Re: Web security issue help

Ahh, that seems to be stuck as DRAFT. :(
GMAIL on tab is not reliable. Sending you now again.


Regards,
- Ravi Kumar


On Wed, Jun 26, 2013 at 12:11 PM, Raakesh kumar <[email protected]> wrote:

> Thank you all for your valuable suggestions. We have successfully recovered
> the website, changed credentials and going to take extra precautions from
> now onward.
> @Ravi, what and whom did you report?
>
>
> On Tue, Jun 25, 2013 at 6:56 PM, Vivek Puri <[email protected]
> >wrote:
>
> > Hi Raakesh,
> >
> >  we have a website http://www.brahmabooks.com which is developed in core
> >> php
> >> without any framework or anything. Today someone mailed us with few user
> >> details saying that he has hacked our system.
> >> Now i don't understand how
> >> could someone display all details from our database.
> >>
> > Once a hacker gains access to your database, this is simple for him.
> >
> >  We have used PHP PDO
> >> with parameterized query and have tested against lots of sql injection
> >> techniques and found it injection proof. I found that Cookies are not
> >> encrypted and are stored in plain data which i have to take care of but
> is
> >> it possible to get table columns and data with this detail?
> >> Can someone guide me how can i secure it and how he would have got these
> >> details?
> >>
> >>  Security can be broken from many different ways, usually referred as
> > attack vectors.
> > SQL Injection is one of the attack vector, there could potentially be
> many.
> >
> > Just using PHP PDO with parametrized query, reduces risk but doesn't mean
> > it makes
> > it immune. To secure the application you have to secure the OS, web
> > server, php,
> > database, your own code.
> >
> > Most people prefer using some kind of framework specifically for this
> > reason that
> > a popular framework is used by many and have been reviewed for security.
> > Still
> > that doesn't means its bullet proof , just that its better than baking
> > your own
> > code specially if you do not fully understand the aspects of security.
> >
> > Here someone could only give you generic advice basically somethings you
> > can find
> > doing a quick google search also:
> >
> > - Is your OS secure ? Make sure all non essential services are stopped
> > - Make sure you have latest security patches applied.
> > - Is database running on secure or local port ? If not switch to local
> > port.
> > - How complex is the code ? Can you move to using some PHP framework or
> > CMS ?
> > - Can you hire someone to review your code?
> >
> > Once you find answer to these questions you may have better clarity.
> >
> > rgds
> > vivek
> >
> > --
> > http://www.twitter.com/vivpuri | http://www.machint.com
> >
> >
> > ______________________________**_________________
> > Ilugd mailing list
> > Ilugd-cunTk1MwBs8/[email protected]
> > http://frodo.hserus.net/**mailman/listinfo/ilugd<
> http://frodo.hserus.net/mailman/listinfo/ilugd>
> >
>
>
>
> --
> Regards
> RAKESH KUMAR
> http://raakeshkumar.wordpress.com
> _______________________________________________
> Ilugd mailing list
> Ilugd-cunTk1MwBs8/[email protected]
> http://frodo.hserus.net/mailman/listinfo/ilugd
>