Tag Info

New answers tagged

0

The hacker used a publicly available shell MulCiShell v0.2. It can be configured to perform a number of functions including brute forcing passwords, downloading your entire site and replicating itself. You could take a closer look at mshell.php to see what it does. Edit: From your log files: He tried to access /etc/passwd which contain a list of system ...


1

In addition to all the answers that explain how to prevent developers from accessing such secret data, there is also a major indirect method: access logs queries can be logged, as can any shell commands, etc. and these logs should be saved in a way such that they are impossible for an individual developer to delete - that way even if they do have access, ...


1

I'm surprised nobody has mentioned DUKPT, but maybe that's because some of the major payment gateways never got around to supporting it, and perhaps they never will now that TripleDES is subject to brute force attacks. But it was a great idea in its time, and there's no reason something like it couldn't be done with modern encryption. Some vendors are ...


2

Pipes are "half duplex" connections: data only flows through them in one direction (from the left-hand program to the right-hand program). If you're using pipes to connect your shell to the network, you need two of them: one to handle input, and one to handle output. Network connections, such as are provided by the /dev/tcp pseudo-filesystem in your second ...


7

The cost of preventing this is enormous and so it is rarely done outside of huge, well funded development groups. The mentions above of code review, security review, etc. are all good ideas, but in practice customers are more interested in getting functioning code than delaying use of their assets for months while review processes happen. The majority case ...


5

For small-medium enterprises where one developer wears multiple hats (DBA, sysadmin, tech support, webmaster, etc), the task of satisfying PCI DSS requirement would be too onerous. On possible solution to prevent a developer from obtaining sensitive data is to use a third-party API where processing and storing of sensitive data happens on a trusted ...


2

Often the developer won't have complete access to the customer database. In my company, all our development is done on anonymised databases - credit card numbers, personal details etc are removed and things are jumbled up. The live databases are on the customer machines and junior/mid level developers simply don't have read access on those tables. We could ...


18

To a not-insignificant degree, this is (as you mentioned) a trust issue, not a technical one. We try to be careful to as far as we can, hire trustworthy people who won't abuse their positions. That said, there are a number of controls that can be implemented to either limit unauthorized access, and/or verify that the trust in individuals is well-placed ...


28

PCI DSS sections 6, 7, and 8 all bear on this question. For example, part of 6.3.2 which requires code review: Code changes are reviewed by individuals other than the originating code author, and by individuals knowledgeable about code-review techniques and secure coding practices. 6.4 with change control: A separation of duties between ...



Top 50 recent answers are included