I am currently looking into ways of securing a number of E-Commerce websites which serve a large amount of traffic every day.

So far we have implemented WAF's (Web Application Firewall), SSL certificates, malware detection (using a range of different software) and also made changes to the E-Commerce software which will make breaching the site harder (changing admin URLs etc).

An idea was given to me by a co-worker which would be to check the MD5Sum of each and every file within the E-Commerce software. My Question is: Is this something which is achievable/worth doing and if so, how would I go about MD5Summing 10k+ files on each site?

  • You need to look at something similar to AIDE or File Integrity checkers. FYI AIDE (Advanced Intrusion Detection Environment) is a file and directory integrity checker. – Krishna Pandey Nov 23 '17 at 11:31
  • Obligatory reminder: MD5 is cryptographically broken and should not be used for anything where an adversary may try to force a collision! Honestly, it shouldn't be used for basically anything at this point, really; the SHA2 family has near-universal support, sufficient performance, and much better security. – CBHacking Feb 23 '18 at 10:49

What you describe is commonly known as a host intrusion detection system. Have a google and you'll find stuff like OSSEC and Tripwire. Alternatively, 6 shell commands:

 mv currentsums oldsums
 find /var/www/html -iname \*.php -exec md5sum {} \; | \
    awk '{ print $2 "," $1 }' | sort >currentsums
 diff currentsums oldsums

(you may wish to treat this as a starting point)

BTW: Your list of things you've done to make this secure has some esoteric stuff in it but none of the basics for hardening a server.


Welcome to Information Security Stack Exchange!

According to me, an attacker is less likely to place backdoors in existing files. Rather, he/she would upload new files as backdoors(especially at the initial stages of gaining access to filesystem). Thus, checking the integrity of existing files is less effective and takes a lower priority than monitoring newly created files.

But then, monitoring the integrity of existing files is possible, and can be used to detect intrusions. You can use software from the market for this purpose. There is a tool I heard of, called TripWire, which makes use of MD5 checksum databases to detect filesystem changes and report possible intrusions. If the E-Commerce websites are under active development, with pages constantly being modified to fix bugs/add features, this may also generate a lot of false positives.

Or you could write a bash (or cmd, depending on your platform) script (free of cost :P) to do the same.

  • Tripwire is available at no cost. Writing a script probably takes more time than installing an already available solution, so unless OP's time comes at zero cost or very nearly so, installing and configuring Tripwire is probably a better choice than trying to cook up an alternative themselves. It's also far less likely to have bugs. – user Nov 24 '17 at 13:44
  • You are up in the night. While an initial payload may create a new file, the necessary privilege escalation to remain persistent post exploit would use lax permissions to inject ring 0 or 1 code to escalate permissions from that as the exploited processes user – jas- Jan 23 '18 at 15:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.