Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have multiple web application installed in separeted directories in a shared hosting account. My worry is if one application get hacked, attacker can use it to attack other applications too.

So, My question is what are the potential ways in which an attacker can exploit a application on a shared account using a different application. Also, How can I prevent such attacks?

share|improve this question

2 Answers 2

Methods of Shared Web Application Server Compromise

Pretty much endless. Have a look at the Open Web Application Security Project's 2013 Top 10, (www.owasp.org) just for starters. If you're anything like me, you're already trembling.

Threat and Risk Assessment: Scope

A full threat and risk assessment would also take into account compromise of user authentication data, e.g. cross-site request forgery, because one compromised session could permit unrestricted access to the server if the account is not isolated properly. For example, consider a hacker exploiting a known vulnerability in a web application after having successfully hijacked a valid user's session.

Injury Assessment

What you're asking about is something that is more often considered in the highest-security scenarios: banking, finance, government, military... And in all of those cases servers with high-value assets are almost categorically isolated and not shared. The evaluation of what is high value is often made on the basis of three principles: confidentiality, availability and integrity.

Example of classic industry high-security scenarios

For example, for a bank, all the financial transaction data is highly confidential, very restricted in availability and its integrity is paramount. That's why most banks will isolate their server clusters by application and by relative interactivity. Then they will also make routine redundant backups of the information into geographically disparate locations, on equally secure clusters.

Threat Mitigation

The best methods to prevent server compromise are routine hardening:

  • the strongest passwords combined with multifactor authentication,
  • secure-signed kernels and software only, e.g. SELinux
  • strict controls using a software firewall like iptables defining which applications are allowed to use which ports in what direction and by what users, but also hardware-based firewalls,
  • active monitoring of the network traffic using a software like Wireshark6,
  • you can also use [intrusion detection and prevention systems, possibly even two or three such systems at the same time,
  • if you are safeguarding high-value information that is exposed to high risk (according to your threat and risk assessment), then physical security should also be considered as a fundamental factor (i.e. who has access to the datacentre, how are they cleared for access, how are keys managed),
  • you can find more information from NIST Special Publication 800-53 -- Anecdotally, I remember hearing a statistic that NASA had only implemented about 65% of these suggested controls by 2014, by virtue of how exhaustive they are.
share|improve this answer
    
Hi, As I have stated in question, I am talking about simple cPanel/FTP based sharing hosting. I have no administrative privileges, system level access. These are just on seperated directories on the same account. I want to know how can I prevent use of one application to attack another. And sorry if I was not clear in the question. –  Santa Claus Feb 26 at 15:16

In your scenario you cannot prevent an attacker from compromising the other applications on the account if the attack in question gains administrative control of the system. Once an attacker gets root then that's it, they can access everything. Your options for dealing with this threat are:

  • Prevention: try to keep an attack from being successful. This means keeping your system up to date and hardening the applications. If you are using a hosting account you may be at the mercy of the provider on this one. Of course you should be doing this anyway....
  • Use different accounts: You could get different accounts for the applications, or you could virtualize the applications using one account, using different credentials for each virtual system. If one of the virtualized apps gets compromised the spread will be contained
share|improve this answer
    
Hi, As I have stated in question, I am talking about simple cPanel/FTP based sharing hosting. I have no administrative privileges, system level access. These are just on seperated directories on the same account. I want to know how can I prevent use of one application to attack another. And sorry if I was not clear in the question. –  Santa Claus Feb 26 at 15:12
    
You don't prevent it @VarunAgw, a compromise on one application likely means a compromise for all. –  GdD Feb 26 at 15:58
    
Could you please give me an example where it is not possible to keep safe the other application? –  Santa Claus Feb 26 at 18:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.