1

I am currently looking into ways of securing a number of E-Commerce websites which serve a large amount of traffic every day.

So far we have implemented WAF's (Web Application Firewall), SSL certificates, malware detection (using a range of different software) and also made changes to the E-Commerce software which will make breaching the site harder (changing admin URLs etc).

An idea was given to me by a co-worker which would be to check the MD5Sum of each and every file within the E-Commerce software. My Question is: Is this something which is achievable/worth doing and if so, how would I go about MD5Summing 10k+ files on each site?

Improve this question
3
  • You need to look at something similar to AIDE or File Integrity checkers. FYI AIDE (Advanced Intrusion Detection Environment) is a file and directory integrity checker.
    – Krishna Pandey
    Commented Nov 23, 2017 at 11:31
  • Obligatory reminder: MD5 is cryptographically broken and should not be used for anything where an adversary may try to force a collision! Honestly, it shouldn't be used for basically anything at this point, really; the SHA2 family has near-universal support, sufficient performance, and much better security.
    – CBHacking
    Commented Feb 23, 2018 at 10:49
  • Restrictive permissions (and safe programming) could be much more effective to prevent file tampering rather than detecting the problem after it had happened. One point is: Are those 10kü+ files expected to change during normal operation? If they do you'll have a lot of work updating the checksums, but even if not, you'll have the check them all every time, because after an attack you cannot rely on the file timestamps to be correct (i.e.: expecting only "new" files could be tampered).
    – U. Windl
    Commented Jun 29, 2023 at 13:05

2 Answers 2

Reset to default
1

What you describe is commonly known as a host intrusion detection system. Have a google and you'll find stuff like OSSEC and Tripwire. Alternatively, 6 shell commands:

 mv currentsums oldsums
 find /var/www/html -iname \*.php -exec md5sum {} \; | \
    awk '{ print $2 "," $1 }' | sort >currentsums
 diff currentsums oldsums

(you may wish to treat this as a starting point)

BTW: Your list of things you've done to make this secure has some esoteric stuff in it but none of the basics for hardening a server.

Improve this answer
0

Welcome to Information Security Stack Exchange!

According to me, an attacker is less likely to place backdoors in existing files. Rather, he/she would upload new files as backdoors(especially at the initial stages of gaining access to filesystem). Thus, checking the integrity of existing files is less effective and takes a lower priority than monitoring newly created files.

But then, monitoring the integrity of existing files is possible, and can be used to detect intrusions. You can use software from the market for this purpose. There is a tool I heard of, called TripWire, which makes use of MD5 checksum databases to detect filesystem changes and report possible intrusions. If the E-Commerce websites are under active development, with pages constantly being modified to fix bugs/add features, this may also generate a lot of false positives.

Or you could write a bash (or cmd, depending on your platform) script (free of cost :P) to do the same.

Improve this answer
2
  • Tripwire is available at no cost. Writing a script probably takes more time than installing an already available solution, so unless OP's time comes at zero cost or very nearly so, installing and configuring Tripwire is probably a better choice than trying to cook up an alternative themselves. It's also far less likely to have bugs.
    – user
    Commented Nov 24, 2017 at 13:44
  • You are up in the night. While an initial payload may create a new file, the necessary privilege escalation to remain persistent post exploit would use lax permissions to inject ring 0 or 1 code to escalate permissions from that as the exploited processes user
    – jas-
    Commented Jan 23, 2018 at 15:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .