5 ms·
Any malware script served to users will also be served to monitors and compromise is just a matter of comparing hashes with originals. Re any compromise, only
by donpark 15y ago
Any malware script served to users will also be served to monitors and compromise is just a matter of comparing hashes with originals.
Re any compromise, only detection of compromise to content/script served to client is necessary in this approach. In extreme case, public read-access to most of the server might even be plausible (although not advisable) IMO.
- adgar 15y agoAnd when China hacks your server, takes a little bit longer, and inserts a rule that only serves the malware JS to Chinese-allocated IPs, will your monitor systems be checking from mainland China, too? Maybe they don't modify your app's code, but insert an iptables rule that achieves the same effect. When a scheme relies on perfect intrusion detection you are not discussing security, you're discussing damage control.
- donpark 15y agoThere are safety measures one has take to deploy stuff I describe to protect against subset attacks like you mentioned as well as hackers using sleepers or logs to identify monitors, etc. It's not easy stuff and definitely not something startups should take on w/o getting side-tracked. This is why I wrote "when applied appropriately" in my original comment.