You are on page 1of 7

Ruald Gerber and Toby Compton set out best practices for avoiding security disasters

You may not think your site has anything worth being hacked for, but websites are compromised all the time. The majority of security breaches are not to steal your data or deface your website, but instead attempts to use your server as an email relay for spam, or to setup a temporary web server, normally to serve files of an illegal nature. Hacking is regularly performed by automated scripts written to scour the Internet in an attempt to exploit known security issues in software. Here are our top 10 tips to help keep you and your site safe online:

1. Keep software up to date
It may seem obvious, but ensuring you keep all software up to date is vital in keeping your site secure. This applies to both the server operating system and any software you may be running on your website such as a CMS or forum. When security holes are found in software, hackers are quick to attempt to abuse them. If you are using a managed hosting solution then you don't need to worry so much about applying security updates for the operating system as the hosting company should take care of this. If you are using third-party software on your website such as a CMS or forum, you should ensure you are quick to apply any security patches. Most vendors have a mailing list or RSS feed detailing any security issues. WordPress, Umbraco and many other CMSes notify you of available system updates when you log in.

2. SQL injection
SQL injection attacks are when an attacker uses a web form field or URL parameter to gain access to or manipulate your database. When you use standard Transact SQL it is easy to unknowingly insert rogue code into your query that could be used to change tables, get information and delete data. You can easily prevent this by always using parameterised queries, most web languages have this feature and it is easy to implement. Consider this query: 1. "SELECT * FROM table WHERE column = '" + parameter + "';" If an attacker changed the URL parameter to pass in ' or '1'='1 this will cause the query to look like this: 1. "SELECT * FROM table WHERE column = '' OR '1'='1';"

The browser can catch simple failures like mandatory fields that are empty and when you enter text into a numbers only . 3. Keep your error messages vague 5. 4. Error messages Be careful with how much information you give away in your error messages. When creating a form always ensure you check the data being submitted and encode or strip out any HTML. You should use generic messages like “Incorrect username or password” as not to specify when a user got half of the query right. Server side validation/form validation Validation should always be done both on the browser and server side.Since „1‟ is equal to „1‟ this will allow the attacker to add an additional query to the end of the SQL statement which will also be executed. For example if you have a login form on your website you should think about the language you use to communicate failure when attempting logins. XSS Cross site scripting is when an attacker tries to pass in JavaScript or other scripting code into a web form to attempt to run malicious code for visitors of your site. If an attacker tries a brute force attack to get a username and password and the error message gives away when one of the fields are correct then the attacker knows he has one of the fields and can concentrate on the other field.

you cannot rely on the file extension or the mime type to verify that the file is an image as these can easily be faked. So what can you do to prevent this? Ultimately you want to stop users from being able to execute .field. including an uppercase letter and number will help to protect their information in the long run. but that doesn‟t mean they always do. even if it‟s simply to change their avatar. although some configuration or extra modules might be required to use salted passwords (pre Drupal 7) or to set the minimum password strength.NET then it's worth using membership providers as they are very configurable. many CMSes provide user management out of the box with a lot of these security features built in. as decrypting them is not possible. For extra security it is a good idea to salt the passwords. Most images formats allow storing a comment section which could contain PHP code that could be executed by the server. using a new salt per password. In the event of someone hacking in and stealing your passwords. Even opening the file and reading the header. The risk is that any file uploaded however innocent it may look. File uploads Allowing users to upload files to your website can be a big security risk. 6. It is crucial to use strong passwords to your server and website admin area. Passwords should always be stored as encrypted values. essentially guessing every combination until it finds a match. could contain a script that when executed on your server completely opens up your website. using hashed passwords could help damage limitation. preferably using a one way hashing algorithm such as SHA. As much as users may not like it. If you are using . but equally also important to insist on good password practices for your users to protect the security of their accounts. 7. and you should make sure you check for these validation and deeper validation server side as failing to do so could lead to malicious code or scripting code being inserted into the database or could cause undesirable results in your website. provide inbuilt security and include readymade controls for login and password reset. If you are allowing users to upload images. Passwords Everyone knows they should use complex passwords. These can however be bypassed. When using salted passwords the process of cracking a large number of passwords is even slower as every guess has to be hashed separately for every salt + password which is computationally very expensive. enforcing password requirements such as a minimum of around eight characters. The best someone can do is a dictionary attack or brute force attack. or using functions to check the image size are not full proof. Thankfully. If you have a file upload form then you need to treat all files with great suspicion. Using this method means when you are authenticating users you are only ever comparing encrypted values.

11.php?id=1234" /> 2. <img src="/imageDelivery. 6. Although this might not be possible if you don't have access to your server from an internal network as you would need to open up ports to allow uploading files and to remotely log in to .php 5. // imageDelivery. deny from all <Files ~ "^\w+\. Image tags support an src attribute that is not a direct URL to an image. Ensure you have a firewall setup. 3. 4. For example: 1.$fileName). 12.any file they upload. readfile('images/'.htaccess file (see below) that will only allow access to set files preventing the double extension attack mentioned earlier. 2. Header('Content-Type: image/gif').allow allow from all </Files> Ultimately. . chmod 0666 so it can't be executed. // Fetch image filename from database based on $_GET["id"] 7.NET) and deliver them to the browser.php has been known to get through. but it isn't recommended to rely solely on checking the file extension as a file with the name image. so your src attribute can point to your file delivery script providing you set the correct content type in the HTTP header.jpg. // Deliver image to browser 10. By default web servers won't attempt to execute files with image extensions. 13. If possible setting up a DMZ (Demilitarised Zone) only allowing access to port 80 and 443 from the outside world. Some options are to rename the file on upload to ensure the correct file extension. 3. for example. <?php 4. If your files are not directly accessible you will need to create a script to fetch the files from the private folder (or an HTTP handler in . If using *nix you could create a . the recommended solution is to prevent direct access to uploaded files all together. any files uploaded to your website are stored in a folder outside of the webroot or in the database as a blob. 5. 9. 8.. and are blocking all non essential ports. or to change the file permissions. ?> 8.. Server security Most hosting providers deal with the server configuration for you. 1. but if you are hosting your website on your own server then there are few things you will want to check.(gif|jpe?g|png)$"> order deny. This way.

SSL SSL is a protocol used to provide security over the Internet. Finally. minimising the risk of your data being exposed. Attackers could sniff for this information and if the communication medium is not secure could capture it and use this information to gain access to user accounts and personal data. They work on a similar basis to scripts hackers will use in that they test all know exploits and attempt to compromise your site using some of the previous mentioned methods such as SQL injection. Use an SSL certificate 10. Security tools Once you think you have done all you can to secure your website then it's time to test your security. It is a good idea to use a security certificate whenever you are passing personal information between the website and web server or database. If possible have your database running on a different server to that of your web server. Doing this means the database server cannot be accessed directly from the outside world. The most effective way of doing this is via the use of some security tools. If you are allowing files to be uploaded from the Internet only use secure transport methods to your server such as SFTP or SSH. . often referred to as penetration testing or pen testing for short. There are many commercial and free products to assist you with this. only your web server can access it. don't forget about restricting physical access to your server.your server over SSH or RDP. 9.

or cookie values in an attempt to view details of another user. Good for testing SQL injection and XSS OpenVAS. The important thing is to focus on the critical issues first. currently scans over 25. OpenVAS is fork of a Nessus before it became a closed-source commercial product. You will probably find that some of the medium/low issues aren't a concern for your site.Some free tools that are worth looking at:   Netsparker (Free community edition and trial version available). A debugging proxy can assist you here as it allows you to intercept the values of an HTTP request between your browser and the server. Good for testing known vulnerabilities.000. Each issue reported normally comes with a good explanation of the potential vulnerability. Claims to be the most advanced open source security scanner. . as they present a wealth of potential issues. But it can be difficult to setup and requires a OpenVAS server to be installed which only runs on *nix. So what should you be trying to alter on the request? If you have pages which should only be visible to a logged in user then I would try changing URL parameters such as user id. changing the POST values to attempt to submit code to perform XSS or to upload a server side script. The results from automated tests can be daunting. A popular freeware application called Fiddler is a good starting point. Another area worth testing are forms. If you wish to take things a step further then there are some further steps you can take to manually try to compromise your site by altering POST/GET values.

but it is a still a good idea to have knowledge of the most common security exploits so you can ensure you are covered. There are also some helpful modules available for CMSes to check your installation for common security flaws such as Security Review for Drupal and WP Security Scan for WordPress. . Thankfully most CMSes have a lot of inbuilt security features.Hopefully these tips will help keep your site and information safe.