3

I've seen many PHP file checker on the net. Basically they computes the sha hash of a requested file. Your PC queries periodically the script and alerts you if the returned hash changes.

The problem is: if the attacker gets write access to my web folder, then he can change the file checker to return always the old hash, making the file checker completely useless and misleading.

So, how can I check that the file checker script hasn't been altered?

Improve this question

2 Answers 2

Reset to default
3

You can place the file checker outside the web directory and deny read/write permissions for the account that is running the web server. In other words do not allow the account running the web server to modify the file checker or the expected values for the file(s). Furthermore, make sure that the account running the web server does not have permissions to change the permissions of the file checker and expected values.

You could also do this from a remote machine, which runs the script and has the expected values, using either the Windows administrator shared folders (e.g. \PC\D$\www\file.php), or SSH on a Unix based system.

It comes down to permissions, as longest the account running the web server has the least permission required to run, and does not have permission to change the script file and expected values it will not render the file checker useless.

If you are interested on a heavy duty file integrity checker, for free, I recommend OSSEC.

Improve this answer
4
  • You could also store a public key in the script, then digitally sign the script (including the embedded public key) and store the resulting signature in a separate file. On startup, the script opens the signature file and verifies it against the script (itself). An attacker cannot forge the signature without your private key.
    – Polynomial
    Aug 30, 2012 at 6:06
  • @Polynomial sounds interesting, but if the script checks itself the attacker could change the file checker so that it returns always the fake message "Verified signature.. File checker hasn't been altered".. So I'm missing the point. Could you explain your idea again?
    – Surfer on the fall
    Aug 30, 2012 at 10:38
  • 1
    @user1294101 True, hadn't considered that. Was half asleep when I wrote that comment!
    – Polynomial
    Aug 30, 2012 at 10:58
  • @Polynomial if I download every time (FTP) the file checker and I check its content, would it be a good idea?
    – Surfer on the fall
    Aug 30, 2012 at 12:09
1

if the attacker gets write access to my web folder

Then don't store it in your web folder - however what's to stop them modifying files outside what you think of as your web folder?

So, how can I check that the file checker script hasn't been altered?

You can't. It would be trivial to implement a script which is not stored on the target system and send the script over an ssh session - but you are still relying on a lot of the files on the target system. It does make it a bit harder though.

You should also be paying at least as much attention to the database of signatures - the attacker doesn't need to modify the code if he can modify the signature database directly - i.e. this definitely shouldn't be held on the remote computer.

Improve this answer
1
  • Probably I didn't explain well. To avoid hack on database of signatures, I'd want to store it on non-target systems.
    – Surfer on the fall
    Aug 30, 2012 at 10:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.