3 ms·
> Most online stores have only implemented browser-based defenses, and criminals capitalize on the unprotected back-end. Security professionals should really co
by vmoore 5y ago
> Most online stores have only implemented browser-based defenses, and criminals capitalize on the unprotected back-end. Security professionals should really consider the full attack surface
What's the entry point for such a RAT? Does it scan for vulns in the server and plant itself there, or what? Article is lacking explanation of how a Linux e-commerce backend actually gets comp'd.
- tata71 5y agoOne of thousands of unpatched (either at the sysops level, or the distro level) kernel RCE vulns.
- vmoore 5y agoI thought that. "criminals capitalize on the unprotected back-end" is a bit vague though. An exposé of the actual vulnerability would make this write-up even better, but I imagine the company doesn't want to discuss that for obvious reasons.
- tata71 5y agoThrow a dart: https://www.cvedetails.com/vulnerability-list.php?vendor_id=33&product_id=47&version_id=0&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=7&cvssscoremax=7.99&year=0&cweid=0&order=1&trc=662&sha=27cc1be095dd1cc4189b3d337cc787289500c13e https://www.cvedetails.com/vulnerability-list.php?vendor_id=...
- tuankiet65 5y agoRunning outdated web applications with vulnerabilities I suppose.