27

I recently started server-side programming, and wrote up a page containing a drawable-canvas that lets users publically draw and save a picture, and overwrite pictures made by others.

For kicks, I thought of advertising the link on social media to see what happens. I'd rather not put my computer in harm's way though just for kicks.

My main concerns are someone being able to access the rest of my system, or being able to delete files off the site.

Are either of these a concern?

Quick information about the setup:

  • I'm using XAMPP 7.0.1 on Windows 10 Home. Besides putting a password on my MySQL server, I really haven't done anything security oriented, so it could be considered in an "out-of-the-box" state as far as security is concerned.

  • It uses a MySQL database and PHP's MySQLi library, but as mentioned above, I have it password protected, and have taken care to prevent injection.

Improve this question
0

5 Answers 5

Reset to default
63

Oh my. YES! All those things are of a concern. You only expose your server publicly if you are prepared to have that server taken over by a malicious party.

All one needs to do is to find a misconfiguration or a security hole and they can own your personal computer that you use to do things like access personal accounts (email, banks, etc.).

Public servers need to be locked down, with only the info it needs to provide a service. Best case is to have that server backed up and disposable in case it is compromised. If something bad happens, you blow it away and restore from back ups.

Do not expose your personal computer to the public in this way, especially when you are exposing custom code and you do not understand how exploitable it is.

Improve this answer
8
  • 1
    So, this is something that should only be left to people that know what they're doing? That's unfortunate. I was curious what kind of traffic I'd get, but exposing my computer to risks like that isn't worth it.
    – Carcigenicate
    Feb 14, 2016 at 21:05
  • 19
    @Carcigenicate You can set up cloud servers for pennies. For instance Amazon EC2. Everyone who signs up gets 750 hours a month of free t2.micro usage. It's 1GB RAM and small HDD, but perfect for testing servers. It is also easy to create security profiles for each of the servers you are testing. If you need something a little more powerful, using spot-requests to get a better server is very cost-effective as well.
    – cremefraiche
    Feb 14, 2016 at 21:11
  • @cremafraiche Thanks. This is purely for my own amusement though, so it's probably a ways before it would be worth looking into external hosting, even if it's cheap.
    – Carcigenicate
    Feb 14, 2016 at 21:14
  • 1
    @Carcigenicate Those who know what they're doing won't do it (put a system with any private info where it's exposed to attack this way).
    – Monty Harder
    Feb 15, 2016 at 22:31
  • 1
    As a recommendation - use KeePass or the like to generate the passwords that you use on these systems. Pretty much the worst possible thing for you would be to setup a server, accidentally have a hole, the attacker then gets your password that you use everywhere else, and now you wish you were dead. Or they were. Regardless - use something to generate and save strong and unique passwords for all the accounts you use relative to this project.
    – Wayne Werner
    Feb 16, 2016 at 14:36
20

My main concerns are someone being able to access the rest of my system, or being able to delete files off the site.

Are either of these a concern?

Yes and yes.

Why?

Are some of the reasons that jump to mind.

Improve this answer
7

To isolate your project from the rest of your system, you could set up a virtual machine, install a minimal LAMP (Linux, Apache, MySQL, PHP) configuration on it and install your application there. Even when your virtual machine gets totally pwned, your normal machine will be relatively save (only "relatively" because there were some known vulnerabilities in VM software which allowed to escape from the guest system to influence the host system, but these are relatively obscure). When your VM got turned into a malware-infested spam machine, you can easily revert it to a known good snapshot or terminate it entirely with a single click.

Deploying your project in a virtual machine is also a good way to learn how to set up a "real" server for your project later, should you decide to rent one.

A free (as in beer) software which allows this is Virtual Box, for example.

Improve this answer
1
  • 5
    VM escapes aren't the only consideration. There's also the internal network security. Anyone who has taken control of a VM running on a desktop PC has bypassed the home router firewall, so then you've got to worry about what other machines are networked to the VM, and how secure those are.
    – Jon Bentley
    Feb 15, 2016 at 15:06
7

In fact, it doesn't matter much for a typical attacker whether you advertise your service or not. Typical attackers routinely scan all available IP numbers for webservers and try to attack them as soon as they go online.

The only adverse effect from advertising can be a traffic overload and unavailability of your server for this reason.

You need to consider security as soon as you go online.

Improve this answer
5
  • 2
    The port/IP scanners are a real issue in my network too. My ISP doesn't even assign a static IP, and I usually end up getting several attempts in my mysql (I have it open to public Internet to get some of my work done).
    – AKS
    Feb 15, 2016 at 14:32
  • I'm actually using a non-standard port, so it's unlikely to be found via scanning.
    – Carcigenicate
    Feb 15, 2016 at 21:16
  • @Carcigenicate scanning is exactly that... Scanning to find out which ports are open. The thinking that it is unlikely someone will find your server is a bad place to start. Assume someone will find it and then do what you need to do to make sure that it doesn't really matter if they do.
    – rooby
    Feb 15, 2016 at 23:58
  • @rooby I know it's possible, but I've had my server open for w months straight without considering security (not a good idea, I know), and I don't have any weird accesses in my logs. I know it's possible, but the "port-space" is pretty large isn't it? Like 65k?
    – Carcigenicate
    Feb 16, 2016 at 0:03
  • @Carcigenicate in the grand scheme of things 65k is not that many. It's not enough to make brute force a waste of time (especially if there is no one monitoring your logs). It's possible no one will attack you but if you assume they could and take precautions you could be avoiding a huge headache in future. In this case if you were to assume that someone malicious can access your site and if you were not confident in the security of your code and/or configuration then maybe you decide it would be better to host elsewhere.
    – rooby
    Feb 16, 2016 at 0:28
2

This doesn't need to be any concern. Or it may be a major concern.

What else is on your machine?

If the answer is, "nothing else that I care about; this is a machine that I installed Windows on last week, and no sensitive data is on it, and any important data was backed up three minutes ago, and I'm willing to erase everything in case an attacker does bad things to my system, and there are no other computers on the network that could be attacked by this dummy machine", then, by all means, go right on ahead.

And just so you don't think I'm being ridiculously sarcastic: I have two such machines in my house right now. They're booted off Live CDs, with minimal security applied (just changed two default passwords), but they are protected by a firewall and the operating system will effectively disappear once I turn the power off later on this week.

My main concerns are someone being able to access the rest of my system, or being able to delete files off the site.

Your security sounds quite minimal and it is only reasonable to believe that you may be attack rather quickly. Either get things much more secure, or make it so that you don't need to be concerned about attackers destroying your system. Your easiest approach might be to spend money buying another (perhaps used) computer that you don't care about, so that you aren't making a bunch of unnecessary risks with things that you do care more about.

By the way, I'd like to re-stress the idea of backups. Think about what data is important, and make sure that all of it is backed up. If that's not the case, then I suggest making that project (of backing up data) be prioritized over experimenting with adding new services.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .