WebAlarm

Background

Website defacement is a popular activity among crackers. They want to leave a legacy by hacking and defacing a website. Although having a good firewall and intrusion detection system significantly reduces the chances of success, chances are that the better skilled crackers will find a way around your security perimeter, and still succeed in defacing your website.

What is WebAlarm?

WebAlarm is an advanced real-time web content monitoring and recovery system. It detects any unauthorised changes of web content and responds immediately by alerting the administrator and performing automatic recovery of original content. Since the detection is performed at file and directory levels, WebAlarm can protect any kind of static files,including HTML, graphics, Java, ASP and CGI scripts.

WebAlarm monitors your web pages to make sure that it is not modified or defaced. Once it detects an unauthorized change in the content of the website, WebAlarm immediately sounds the alarm, and notify the web administrator via email, phone or SMS. Best of all, WebAlarm recovers the defaced website instantaneously, by replacing the defaced files with the backup.

Features

Detection

• File and directory-level monitoring of web content
• Poll-based monitoring using hash signatures
• Detection of modified files
• Detection of deleted files/directories
• Detection of additional files
• Monitoring of native file attributes
• Quick monitoring mode (low system overhead)
• Event-based monitoring (Windows only)
• Attribute-only monitoring (UNIX)

Alert And Notification

• Email notification upon file tampering
• Email notification upon content update
• Daily report / error summary
• Logging of events
• Console broadcast alerts (visual and audio)

Backup & Recovery

• Archiving of web content
• Quarantine of tampered files for evidence gathering
• Automatic recovery of file content
• Recovery of file attributes (UNIX only)
• Recovery of file links and device nodes (UNIX only)
• Execution of custom programs and scripts

Administration

• User-friendly graphical administration console
• Single-point multi-server administration
• Remote administration (LAN/WAN/Internet)
• Support for staging server and secure content synchronization
• Remote file upload control, with timer and auto-accept
• Multi-user administration
• Multi-database (file group) support
• SSL communication channel