Tag Info

New answers tagged

1

The cost of preventing this is enormous and so it is rarely done outside of huge, well funded development groups. The mentions above of code review, security review, etc. are all good ideas, but in practice customers are more interested in getting functioning code than delaying use of their assets for months while review processes happen. The majority case ...


1

For small-medium enterprises where one developer wears multiple hats (DBA, sysadmin, tech support, webmaster, etc), the task of satisfying PCI DSS requirement would be too onerous. On possible solution to prevent a developer from obtaining sensitive data is to use a third-party API where processing and storing of sensitive data happens on a trusted ...


2

Often the developer won't have complete access to the customer database. In my company, all our development is done on anonymised databases - credit card numbers, personal details etc are removed and things are jumbled up. The live databases are on the customer machines and junior/mid level developers simply don't have read access on those tables. We could ...


6

To a not-insignificant degree, this is (as you mentioned) a trust issue, not a technical one. We try to be careful to as far as we can, hire trustworthy people who won't abuse their positions. That said, there are a number of controls that can be implemented to either limit unauthorized access, and/or verify that the trust in individuals is well-placed ...


12

PCI DSS sections 6, 7, and 8 all bear on this question. For example, part of 6.3.2 which requires code review: Code changes are reviewed by individuals other than the originating code author, and by individuals knowledgeable about code-review techniques and secure coding practices. 6.4 with change control: A separation of duties between ...


0

I am still not sure how to block this hack, but I wrote the below solution which catches all infected php files on your server, backup them (with it original path),restoring them into it orig state, and also write a summary file with the result It works great for me (about 21000~ php files scanned and fix in 7min) In order to use it copy the below code into ...


6

No. The backdoor is not on this script. This piece of highly obfuscated code contains a program to allow the hacker to dynamically append any HTML or javascript by randomly calling a server located at 31.184.192.250 with one of the four hostnames "33db9538.com", "9507c4e8.com", "e5b57288.com", "54dfa1cb.com". The deobfuscated code looks something like this: ...


1

You'd probably have to go around a lot of places to get anything specific, but since you are talking about hardware-based exploits, you're going to want to look for physical bugs. There's a great article I read from spiderlabs about some stuff like this: http://blog.spiderlabs.com/2014/03/detecting-surveillance-state-surveillance-part-1-hardware-impants.html ...



Top 50 recent answers are included