Only Network » security

When hosting goes wrong

Owen — Mon, 26 Apr 2010 16:06:19 +0000

: Image via CrunchBase

I was reading a report as to how a large number of WordPress blogs on GoDaddy have been hacked and couldn’t help thinking how sometimes we’re just so dependant on the hosting provider we choose. We trust them to maintain proper security, especially on shared hosting accounts and make sure that baddies don’t come by and corrupt our site.

WordPress is a pretty popular target, because of the number of sites out there that run the software, but there’s a great community of people involved in building the platform and making sure it’s secure for everyone. You still need to keep a look out for your blog doing strange things however. So if your site starts redirecting to a site that gives you a security warning, or your find hidden links to some nuphedragen review, just make sure that everything is working fine. If you’re still in doubt, call a WordPress Guru.

Hack Attack

Owen — Mon, 22 Sep 2008 06:29:10 +0000

One of my websites got compromised today. AskOwen‘s been running fine since the first day it went live, however today I found the website defaced. It was an interesting hack, and one that wasn’t connected to the fact that WordPress was running on the site. I had left my .htaccess file writable and this was changed for me. I still need to get to the bottom of how files were written to the server, but I’ll leave that for another day.

Unfortunately there are too many tools out there, that some acne-ridden teenager can use to automatically check for exploits and deface a website. All it takes is the right software and someone to press the button. Not very hard huh?

Project Honeypot

Owen — Sun, 13 Jul 2008 22:56:16 +0000

I’ve just come across an interesting project called Project Honeypot. Here’s what they have to say about themselves:

Project Honey Pot is the first and only distributed system for identifying spammers and the spambots they use to scrape addresses from your website. Using the Project Honey Pot system you can install addresses that are custom-tagged to the time and IP address of a visitor to your site. If one of these addresses begins receiving email we not only can tell that the messages are spam, but also the exact moment when the address was harvested and the IP address that gathered it.

Having some sort of defence for your website is always a great idea, a bit like getting a slipcovers for your sofa. I’ll need to read a bit more about it before deciding whether to implement it or not, but I thought it was an interesting thing to post.

Network Security Toolkit

Owen — Thu, 10 Jul 2008 10:08:17 +0000

If you’re looking for a security toolkit to test for vulnerabilities at your home at office, look no further than the Network Security Toolkit. It’s a bootable CD that fires up a Fedora installation packed with all the security tools you can think of. Here’s how they describe it:

What we find rather fascinating with NST is that we can transform most x86 systems (Pentium II and above) into a system designed for network traffic analysis, intrusion detection, network packet generation, wireless network monitoring, a virtual system service server, or a sophisticated network/host scanner. This can all be done without disturbing or modifying any underlying sub-system disk. NST can be up and running on a typical x86 notebook in less than a minute by just rebooting with the NST CD. The notebook’s hard disk will not be altered in any way.

I wonder if it’s possible to get it running off a flash drive, would be much easier to carry around.

Watch your password

Owen — Wed, 15 Aug 2007 07:21:43 +0000

There’s a number of common passwords that hackers try out when breaking into a system.? Here’s what they are:

Top 10 passwords:

1. 123
Would you protect your bank account with a PIN number this simple and easy to replicate? Come on, be more creative. At least add a word before or after it.

2. password
You may think you’re clever choosing such an easy to remember password, but the problem is that almost 1 in 250 people do the same thing!

3. liverpool
This list is based on a British poll, but the lesson is the same. In this case, “liverpool” could be the name of the city or soccer team. Either way, don’t use your hometown or favorite sports team as a password.

4. letmein
Let me in! Let me in! It’s the modern-day equivalent of “Open Sesame!”

5. 123456
It’s always wise to use one or more numbers in your password, but choose an order that’s not quite so predictable!

6. qwerty
Cute! But don’t use it. It may be that when you have to type something in that blank space for the password, you look down at the keyboard hoping for inspiration and see the first six letters on the top row. The problem is too many other people do the same thing.

7. charlie
Choosing the name of a loved one is commonly done and easily guessed by anyone who knows you. Honor your loved ones in some other way!

8. monkey
It’s a mystery as to why “monkey” is such a popular password, but it could be that it contains six letters (typically, this is the minimum number required), is easy to remember and is easy to type.

9. arsenal
This is the name of a popular soccer team in England, which probably accounts for its presence on this British list. But the lesson still holds in the United States: Don’t choose Giants, Cowboys or Ravens either! Sports teams are ubiquitous passwords. “Arsenal” may also be popular because its first four letters are a four-letter word.

10. thomas
Yet another first name! Choosing a password is not like naming a child.

So now you know what to avoid. Do you use any of them?