full-disclosure - Re: Question regarding script vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Thu, 20 Dec 2012 22:45:26 -0500
From: Jerry Bell <jerry@...kologist.com>
To: Rand McRanderson <therandshow@...il.com>
Cc: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: Re: Question regarding script vulnerabilities

I think some of the other responses missed the subtleties of your question.  Let me see if I can expand it accurately:

We know that malicious scripts are very problematic in shared hosting environments, because there are many avenues of attack: control panel attacks, symlinks, bad directory permissions, poorly configured/maintained software and on and on.

But, in the case of a VPS or dedicated server, most of those worries aren't present because there are no other "customers" on the OS, and generally the owner of the VPS/dedicated server can configure and manage security and software to his/her liking, leaving the "trust worthy" aspect of a datacenter to mean that they will not run off with your hard drives, share root passwords (if given to the provider), and that sort of thing.

Assuming this is indeed what you meant, my opinion is that there's a significantly lower probability that you'll have to content with malicious scripts on a dedicated server, but the risk isn't eliminated.  The main objective of many attacks on servers these days is to install some sort of malicious script.  So, as one of the other responses indicates, there are vectors by which attackers may be able to plant them, and so it does make sense to pay attention.

- Jerry

On Dec 19, 2012, at 12:25 AM, Rand McRanderson <therandshow@...il.com> wrote:

> I was curious, if you have a virtual dedicated server or a dedicated server, and a reasonably trustworthy hosting service, are malicious scripts planted by external people a big concern? If so why?
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/