Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Consider (usual scenario) You own a Shopping Cart Website and hosted on Internet, now, your hosting company provides you database to store your data. If talking about security, we need it for:

  • Securing Files and Folders on the server (Access Permissions).
  • Database: Securing the database with password.
  • Programming: Securing the shopping cart (Securing the web application).
  • Data in transit: Securing the data in transit such as (user registration, payments, invoices, etc) when client sends to server, and when server sends responses to the client (forms, order history, user profile, etc)

The big question: how to ensure integrity?

  • Determining Unauthorized Access that modified or tried to modify data?
  • Determining Authorized Access that tried or did unauthorized actions?
  • Determining whole system integrity

DB For instance, data that saved in database such as MySQL and MSSQL are not encrypted, its considered secure on the DB server, also for hug rows, encryption decreases the performance and if attacker get access DB server, he can also get the private key.

Files and Folders Lets consider that we encrypted all files that doing critical actions (such as Access Control, Data Saving, etc), now, by any way, if attacker get access to the server, he can add one line to send all ($_POST, $_SESSION, $_COOKIE, and $_GET) to an email.

Data In Transit Consider that SSL is implemented, but man-in-the-middle-attack can get a copy of traffic (this is possible). How many networks between me and stackexchange.com now? thousands! Me -> My ISP (Clients -> Core -> Border Routers -> Foreign ISP -> Foreign ISP -> Stackexchange Data Center -> Some Cluster or any other model -> Stackexchange) How can we ensure that the data between these networks not modified?

Just see this image! which currently available its not just idea: SSL ATTACK

At this point: I am asking is there any mechanism for better security for Web Applications that depends always on data in Transit? I hope to get some answers that passes me in this sadness about security :(

share|improve this question

1 Answer 1

up vote 1 down vote accepted

Keep everything encrypted with SSL with a properly signed SSL certificate from a trusted CA. Web servers/certificate authorities should not give away their private SSL keys, similarly web browsers should only trust a minimal set of respected certificate authorities.

This prevents eavesdroppers from decrypting/altering1 communications.

1 Well they could drop packets or randomly alter a packet, which with very high probability would result in the packet being undecryptable (equivalent to dropping a packet).

Tineye says your image is from: http://www.edecision4u.com/HTTPS-SSL.html, which has its online documentation at: http://www.edecision4u.com/data/DG-HTTPS.SW.Specs.2012.doc (beware doc file). This documentation specifically states its limitation:

Note: Certificate Error Warning will appear at target user Web Browser. This problem can be resolved by having own trusted Certificate Authority (CA). For more information, please contact Decision Group.

Hence, to use this product you have to have a trusted by your browser CA to sign a certificate for your MITM attack, which valid CA should not do; however invasive governments may be able to do (especially if your browser trusts all the default CAs).

share|improve this answer
    
Thanks, what if my ISP changed DNS of facebook and created similar site? then, he can collect thousands of credentials in few minutes, considering that SSL can be enabled also for the fake one. –  Akam Jan 31 '13 at 23:01
1  
@Akam, Unless your ISP is also a certificate authority trusted by your browser, you would not be able to create a trusted HTTPS session with them. Your browser would warn of a certificate error. –  dr jimbob Jan 31 '13 at 23:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.