Jollity Posted March 5, 2015 Posted March 5, 2015 We have been having problems with our website getting hacked and the front page defaced. It has happened twice now: apparently different groups (and not the little darlings in the school unless they did a very good job of disguising their trail). It's a PHP website with a custom CMS and has been managed and hosted by the web development company that built it, but we do have ownership of the code. They have tried to clear up after each occasion, but they have now admitted that they are not really up to the job of tracking down the underlying problems. It does appear (certainly the first time) that the problem was the site code itself and not vulnerable 3rd party software. There are more details I cannot really go into on a forum. While I will be taking a look myself, we are now interested in finding someone who could review the website's security and perhaps help us out if it gets hacked again. Is there anyone here a website security consultant looking for a job? Or does anyone have any recommendations?
ZeroHour Posted March 5, 2015 Posted March 5, 2015 A few of the common vectors: If you allow file uploads/submissions to a writeable directory (everything else shouldn't be write) then block the execution of php/asp/cgi in that folder, a common way in is to submit a php file then directly access the url once uploaded. Anywhere/everywhere you use a querystring, get or post, form submission needs to have its input filtered through php's function filter_input which will help filter crud out. 1
danbuntu Posted March 5, 2015 Posted March 5, 2015 my suggestion is to ditch the cms and get a new one. If you hire a consultant that might find problems with it and fix them. There is guarantee though that there might not be more issues found and exploited in the future (think of it like still using XP). also check that your host system is fully up to date - os, php version, mysql version, .net version or whatever it runs on. 1
ZeroHour Posted March 5, 2015 Posted March 5, 2015 also check that your host system is fully up to date - os, php version, mysql version, .net version or whatever it runs on. Just to say if the server is on php 5.3 do not update to 5.4 without testing as it changed a few of the rules and it could break your existing cms. 1
danbuntu Posted March 5, 2015 Posted March 5, 2015 but if it is on 5.3 makes sure it's he latest version of it for your operating system
Jollity Posted March 5, 2015 Author Posted March 5, 2015 Thank you for the suggestions for fixing. I will look out for those when I get my hands on the code. I agree it would be safer to ditch the whole CMS and start afresh at this point, though that would be a hard one to sell to our management as the site was not built that long ago and they are largely happy with it in other respects. While I know no one could ever catch every hole, I am thinking it might be possible for someone who knew what they were doing to patch up the worst of any security issues, put in place a rapid response plan in case of it happening again, and be sufficiently protected. However I know there is a point where it takes less time to rewrite something completely than try to fix it. If an unbiased expert opinion after looking over the site code was that it was fundamentally unsound that would be useful to know in itself.
plexer Posted March 5, 2015 Posted March 5, 2015 What about sticking your website behind cloudflare as well? Ben 1
Jollity Posted March 5, 2015 Author Posted March 5, 2015 I know cloudflare mainly as an anti-DDOS and CDN. Does it work well for catching exploit attempts as well?
plexer Posted March 5, 2015 Posted March 5, 2015 Easy and affordable SSL, Web Application Firewall, spam protection, and DDoS protection and mitigation | CloudFlare | The web performance & security company Ben
mats Posted March 6, 2015 Posted March 6, 2015 You might try running a penetration tester against your site - something like Owasp Zap. It should give you some idea where the vulnerabilities lie - and it's probably the kind of thing your attackers use. 1
danbuntu Posted March 6, 2015 Posted March 6, 2015 oh Owasp Zap is a new one to me. I'm firing it at couple of my sites now I'm happy to set it to scan your site as well jollity if you want
Jollity Posted March 6, 2015 Author Posted March 6, 2015 Easy and affordable SSL, Web Application Firewall, spam protection, and DDoS protection and mitigation | CloudFlare | The web performance & security company Does sound good. Have you used it and found it worked well? I had not heard of Owasp Zap either. I will add it to the list. I have been collecting vulnerability scanners: Qualys Detectify Nikto2
plexer Posted March 6, 2015 Posted March 6, 2015 I have my own website going through cloudflare, edugeek uses it I believe. BEn 1
ZeroHour Posted March 6, 2015 Posted March 6, 2015 I have my own website going through cloudflare, edugeek uses it I believe. BEn We did use it in the past, everything is through AWS currently. Its a very good service but we did have one or two issues we couldnt resolve but part of that could have been down to our previous hardware. They are also one of the fastest nameserver's hosts in the business. 1
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now