Which attacks can a rogue hosting company carry against the servers it hosts? Assume that the rogue hosting company also provides full access to law enforcement.

I was just wondering about that. So much effort people go though to secure their servers and all NSA needs to do is to force the hosting company to provide direct access, make them take a snapshot or whatever...

Also assume that you followed all good security practices, and you have downloaded and flashed the OS by yourself and it's up to date.

Also assume Full Disk Encryption, and DDR3 RAM memory.

I want to know mostly about attacks on run-time but at rest too.

Edit: to clarify I'm not asking about remote attacks a server normally faces from a hacker in his home, like a SQL injection or brute force on SSH. But attacks that are possibly only from the hosting company and nobody else. (One example I see is the hosting company taking a snapshot of your server and run it somewhere else).

  • 2
    You are still co-mingling "what attacks can be done" and "what can I do to protect myself". – schroeder Jul 19 '15 at 5:59
  • Bare metal? VPN? Be more specific. – Konrad Gajewski Jul 19 '15 at 8:42
  • Hold on. I meant VPS, not VPN ;-) It's a hot day here in Poland. – Konrad Gajewski Jul 19 '15 at 11:39

Ok, in case of a VPS the ENTIRE server can be compromised, as one can clone and dump the state of the machine any time she wants. Even if you were to use encryption on disks, the keys would be in the memory and easy to retrieve. You could write your own patches to the system, but this would be StO.

If, however you owned the box, and just co-located it, you could, in theory have a much safer environment. Intrusion detection to the case and disks. Keys locking physical access to the front panel and hot-swappable disks. If you want real security go for this option.

| improve this answer | |
  • They can retrieve the keys without turning off the machine? I read DDR3 ram memory is immune to cold boot attacks. I could try to patch the kernel with TRESOR . +1 – Freedo Jul 19 '15 at 11:32

This question is really to broad to be answered. I will still make an attempt to answer it with a broad answer.

If the hosting company is malicious, you can consider your system compromised. Having access to the physical server is considered having the control over the machine.

As per the possible attacks, it is too vaste to be put here.

| improve this answer | |

There are variety of attacks can be performed in the servers. So this is too broad to answer here.

You can try out Xss,SQL injection etc..

For attacking you can go through OWASP Top 10 vulnerabilities that are still causing a huge damage to servers.

| improve this answer | |
  • I think you have misinterpreted my question. I'm not asking about remote attacks on server like a hacker would do in his home. But attacks that can come only for who host the server and nobody else. – Freedo Jul 19 '15 at 11:06

Not the answer you're looking for? Browse other questions tagged or ask your own question.