaccounted for, then it's very likely the server has been breached.
Now what? That is a very open ended question. The first thing to do is accept the fact that it happened and understand that it's happened to companies that are far bigger and with much bigger IT budgets than yours. Remember Target? Now you have to figure out how the breach occurred, determine how much was breached, mitigate the breach as best as you can and then in most cases start building and securing new server(s). It's my belief that once a server has been breached we can never be 100% certain that we've found everything that was put on the server by that breach. Once you have a clean server then you clean and migrate your code and other resources to the new server. This can be a huge and daunting task especially if you have a minimal IT department or none at all.
If no one on your IT team is responsible for maintaining the servers and/or your hosting company isn't maintaining the servers then, who will? Who will make sure they are secure? We will.
Who you Gonna Call? CF Webtools!