Category Archives: Site Security
Is your website hackable? Why you need to worry (Page 1 of 3)
Apocalypse Now
Just because you think your data is safe does not mean your database of sensitive organization information has not already been cloned and is resident elsewhere ready to be sold to the highest bidder. To make matters worse, only recently, it has been discovered that hackers are not simply selling your; theyre also selling the fact that you have vulnerabilities to others be they hackers, industrial spies or terrorists.
It all sounds apocalyptic, doesnt it? Well, rather than being an angel of doom, Ill let the stats speak for themselves.
TJX Companies Inc.,
TJX Companies, owners of T.J. Maxx, Marshalls, Winners, HomeGoods, A.J. Wright, and Bobs stores, on the 17th January this year, disclosed that 40 million of their customers credit and debit card details were stolen. In parallel, federal credit union SEFCU published a similar warning that the personal details of 10,000 of its customers were compromised in the hack attack.
Another 60 banks including Citizen Union Savings Bank and Bank of America seem to have customers whose credit and debit cards have been breached in this attack.
Ben Cammarata, Chairman and Acting Chief Executive Officer of TJX Companies, stated that the nature of the hack is not known and two computer security experts are at hand examining the problem. The warning issued by SEFCU sheds greater light and states A fraudster may have gained access to
card information through one of those entities in the payment network, including the merchant.
SC Magazine reports that hackers used data from the breach to purchase goods in a number of states in the US, in Hong Kong and in Sweden.
A digest of the latest developments follows:
* According to 3WCAX-TV Website, the attack is expected to cost consumers one-point-five (M) million dollars. This article was published before law suits started sprouting. * Brian Fraga, Standard-Times, reports that a class action lawsuit filed this week in U.S. District Court (Boston) against TJX. The amount of damages sought is undisclosed. According to SC Magazine, yesterday a West Virginia resident slapped another lawsuit and is suing TJX for $5 million. * U.S. Rep. Ed Markey, D-Mass., chairman of the House Subcommittee on Telecommunications and the Internet, has called for the Federal Trade Commission to investigate the hacking, according to a eport today in the Boston Globe. * Today, the Government of Canada, stated that it is launching an investigation into TJX and the data breach. * Of note is that the hacking may have started in May 2006 and the breach was discovered only in December 2006 (and publicized in January 2007).
Universities
University systems are usually highly decentralized which makes it hard to ensure tight security. To the extent that one department may have deployed a hardened security infrastructure while others loll in lax measures making the whole system weak.
Security – Keeping it Off the Web (Page 1 of 2)
The topic of website security is seldom brought up among non-programmers and those who may not be technically inclined, yet if you operate a website, it is an issue of substantial concern to you.
Addressed in this article is a nearly universal problem, it affects almost every single PHP or CGI script I’ve ever seen. We won’t delve into the technical issues too far, this is intended for the web site owner, someone who might install the occasional PHP file or CGI script. I will assume you are not a software developer.
A general rule I like to follow when installing php scripts or web applications is this: If it doesn’t need to be on the web, it shouldn’t be there. This is obvious, but it has implications that are not always clear.
What we are mainly referring to is configuration and to a lesser extent, program libraries and source code. It may also apply to files and other resources that are controlled through a script interface. An example of this would be scripts that charge money for downloading files or set up newsletters. Lets start with an example, we’ll call it program.php. In our example, program.php is a database application using mysql to store information.
For our script to do it’s job, it will need access to your mysql password and user-name. It may also need access to many other program files and so-forth.
During installation, a control panel probably asked for your mysql credentials, it may even have asked you to change the file permissions on a configuration file of some sort. You’ve probably been through this type of install process at one time or another.
What it will do next, is write your database password and other private information to a configuration file. This usually happens without your knowledge, it is also where our problems begin.
Most people don’t catch this right away, if the configuration file is in the same directory (or sub-directory) it is web accessible. Quite often it is a php file, usually with write permissions turned on.
The extension .php does afford some degree of protection, under normal circumstances these files aren’t sent to a visitors browser but it is still unsafe.
If someone makes a slight mistake in the configuration or .htaccess file, it will dump the actual contents of “conf.php” to the users web browser, complete with your database password and other private information.
As anyone who has been around web servers very long can tell you, this is a common occurrence. I’ve personally seen it happen on several occasions.
Furthermore, many other web editing tools need to create backup files, resulting in something like config.php.BAK or perhaps config.php.tmp.
We now have a file ripe for hackers and other would-be intruders to gain access to your mysql database passwords as well as any other private information kept there.
What is most alarming is that almost every single off the shelf web based program exhibits this very problem in some form or another.