Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I used SSL certificate on my site but still it has been hacked.

How do I prevent this from happening?

Do SSL certificate come with a waranty which would compensate me because my site was hacked?

share|improve this question
5  
If you can give context over what the hack method was then you could ask specific questions and get good guidance. SSL is not designed to prevent a website being hacked - as both Jeff and Mike said, it just protects communications. –  Rory Alsop Sep 3 '11 at 9:07
1  
I have a sword, does that mean the bully wouldn't be able to beat me? –  Lie Ryan Sep 3 '11 at 13:00
9  
Security is full of misconceptions. SSL = security = why am I hacked? If you know don't know what else to consider, it actually is a logical statement. (Be nice to the new guy.) –  Jeff Ferland Sep 3 '11 at 15:25
1  
You have to consider also, MITM attacks like sslstrip, session hijack, and so on. –  KeyneON Sep 4 '11 at 2:20
add comment

4 Answers

up vote 14 down vote accepted

An SSL certificate protects users of your site from having their communications intercepted by a 3rd party. I think it is likely that when you say your site was hacked, this isn't what you're talking about. An SSL certificate does not validate the content of your site, nor does it prevent anyone from accessing it as intended or otherwise. Controls for these are outside the realm of SSL.

There is no warranty regarding SSL certificates other than potential civil liability. Unless your certificate itself was compromised by actions of the issuer, you have no case against them and no warranty is implied.

As far as figuring out what was insecure about your site, how you were compromised, or what needs to be addressed to fix it, you need to have forensic analysis performed on your compromised machine. A review of the website code for the site in question may also be in order.

share|improve this answer
4  
A minor clarification, SSL protects your communication from being understood, but an adversary could still intercept your communication. –  this.josh Sep 4 '11 at 18:34
    
+1 to your comment: good clarification. –  Jeff Ferland Sep 4 '11 at 19:15
add comment

SSL certificates don't do anything to prevent your site from being hacked, so you're not going to be able to claim compensation. If properly implemented, they prevent your users' traffic from being intercepted by third parties, which is not the same thing at all.

To stop your site from being hacked again, you need to employ or become an expert in Internet security -- there's no other way. There are so many different ways that your site could be vulnerable that I couldn't even begin to list them all here.

share|improve this answer
    
Minor clarification, SSL protects your communication from being understood, but an adversary could still intercept your communication. –  this.josh Sep 4 '11 at 18:36
add comment

I've never heard of a warranty on SSL certificates, and even so, it wouldn't be that your site wouldn't be broken into - it'd be a warranty concerning the link between your server and your user's computer.

You may be thinking of those (ridiculous) "verified by XXX" logos you see on websites. Those are intended to give visitors confidence that the site is indeed secure, but again, they don't function as an assertion that nobody can break into your site, as much as an indication that the site is using SSL to protect communications.

There are other logos out there that sometimes show up on websites, sometimes from the same companies that sell certificates, that purport to speak to the security of the site itself, but even so I haven't heard of any of them warranting that claim. Far from it, usually - almost everyone inserts gigantic disclaimers in their license agreements.

share|improve this answer
add comment

Let's say you have SSL, but an outdated OS, poor passwords, your house/work network compromised, not only by you, but by others that also make use of it. How can your server be secure?

There are so many technical paths a malicious guy can try, and social engineering to do. An SSL certificate, can only protected the communication preventing it to be transmitted as plain text and checking if the parts are who they are claiming to be. It's the same say to the user: "Your information will be transmitted by a verified organization locked in a box with one key to lock and another to open. Only you and I have the keys".

But this doesn't mean that no one will be able to exploit that key during the transmission. For example, the attacker can invalidate the HTTPS transmission before the user even note, forcing the information to be transmitted as plain text (e.g sslstrip).

Second, let's say that everything is ok, but you built your page with Wordpress or Joomla for example, with a feel plugins. If you do not have the appropriate guy to check your code, is just a matter of time to someone break in, since exploits for applications and plugins made by those organizations and their users pop out every day on exploits databases.

Just an example, the same can be done on in-house applications, even with automated tools.

SSL is just the tip of the iceberg.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.