In this forum many user talk about virtualbox,vmware, to isolate the server from the system.And Protecting Hidden services .onion private key from your host its better to store outside from that isolated place what the server is running.But i think it's not enough.Programs like Xampp,Wamp in windows try to install in system drive C:/.With this is the problem if this happend the attacker will acces the system in virtualbox.And they can install more viruses,and backdoor.I think its a way 1. to put the server in a encrypted file (like a VeraCrypt volume,2.Copy this file in the virtual mashine,+ encrypt the virtual mashine too with full disk encryption but with another keys what use the host mashnine.3.Mount this file and run the serven in a non system patrition drive.4 disable USB ports,block drivers,CD,DVD,ports,in virtual mashine block.Turn on network discovery to protect the system to acces back and forth to acces the encrypted virtual system or non system patrition drives.
How can i give more extra protection to protect the system in virtual mashine if the server are cracked like C99 shell,to block the attacker to acces in the operating system in the virtual mashine?
my resoults: Os:Windows 7
Server Xampp for window 7.1.2 / PHP 7.1.2
Tor 0.9.9.10
Run time 3 week
Service: hidden forum
The server installed in a non system patrition drive!!!
The setup:Another programs blocked.Port 80,MSQL allowed,another program activity blocked with firewall.The server installed in a non system patrition drive.Only the MSQL and Apache runned.
The 1. attack: The attackers scanned all bublic and non public URL-s what can accesable from a simple browser.Like server-info,server-status,and defaultly the hidden server information.They can acessed all links what possible available in normal browse without passwords or cracking the server.
The 2. attack: The attackers saved all this page informations and several times goes back some certain links which can contain major information like: User information,website public change information,. They have been saved and fallowed this status.
The 1-2. attack:Some robots constantly but slowly scanned the website.
The 3. attack:Cracking the server.After the first visitor.About 3 week later they have been cracked my server.They uploded a PHP vĂrus in the phpmyadmin folder.
What did this virus know?: This virus name was c99 shell.And the attacker renamed the file to abc.php They can search and download files not just the server but another patritions,portable usb,pendrive etc.Its have a web interface.Its looks like a website or a browser. Before this happend i enable all the xampp server cache moduls. This virus script upload the attackers through the server.But its somhow can not acessed the system patrition drive.