4 ms·

Hearing about all these recent hacks (LinkedIn, RubyGems, LivingSocial) really makes me nervous and wonder how I can avoid hacks. Are there any details on how t

Hearing about all these recent hacks (LinkedIn, RubyGems, LivingSocial) really makes me nervous and wonder how I can avoid hacks. Are there any details on how these systems were hacked in the first place, so that the rest of us can learn from the lessons? I already use as many security good practices as I can (bcrypt, processes and apps running under different user accounts and database accounts, read-only accounts, principle of least privilege, firewall, fail2ban, key-only SSH logins, file modification monitoring, forwarding logs to a log host, etc) but I can't shake off the feeling that I may be forgetting something.

larrys 14y ago
"and wonder how I can avoid hacks" (I'll leave it to others more knowledgeable to answer this but keep what I say next in mind.) My question to you is, how big of a target are you? I mean the security you would use if you are Madonna is not the same as a "B" list actor or the person working in the local coffee shop. You can put untold hours into this but unfortunately security is a full time job and can also detract from other things you need to be concerned with that might be more important for your particular situation. "I may be forgetting something" Sure but the same concern is in play when taking a trip or with anything. What are you forgetting? Where are you going? How easy will it be to solve the problem and how much impact will forgetting dental floss have? Are you going to an uninhabited island or Manhattan where you can buy almost anything 24/7?
- laumars 14y ago
  What you're advocating is bordering dangerously into the realm of "security through obscurity" - a very bad principle to base any kind of security on. While the former member might not be a high profile target for the moment (and let's assume that he isn't for the sake of devils advocate), who's to say that next week a story hits the news about his wife or children or even a company he's affiliated with and then reporters decide to start poking about on forums and social media for cheap information to write sensationalist reports on? Or that hackers use that news as an excuse to target the poor guy? Or even who's to say that next month he annoys someone on HN who decides to play some pranks? While you are right that that security is a full time job, you should never advocate the numbers game because as remote as the odds might be, people do win the lottery.
  - rmrfrmrf 14y ago
    I think both of you and your parent post's points are well-taken. IMO you should do all that you can to secure your site within practical reasoning. The LivingSocial password hashing debacle is an example of a security failure that pretty much every website in the known universe could improve on by changing a single line of code -- that's what's so frustrating about it in the first place. There are cases, though, where certain security measures are probably not needed. For example, I would probably not recommend that my mom use a keyfob security token to log into her blog admin page (although I'd probably offer to make one for her with an Arduino as a weekend project lol), or hire armed guards to guard her database servers. Enterprises certainly need these measures along with many others.
    - laumars 14y ago
      What you're discussing is how valuable is the data. eg if your mum lost her blog (and kudos to her being tech-savvy enough to run one - my mum certainly isn't!), it would be frustrating, but not really a big problem. She'd just just restore from a back up, change the passwords then back to business as usual. But then you're comparing it against examples where there's confidential information (eg user passwords) which, if stolen, is a massive problem. I'm assuming from the OPs tone, that his box sits somewhere between the two extremes. However the very fact that he's got an SSH account on it makes the box a much more favorable target than the millions of free blogs on shared hosting services - so even if his box doesn't contain 3rd party passwords and/or credit card information, and even if he can easily restore the box from a back up, he still has the problem that a break in could see his box used to send spam and what not. Many hosting providers will just kill your subscription if that happens. So while you're right that there's a balance between security and usability, security most definitely comes first if you're administrating your own VPS / dedicated hardware.
  - larrys 14y ago
    "What you're advocating is bordering dangerously into the realm of "security through obscurity" - a very bad principle to base any kind of security on." I don't believe that is what I am saying. I'm saying you are less of a target if you are "nobody" than "somebody". Would you agree that it is proper to have more security in place at an event like the Boston Marathon or a major league baseball game or when the prime minister visits then the dance recital at the local school?
rmrfrmrf 14y ago
Who is able to physically access your database hardware? Can you or any of your employees walk up to it? If so, who? If someone had a gun to your head and demanded your username and password list or they'd shoot you, how would you get the data for them? Who knows the sensitive database passwords? Where are they stored? How often are they changed? Have you fired anyone recently? Was their access revoked and were all passwords changed? Things you didn't mention as precautions are protections from SQL injection attacks (I'm assuming you're using prepared statements) and that you're using huge passphrases, along with making sure that your applications are up to date with the latest security patches.

larrys 14y ago

"and wonder how I can avoid hacks" (I'll leave it to others more knowledgeable to answer this but keep what I say next in mind.) My question to you is, how big of a target are you? I mean the security you would use if you are Madonna is not the same as a "B" list actor or the person working in the local coffee shop. You can put untold hours into this but unfortunately security is a full time job and can also detract from other things you need to be concerned with that might be more important for your particular situation. "I may be forgetting something" Sure but the same concern is in play when taking a trip or with anything. What are you forgetting? Where are you going? How easy will it be to solve the problem and how much impact will forgetting dental floss have? Are you going to an uninhabited island or Manhattan where you can buy almost anything 24/7?

laumars 14y ago
What you're advocating is bordering dangerously into the realm of "security through obscurity" - a very bad principle to base any kind of security on. While the former member might not be a high profile target for the moment (and let's assume that he isn't for the sake of devils advocate), who's to say that next week a story hits the news about his wife or children or even a company he's affiliated with and then reporters decide to start poking about on forums and social media for cheap information to write sensationalist reports on? Or that hackers use that news as an excuse to target the poor guy? Or even who's to say that next month he annoys someone on HN who decides to play some pranks? While you are right that that security is a full time job, you should never advocate the numbers game because as remote as the odds might be, people do win the lottery.
- rmrfrmrf 14y ago
  I think both of you and your parent post's points are well-taken. IMO you should do all that you can to secure your site within practical reasoning. The LivingSocial password hashing debacle is an example of a security failure that pretty much every website in the known universe could improve on by changing a single line of code -- that's what's so frustrating about it in the first place. There are cases, though, where certain security measures are probably not needed. For example, I would probably not recommend that my mom use a keyfob security token to log into her blog admin page (although I'd probably offer to make one for her with an Arduino as a weekend project lol), or hire armed guards to guard her database servers. Enterprises certainly need these measures along with many others.
  - laumars 14y ago
    What you're discussing is how valuable is the data. eg if your mum lost her blog (and kudos to her being tech-savvy enough to run one - my mum certainly isn't!), it would be frustrating, but not really a big problem. She'd just just restore from a back up, change the passwords then back to business as usual. But then you're comparing it against examples where there's confidential information (eg user passwords) which, if stolen, is a massive problem. I'm assuming from the OPs tone, that his box sits somewhere between the two extremes. However the very fact that he's got an SSH account on it makes the box a much more favorable target than the millions of free blogs on shared hosting services - so even if his box doesn't contain 3rd party passwords and/or credit card information, and even if he can easily restore the box from a back up, he still has the problem that a break in could see his box used to send spam and what not. Many hosting providers will just kill your subscription if that happens. So while you're right that there's a balance between security and usability, security most definitely comes first if you're administrating your own VPS / dedicated hardware.
- larrys 14y ago
  "What you're advocating is bordering dangerously into the realm of "security through obscurity" - a very bad principle to base any kind of security on." I don't believe that is what I am saying. I'm saying you are less of a target if you are "nobody" than "somebody". Would you agree that it is proper to have more security in place at an event like the Boston Marathon or a major league baseball game or when the prime minister visits then the dance recital at the local school?

rmrfrmrf 14y ago

Who is able to physically access your database hardware? Can you or any of your employees walk up to it? If so, who? If someone had a gun to your head and demanded your username and password list or they'd shoot you, how would you get the data for them? Who knows the sensitive database passwords? Where are they stored? How often are they changed? Have you fired anyone recently? Was their access revoked and were all passwords changed? Things you didn't mention as precautions are protections from SQL injection attacks (I'm assuming you're using prepared statements) and that you're using huge passphrases, along with making sure that your applications are up to date with the latest security patches.