lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 20 Dec 2012 22:45:26 -0500
From: Jerry Bell <jerry@...kologist.com>
To: Rand McRanderson <therandshow@...il.com>
Cc: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: Re: Question regarding script vulnerabilities

I think some of the other responses missed the subtleties of your question.  Let me see if I can expand it accurately:

We know that malicious scripts are very problematic in shared hosting environments, because there are many avenues of attack: control panel attacks, symlinks, bad directory permissions, poorly configured/maintained software and on and on.

But, in the case of a VPS or dedicated server, most of those worries aren't present because there are no other "customers" on the OS, and generally the owner of the VPS/dedicated server can configure and manage security and software to his/her liking, leaving the "trust worthy" aspect of a datacenter to mean that they will not run off with your hard drives, share root passwords (if given to the provider), and that sort of thing.

Assuming this is indeed what you meant, my opinion is that there's a significantly lower probability that you'll have to content with malicious scripts on a dedicated server, but the risk isn't eliminated.  The main objective of many attacks on servers these days is to install some sort of malicious script.  So, as one of the other responses indicates, there are vectors by which attackers may be able to plant them, and so it does make sense to pay attention.

- Jerry


On Dec 19, 2012, at 12:25 AM, Rand McRanderson <therandshow@...il.com> wrote:

> I was curious, if you have a virtual dedicated server or a dedicated server, and a reasonably trustworthy hosting service, are malicious scripts planted by external people a big concern? If so why?
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists