5 ms·

Hosting a copy of phpMyAdmin behind basic HTTP authentication in 2025 really is asking for it.

by cbg0 1y ago

jsheard 1y ago
I was kinda surprised to see that phpMyAdmin is still maintained, albeit only barely. The last release was in January but before that it hadn't been touched for over two years.
- pelagicAustral 1y ago
  This stuff is still packaged with cPanel, which is probably the most common way to manage web servers on the internet.
  - Macha 1y ago
    I wonder how long it's been since that was true. I think that era passed when most small businesses and individuals moved from self hosting to SaaS.
    - technion 1y ago
      Nearly every website developer servicing small business builds a WordPress site and sets it up on a hosting company's cPanel install with phpmyadmin running by default.
      - jsheard 1y ago
        I guess those installs are the ones the Wordpress vuln scanners are looking for when they spam my server with /wp-admin/ requests.
      - Macha 1y ago
        Which are far far outnumbered by people setting up squarespace sites, or shopify sites or facebook pages or twitter profiles these days. It was definitely true at one point that small scale indie web devs and small business contractors outnumbered big tech in both headcount and servers. I don't think that's been true for a while now.
        mmcwilliams 1y ago
        Do you have figures for that?
        Tijdreiziger 1y ago
        That’s not what the stats show. WordPress powers 43% of websites today. Shopify, Wix, and Squarespace together only account for 11%. https://w3techs.com/technologies/overview/content_management https://w3techs.com/technologies/overview/content_management
        Macha 1y ago
        Here's their "10 popular sites using Wordpress" - microsoft.com - It's not wordpress, probably home grown - wordpress.org - This one's a freebie - digicert.com - Using Adobe Experience Manager, per script includes - wordpress.com - Another freebie - mozilla.org - No, using a homegrown CMS: https://github.com/mozilla/nucleus https://github.com/mozilla/nucleus - nih.gov - It's using Drupal, per a meta generator tag - forbes.com - No real for or against evidence, though the lack of any wp- paths leans a little more against it being wordpress - archive.org - It's some type of react app, not wordpress. Probably home grown - nginx.org - Just... no. - ebay.com - Would it surprise you, no. I have serious questions about their methodology. Similarly, just because sites like Techcrunch use Wordpress, doesn't mean they're doing it by having someone upload files over FTP to some cPanel managed Godaddy account.
        Tijdreiziger 1y ago
        Most of those do in fact seem to use WordPress for part of their site: * microsoft.com – uses WP at devblogs.microsoft.com * digicert.com – may be a false positive, they link to files at /wp-content/ URLs, maybe they used WP in the past and kept the URLs? * mozilla.org – uses WP at blog.mozilla.org * nih.gov – uses WP at directorsblog.nih.gov * forbes.com – can’t tell, my ad blocker breaks their cookie consent screen * archive.org – uses WP at blog.archive.org * nginx.org – uses WP at blog.nginx.org * ebay.com – may be false positive? We end up with 2/10 potential false positives, and one unknown (and even then, those are huge sites, who knows if they’ve got WP hiding under some deeply-buried subdomain). I agree with you that Microsoft and TechCrunch probably aren’t FTPing their files in, but even if we assume that only 50% of WordPress sites are doing so, that’s still more websites than the next 10 competitors, combined! If you think about it, this makes sense: do you reckon your local small businesses have a TechCrunch-level web presence, or are they using GoDaddy? Now consider that there exist many more local businesses than TechCrunches.
    - doublerabbit 1y ago
      I serve a cPanel hosting, some people just want something up and running now which cPanel provides. With Softaculous for automatic installation of scripts it's still widely popular for Wordpress installations. Web hosting is however a very dead market to startup in.
whalesalad 1y ago
A tale as old as time
TonyTrapp 1y ago
Can you please elaborate how it is "asking for it" if we assume the basic auth password is reasonably complex and kept as safe as, say, the SSH login credentials of the same server?
- cbg0 1y ago
  You shouldn't be logging in to a server via SSH using a user+password combo, instead use a public/private key combo which is considerably more complex and can't effectively be bruteforced like a user+password. Most web servers don't really come with any built in defense against brute force attempts vs Basic Auth gates, so unless you've set something up to protect it, someone with enough time will eventually get in.
  - lossolo 1y ago
    > someone with enough time will eventually get in That's only correct if the password is weak. With enough entropy, it's practically impossible to brute force.
  - ArinaS 1y ago
    > "can't effectively be bruteforced like a user+password." Only when the password is weak enough to bruteforce swiftly. It will take literally thousands of years to bruteforce strong passwords.
    - DrillShopper 1y ago
      But you only need one weak password to get in
      - that_guy_iain 1y ago
        But you only need one password to protect your HTTP auth phpMyAdmin so just make it 30 characters.
  - voidUpdate 1y ago
    Genuine question that I haven't found a good solution to yet, if I want to just go to any old computer and ssh into my server, do I have to carry around a USB stick with the ssh key on or something? because I sure as hell wont be able to just remember it
lossolo 1y ago
Sure, if you slap Basic Auth with "admin:admin" on phpMyAdmin in 2025, you're asking for it. But a Basic Auth password with 256 bits of entropy is just as resistant to brute force as AES-256 (assuming the implementation is sound and TLS is used). It's not the protocol that's insecure, it's usually how it's deployed.
- andruby 1y ago
  Only if it's only accessible via proper TLS (otherwise it's easy to read the user/pass with MITM as basic auth doesn't encrypt the user/pass). If there is no throttling/rate-limiting/banning then this setup allows for a lot of attempts, wether brute-force or dictionary.
  - RockRobotRock 1y ago
    What is "a lot of attempts"? I'm no expert in cryptography, but there's many orders of magnitude difference between a distributed bruteforce of a known hash, and bruteforcing over the web.
  - jeroenhd 1y ago
    As long as "a lot of attempts" take longer than the time it'll take the sun to expand and envelop the earth, that's not really a problem. Every form of authentication is either subject to "a lot of attempts" or trivial DoS (for when you rate limit the login API so now admins can't log in either). The principles behind modern authentication are mostly "how do we make verification require even more attempts if the attacker doesn't know the password".
  - Sohcahtoa82 1y ago
    "a lot of attempts" is doing a LOT of heavy lifting here. If your password was a set of random letters (both upper and lower case) and numbers and 20 characters long, then even if you could attempt 1,000 logins/second (a very high number for an online attack), it would take a whopping 2,232,000,000,000,000,000,000,000 years. If you could do 1,000,000 logins/second, an absolutely absurd number for an online attack, that only takes 3 zeros off that number.
ndiddy 1y ago
The hacker posted a screenshot of the shell on the 4chan server. It was running FreeBSD 10.1, which came out in 2014 and stopped getting patches in 2016. It seems like there was basically nobody doing maintenance after moot sold the site. I wonder how long it'll take for them to get the site back up if they don't have anyone who can do server administration.

Hosting a copy of phpMyAdmin behind basic HTTP authentication in 2025 really is asking for it.

by cbg0 1y ago

Hosting a copy of phpMyAdmin behind basic HTTP authentication in 2025 really is asking for it.

I was kinda surprised to see that phpMyAdmin is still maintained, albeit only barely. The last release was in January but before that it hadn't been touched for over two years.

pelagicAustral 1y ago
This stuff is still packaged with cPanel, which is probably the most common way to manage web servers on the internet.
- Macha 1y ago
  I wonder how long it's been since that was true. I think that era passed when most small businesses and individuals moved from self hosting to SaaS.
  - technion 1y ago
    Nearly every website developer servicing small business builds a WordPress site and sets it up on a hosting company's cPanel install with phpmyadmin running by default.
    - jsheard 1y ago
      I guess those installs are the ones the Wordpress vuln scanners are looking for when they spam my server with /wp-admin/ requests.
    - Macha 1y ago
      Which are far far outnumbered by people setting up squarespace sites, or shopify sites or facebook pages or twitter profiles these days. It was definitely true at one point that small scale indie web devs and small business contractors outnumbered big tech in both headcount and servers. I don't think that's been true for a while now.
      - mmcwilliams 1y ago
        Do you have figures for that?
      - Tijdreiziger 1y ago
        That’s not what the stats show. WordPress powers 43% of websites today. Shopify, Wix, and Squarespace together only account for 11%. https://w3techs.com/technologies/overview/content_management https://w3techs.com/technologies/overview/content_management
        Macha 1y ago
        Here's their "10 popular sites using Wordpress" - microsoft.com - It's not wordpress, probably home grown - wordpress.org - This one's a freebie - digicert.com - Using Adobe Experience Manager, per script includes - wordpress.com - Another freebie - mozilla.org - No, using a homegrown CMS: https://github.com/mozilla/nucleus https://github.com/mozilla/nucleus - nih.gov - It's using Drupal, per a meta generator tag - forbes.com - No real for or against evidence, though the lack of any wp- paths leans a little more against it being wordpress - archive.org - It's some type of react app, not wordpress. Probably home grown - nginx.org - Just... no. - ebay.com - Would it surprise you, no. I have serious questions about their methodology. Similarly, just because sites like Techcrunch use Wordpress, doesn't mean they're doing it by having someone upload files over FTP to some cPanel managed Godaddy account.
        Tijdreiziger 1y ago
        Most of those do in fact seem to use WordPress for part of their site: * microsoft.com – uses WP at devblogs.microsoft.com * digicert.com – may be a false positive, they link to files at /wp-content/ URLs, maybe they used WP in the past and kept the URLs? * mozilla.org – uses WP at blog.mozilla.org * nih.gov – uses WP at directorsblog.nih.gov * forbes.com – can’t tell, my ad blocker breaks their cookie consent screen * archive.org – uses WP at blog.archive.org * nginx.org – uses WP at blog.nginx.org * ebay.com – may be false positive? We end up with 2/10 potential false positives, and one unknown (and even then, those are huge sites, who knows if they’ve got WP hiding under some deeply-buried subdomain). I agree with you that Microsoft and TechCrunch probably aren’t FTPing their files in, but even if we assume that only 50% of WordPress sites are doing so, that’s still more websites than the next 10 competitors, combined! If you think about it, this makes sense: do you reckon your local small businesses have a TechCrunch-level web presence, or are they using GoDaddy? Now consider that there exist many more local businesses than TechCrunches.
  - doublerabbit 1y ago
    I serve a cPanel hosting, some people just want something up and running now which cPanel provides. With Softaculous for automatic installation of scripts it's still widely popular for Wordpress installations. Web hosting is however a very dead market to startup in.

whalesalad 1y ago

A tale as old as time

TonyTrapp 1y ago

Can you please elaborate how it is "asking for it" if we assume the basic auth password is reasonably complex and kept as safe as, say, the SSH login credentials of the same server?

cbg0 1y ago
You shouldn't be logging in to a server via SSH using a user+password combo, instead use a public/private key combo which is considerably more complex and can't effectively be bruteforced like a user+password. Most web servers don't really come with any built in defense against brute force attempts vs Basic Auth gates, so unless you've set something up to protect it, someone with enough time will eventually get in.
- lossolo 1y ago
  > someone with enough time will eventually get in That's only correct if the password is weak. With enough entropy, it's practically impossible to brute force.
- ArinaS 1y ago
  > "can't effectively be bruteforced like a user+password." Only when the password is weak enough to bruteforce swiftly. It will take literally thousands of years to bruteforce strong passwords.
  - DrillShopper 1y ago
    But you only need one weak password to get in
    - that_guy_iain 1y ago
      But you only need one password to protect your HTTP auth phpMyAdmin so just make it 30 characters.
- voidUpdate 1y ago
  Genuine question that I haven't found a good solution to yet, if I want to just go to any old computer and ssh into my server, do I have to carry around a USB stick with the ssh key on or something? because I sure as hell wont be able to just remember it

lossolo 1y ago

Sure, if you slap Basic Auth with "admin:admin" on phpMyAdmin in 2025, you're asking for it. But a Basic Auth password with 256 bits of entropy is just as resistant to brute force as AES-256 (assuming the implementation is sound and TLS is used). It's not the protocol that's insecure, it's usually how it's deployed.

andruby 1y ago
Only if it's only accessible via proper TLS (otherwise it's easy to read the user/pass with MITM as basic auth doesn't encrypt the user/pass). If there is no throttling/rate-limiting/banning then this setup allows for a lot of attempts, wether brute-force or dictionary.
- RockRobotRock 1y ago
  What is "a lot of attempts"? I'm no expert in cryptography, but there's many orders of magnitude difference between a distributed bruteforce of a known hash, and bruteforcing over the web.
- jeroenhd 1y ago
  As long as "a lot of attempts" take longer than the time it'll take the sun to expand and envelop the earth, that's not really a problem. Every form of authentication is either subject to "a lot of attempts" or trivial DoS (for when you rate limit the login API so now admins can't log in either). The principles behind modern authentication are mostly "how do we make verification require even more attempts if the attacker doesn't know the password".
- Sohcahtoa82 1y ago
  "a lot of attempts" is doing a LOT of heavy lifting here. If your password was a set of random letters (both upper and lower case) and numbers and 20 characters long, then even if you could attempt 1,000 logins/second (a very high number for an online attack), it would take a whopping 2,232,000,000,000,000,000,000,000 years. If you could do 1,000,000 logins/second, an absolutely absurd number for an online attack, that only takes 3 zeros off that number.

ndiddy 1y ago

The hacker posted a screenshot of the shell on the 4chan server. It was running FreeBSD 10.1, which came out in 2014 and stopped getting patches in 2016. It seems like there was basically nobody doing maintenance after moot sold the site. I wonder how long it'll take for them to get the site back up if they don't have anyone who can do server administration.