The Stack Overflow podcast is back! Listen to an interview with our new CEO.
201

It's not so much that PHP itself has security problems (assuming needed security updates), as it is there exists a lot of popular PHP-based software with rampant security problems. You could fault PHP for being a language that gives you enough rope to choke yourself, but the real problem is just how prevalent vulnerable PHP code actually is. One need look no ...


132

"Right" might not be the right word, but "wise," "prudent" and "conscientious" come to mind. PHP has, since its inception, adhered to a philosophy that devalues correctness in software. There is a huge number of situations a program can encounter where other languages (e.g. Python) would give up and throw an error to tell you that your program is wrong, ...


84

A malicious hosting provider can do a lot more than simply steal your code. They can modify it to introduce backdoors, they can steal your clients' data, and ruin your whole business. Trust must exist between you and the host. About the source code. If the attacker is trying to gain access to your source code, they will gain access to your source code, ...


52

This question is a bit broad, but I think an answer that is a little bit broad will still be helpful. The answer depends on the "kind" of hosting you are talking about. There are three main kinds which I will break down below, but just FYI the names I use are not necessarily industry-standard names. The concepts however are pretty common across the board: ...


43

In general, you're correct you'll need the permission of the hosting company where you are scanning services deployed on their infrastructure. This is partially so that their Intrusion Detection Systems are aware that it's an authorised scan. Both AWS and Azure have policies detailing the process and what's acceptable to test. The AWS one is here and the ...


42

Yes, your hosting provider is necessarily able to see your SSL private key, if the fancy takes him to do so. Because that SSL keys is used by his software running on his machines. (This still holds in the case of a hosted virtual machine -- in practice, a malicious host could simply take a snapshot of your running VM and analyse it at his leisure, and you ...


42

PHP's security problems can generally be narrowed down to two categories Unpatched systems As of right now, Wordpress stats shows over half of all users are running PHP on versions of PHP that are past End of Life (PHP 5.2 - 5.4). In two weeks, PHP 5.5 goes EOL and then it jumps to about 80% of all installs. Now, to be fair, some Enterprise/LTS Linux ...


42

This is likely a server misconfiguration, since all those websites are served from 95.173.215.72. When opening one of the websites via HTTPS, my browser warns me that the certificate common name, which must match the website domain, is invalid. I guess those websites aren't supposed to be acccessible via HTTPS, since Apache isn't configured to deliver the ...


38

Well, this calls for three comments: You cannot protect secrets with code obfuscation. Not really. Code obfuscation somehow works against unmotivated attackers, but it is not strong. If there is commercial value in breaking through it, then it will happen. If you don't trust your hosting service then look for another hosting service. If the secrecy of your ...


29

No, it isn’t worth it. Nobody wants to steal your code. A thousand million SaaS products have been launched by individuals and companies using third-party hosting of some description or another, and roughly none of them have found themselves to be competing against themselves after having the code for their products stolen by their hosts. So, should you ...


29

What you need is relatively simple: you need to ensure that your students' unprivileged accounts are well confined. If you don't have a graphical environment involved, your situation is relatively simple. You should start by implementing the following actions: ensure users are created without administrative privileges (no sudo, no admin or wheel group) ...


24

If the Magento vulnerability led to a shell, then that shell could be used to get root access by a privilege escalation vulnerability. When that happens, the attacker has complete control over the system.


19

Could one create a vulnerable website on purpose to attack a server of a hosting provider? Yes, this is definitely possible. Since I have only experienced this with Linux based hosting solutions, I can only share my experience in that scenario. On several occasions I have managed to compromise an entire shared hosting server which was running DirectAdmin / ...


19

This is a long and complicated topic, but I will try to answer as concisely as I can. Basically, you are mixing three kinds of problems here: Abuse of legitimate email sending facilities which your server provides; Execution of malicious code on your webserver which may send emails to any outside recipients on their own, i.e. without using the legitimate ...


18

Ultimately you're the only one who can make that risk assessment. If you'll sleep better obfuscating your code, go for it. Personally I wouldn't bother. Reputable web hosting services are in the web hosting business not the source code theft business. If they steal your code they'd still have to install it, sell the service, find customers, and fight off ...


18

Passwords, should NEVER be stored plain text, regardless what they are used for. People tend to reuse their passwords, meaning a person's email password could be the same for his facebook account or other more critical application. Therefore performing correct password hashing is imperative.


17

PHP is no less, or more secure, or insecure than any other language (Java, Rails, etc). It is all about the coding. Are checks and balances in place to deflect, defend, prevent, and or mitigate an attack. Quoting: WhiteHat Security performed vulnerability assessments of more than 30,000 websites using .NET, Java, ASP, PHP, Cold Fusion and Perl. The ...


12

Based on the few details of this setup and some guess work what you might use this setup for the following problems come to mind: with local privilege escalation exploit one might break out of the chroot and affect other users on this system. if used in a web context it is possible to set/override cookies into the others domain and thus change the behavior ...


12

You might also be asked to add a temporary security exception to view the content. This is a typical issue when multiple sites share the same IP address and some of these have HTTPS enabled and some not. In this case often a default certificate and site will be served where the certificates subject does not match the domain in the URL - and this results in ...


11

Obfuscation is ineffective against a determined attacker, it only makes it slightly more difficult. If you have a particular reason to distrust your hosting provider, get another. If you just want to be safe, get a non-disclosure agreement and other legal assurances that allow you to go after your host if they abuse things. If you still don't trust ...


11

If your computer is able to use the API without a password, then the information has to be stored somewhere on your system. The point of storing it in the environment variable is to make it so that you don't check it in to the version control along with the source, however really, the ideal would be to use something like a HSM or TPM to store the API key in ...


11

You wouldn't need the vulnerable website if you have an account on the shared hosting already. What you need is code execution on the host. A remote code execution vulnerability in one of the hosted websites gives you that, sure. But if you have your own account already, why not just upload whatever code you want to run? I guess installing a vulnerable ...


9

I wouldn't bother. Two reasons: Runtime interpreted languages really cannot be fully protected that way. To completely obfuscate it you would have to obfuscate it from the runtime as well, then there would be no way to execute it. Obfuscation just makes the task slightly more annoying. It can also make debugging and deployment more time consuming for ...


9

Since the potential attackers (the other customers on the share host) can see your processes (as well as you see theirs), your Wiki and what you do with it is protected from their inquisitive eyes by the Unix security model: roughly speaking, non-root users cannot impact each other, subject to the access rights on files, directories and devices. You thus ...


8

tl;dr: Virtual machine RAM is reasonably private, given your stated assumptions. I'm not an expert on virtual machine security (real experts, please come correct any errors in this post), but I found this question interesting enough to do some Googling. Here's what I found. From a NIST publication titled Security Recommendations for Hypervisor Deployment: ...


8

One of the fundamental problems with PHP is really a fundamental problem with the CGI model of things (upon which PHP is based, despite mod_php's trappings) - namely that user-facing data is intermingled with scripts, and it becomes very easy for e.g. user uploads to become an executable script. This isn't necessarily a problem with PHP itself but having PHP ...


7

Ask your security officer, or your contact/security officer at the NSA (the originator). (When it comes to handling of classified or FOUO material, you probably should not be following security advice from the Internet anyway...) Apparently, FOUO often means that it contains personally identifying information that should not be made public. A cynical part ...


7

You should also check with your ISP. Depending on government regulations and their own operating policies, they could be required to block your pentest actions if detected, or cancel your service completely. They may even be required to report you to law enforcement agencies.


6

The PHP system call simply relays commands to the command line of the OS. If you don't have command line access to the server you're renting, then you can see the obvious concern with allowing that command, as now you as a developer have access to the command prompt. However, even if you do have command line access, incorporating the 'system' call into PHP ...


6

Do you have a site? If so, you're vulnerable. A distributed denial of service attack (DDOS) consists of a number of computers throwing data at your site faster than it can handle it. Unless you're operating on the scale of Google, you're vulnerable. Your main defense is to not be a target worth the effort of attacking. A conventional denial of service (...


Only top voted, non community-wiki answers of a minimum length are eligible