Forgot your password?
typodupeerror
Security The Almighty Buck

70% of Sites Hackable? $1,000 Says "No Way" 146

Posted by kdawson
from the money-where-mouth-is dept.
netbuzz writes "Security vendor Acunetix is flogging a survey that claims 7 out 10 Web sites it checked have vulnerabilities posing a medium- to high-level risk of a breach of personal data. Network World's go-to security guy, Joel Snyder, says that percentage is 'sensationalist nonsense' — and he's willing to back that judgment with $1,000 of his own money. In fact Snyder will pay up if Acunetix can get personal data out of 3 of 10 sites chosen at random from their survey list."
This discussion has been archived. No new comments can be posted.

70% of Sites Hackable? $1,000 Says "No Way"

Comments Filter:
  • by Anonymous Coward on Wednesday February 14, 2007 @09:05AM (#18010364)
    I can totally believe this. Especially after some recent research that I've done into the security of one specific web hosting provider. It wasn't the users' fault, it was very poor security on the side of the provider. Of course, the provider states how good their security is on their website, but its only false security. For instfance, home directories have the permissions 711, which would make the causual unix user think that you can't view files in the person's home directory, but of course, since there is a predictable structure under that, it is trivial to get into someone's web directory which is world readable. And thus you can get access to their database passwords and so hon. And this is a very large hosting provider, over 100,000 websites are hosted with them. I can only imagine that many other hosting providers have these same types of problems.

    Actually, I am wanting to release my findings publically and name the hosting providerf, but I'm worried about getting sued or being investigated. I would think that as long as I only state factual information that can be obtained in a trivial and public manner that it would be alright. I mean I'm not smashing the stack or anything to get this information, I'm talking about all I have to do is use commands like cd, cat and find. Real hackers tools, eh? With how many users and servers this place has, I'm amazed they havben't had all their user's accounts wiped out. It would be trivial to do.

    I think I may start an anonymous blog to document these cases.
    • by Eivind (15695) <eivindorama@gmail.com> on Wednesday February 14, 2007 @09:27AM (#18010552) Homepage
      Having web-directories 755 or similar ain't in itself a threat. Now, if the setup is such that you can't restrict readability of config-files and have them still readable by your php (or whatever!) process, then they're seriously fucked, agreed.

      My web-directory is 755 too, along with 644 for the static content there. However all my script and config-files are 640 with the group set to a group ( user_web ) that all scripts run as.

      Basic idea ? If you're clueless you're screwed no-matter-what. And if your hosting-provider is sufficiently clueless, then you're screwed even if you have a clue. Unless you use that clue to find a new hosting-provider.

      • How to do it right (Score:1, Insightful)

        by Anonymous Coward
        I'm the original poster and I run a web hosting provider myself. The way I do it that is guaranteed to keep shell users out is to put everyone in the users group and then make home direcotires 705 and owned by the users group. That keeps users out but allows Apache in. Then I have Apache/PHP setup in a way that prevents users from accessing other user's files. I don't want to rely on hoping things are safe, I want to be sure that they are. Still, PHP has some flaws in it that can't 100% guarentee that
        • with mod_php ?

          because PHP safe_mode is a joke

          CGI/suexec is the only way I know about, though I gave up once I'd got it sorted so there may be another.

          DB passwords - putting them in httpd.conf is a start.

      • by Tony Hoyle (11698) <tmh@nodomain.org> on Wednesday February 14, 2007 @09:48AM (#18010764) Homepage
        I've seen plenty of scripts with instructions like

        "Install this then chmod -R 777 so that the script can work"

        Clueless noobs then go and install it and wonder why they're hacked the next week...

        I always go through locking down such scripts (minimal permissions, rename all config files and, if possible, put them outside the web root. Same for writable directories if any are required). Those that can't be locked down are simply deleted.
    • by DrSkwid (118965)
      Sorry, but that's the user's fault for not performing due diligence when choosing a provider.

      • re: due diligence (Score:2, Interesting)

        by theBeak (1003038)
        True, due diligence is the customer's responsibility. But how many customers REALLY know what to check for when it comes to security, infrastructure or otherwise? Let's face it, even those who bother to pick up the phone and call a provider will at most ask "are you secure" etc., and naturally the rep will say "absolutely". I mean, look at the whole Blackboard course management system mess. Do you really think any techie would choose them over Angel, the myriad open source solutuions, et al? Of course not.
    • Re: (Score:3, Informative)

      by ACMENEWSLLC (940904)
      Security at ISP's generally suck. We own multiple domains. We have multiple ISP's providing websites.

      I took one of our domains and set it up at the other ISP, and visa versa.

      When I sent an e-mail on domain1 to domain2, it didn't go to domain2. It went to the fake domain2 I setup with ISP hosting domain1.

      This means their DNS that holds the zone data is also the same DNS server they use for lookups. Both ISP's had this problem.

      This means that someone could setup a domain ebay.com, or usbank.com, or what
    • by Deagol (323173)
      I mean I'm not smashing the stack or anything to get this information, I'm talking about all I have to do is use commands like cd, cat and find. Real hackers tools, eh?

      Careful there, fella....

      True story. I know a good, sharp guy who, while doing consulting work for a small, rural ISP, downed a production system by mistake. The owners apparently sued him, and during trial, some 'expert' witness tried defend the ISPs position that my friend's cat'ing of /etc/password during the course of his work was ha

  • Legal? (Score:5, Insightful)

    by Max Romantschuk (132276) <max@romantschuk.fi> on Wednesday February 14, 2007 @09:06AM (#18010380) Homepage
    ...seriously, this can't be? Right?

    The actual hacking, not the challenge, that is.
    • Re:Legal? (Score:5, Funny)

      by bad_fx (493443) on Wednesday February 14, 2007 @09:21AM (#18010508) Journal
      Perhaps that's what Joel is counting on... Seems like Acunetix is screwed either way. Still, it's probably what they deserve for making the claims in the first place. ;) I had to laugh at this:

      "Without sounding apocalyptic, I believe the 70% figure should send tremors not just ripples in the market," says Kevin Vella, vice president of sales and operations, sounding apocalyptic in a press release.
      • Re:Legal? (Score:4, Informative)

        by varmittang (849469) on Wednesday February 14, 2007 @12:43PM (#18013028)
        They replied, and basically stated they would accept, but wouldn't hack third party sites since its illegal.

        Dear Mr. McNamara and Mr. Snyder, We read the blog published yesterday by yourself together with the subsequent comment by Joel Snyder and would like to make the following comments while also addressing the issues raised.

        The point of publishing the results of the 3200-strong survey was to address the lack of awareness among organizations of the critical dangers of such web application vulnerabilities as Cross Site Scripting, SQL Injection and Cross Site Request Forgery. We are merely pointing out a trend corroborated by other published studies concluding that web security is a problem. It surprises us that Mr. Snyder is among those who do not take the present situation seriously by, indeed, making a mockery of the results through claims that these are incorrect.

        This further proves our point that web application security is one of the least understood and often misconceived aspects of online security today.

        Several experts in the field (for example, Jeremiah Grossman) have been stating these facts and dangers for a few years now. So we are not the only ones when it comes to web application security concerns.

        I do concede sounding apocalyptic with my comment and, for this I apologize. The fact remains, however, that 70% out of the commercial and non-commercial entities that we scanned were seriously vulnerable to hacking during the time we scanned them. Others (for example, http://ha.ckers.org/blog/20070213/70-of-websites-u nder-immediate-risk-of... [ckers.org]) believe that these figures are much greater.

        We are available to put Mr. Snyder's doubts of the validity of our results at rest by submitting all the reports to a trusted third party with proven web security experience and knowledge. Given appropriate authorization and permission from the owners of the websites we scanned during January 2006 -7, Mr. Snyder would be able to see any of the full reports of our scans - these highlight where and when the vulnerabilities were found. Of course, we cannot vouch that these vulnerabilities have not been fixed but are willing to do this for the sake of professional correctness. And, after all, we stand behind our data.

        We are willing to accept the challenge. However we feel that the subject of the challenge should be the Network World website, rather then - as Mr. Snyder suggested - an innocent third party website. After all, making a wager with someone else's website would be unfair, and furthermore illegal.

        So we will accept the wager and perform a security audit on the Network World site and attempt to breach any vulnerabilities found. This should be a fair substitute, since we are assuming that considering Mr. Snyder's comments, Network World is confident that its website is secure and any data it holds is unbreachable.

        Should Network World accept, we will start the audit immediately and point out any vulnerabilities found to the public. If we do manage to breach the Network World website, we would expect Network World to make a public statement, - published on the home page and first page of the next Network World issue - that its website was actually vulnerable and that Acunetix were able to hack it.

        We do expect a response within the next 24 hours that the company authorizes us to immediately perform the security audit and that the company takes full legal responsibility and holds us harmless for any resulting outages and damages.

        Our team thanks you for this opportunity and looks forward to the challenge!

        Signed,
        Nick Galea, CEO and Kevin J Vella, VP Sales and Operations

        Acunetix Ltd Direct: +356 2316 8126 Tel: +356 2316 8000 Fax: +356 2316 8001 Web: http://www.acunetix.com/ [acunetix.com] Web: http://www.acunetix.de/ [acunetix.de]
        • by LordEd (840443)
          In many cases, auditing a site's security is a service. Perhaps Acunetix should ask them to pick the random sites and ask permission to test their security much in the fashion as the above letter for the purpose of this challenge.
    • Re: (Score:3, Insightful)

      by Karganeth (1017580)
      I wouldn't be surprised if the challenge was illegal too. IANAL, but isn't putting a reward on comitting a crime seen as inciting crime? I'm pretty sure that I'd end up in lots of trouble if I said "$10,000 says you can't rob that guys house" and the person accepted the challenge then was caught.
      • Re: (Score:3, Funny)

        by MarkGriz (520778)

        I'm pretty sure that I'd end up in lots of trouble if I said "$10,000 says you can't rob that guys house" and the person accepted the challenge then was caught.

        Probably right. Best to stick with the "triple dog dare ya"
  • by Smidge204 (605297) on Wednesday February 14, 2007 @09:07AM (#18010388) Journal
    At least he's not offering $1000 per site hacked, unlike the shmuck [kotaku.com] who offered a $1,200 bounty on every unsold PS3 [penny-arcade.com].

    =Smidge=
    • by joel_snyder (561706) on Wednesday February 14, 2007 @09:45AM (#18010732)
      I'm sure that if they're serious about actually showing that the statistics are useful then we can find 10 random sites who are willing to be 'ethically hacked.'

      The astonishing thing is that most people who will read this press release just don't get it, and the depths of their not getting it are even more astonishing...

      I am challenging the conclusion, not the data. I believe that they think that they have found vulnerabilities. I suspect they have found a lot of lousy code. No surprise here. 70%, sure. I'll bite off on that number. I'm not arguing with that.

      But there is a huge difference between turning a vulnerability into a breach. Let me give you an example. A lot of Cross-Site Scripting attacks let you steal cookies. So they probably found those. But the question is: when you have a cookie, what can you do with it? Can you steal important data? Can you turn that cookie into a breach? Good web sites that use them also tie cookies to your IP address, which means that if you steal my cookie, you got nothing but crumbs. So the point is not that there are these vulnerabilities, but that they have done nothing to show whether these vulnerabilities are truly breachable and able to get an attacker real useful data.

      Same for things like directory listing. You can do that to my web site. Is that a security problem? No, in fact, I turned it on specifically. If I didn't want people to read it, I wouldn't have put it on the friggin' web server.

      Is a web site that's susceptible to an SQL injection attack hackable? Depends on where you get to inject the code. I'm sure that someone who put their mind to it could take a web site like, say, slashdot, and inject some SQL. Then they might be able to ... well, they could read all those posts that are on the web site. Except they wouldn't be nicely formatted, but real men write HTML with vi anyway. Maybe they could store or corrupt data with the injection, and maybe they couldn't. Maybe (and this is most likely) they could cause the script to blow up. Is that "hacking" a web site? Hell, I get script explosion errors from web sites WITHOUT hacking them.

      Is being able to view a script a security vulnerability? it depends. It depends on the web site. The script. The webmaster's intentions.

      What percentage web sites actually have data that's worth anything?

      So the point is not that they've found a lot of theoretical issues, but whether they've actually found security issues. And the only way, in my mind, to see whether they have is to see if the issues can be exploited. If they can, I'll pay up. If they can't be exploited, then all they've done is made long lists of things that don't matter from a security point of view.

      Very long lists.
      • Actually it wouldn't surprise me either way ...

        I work as a contractor in web-development and you'd be surprised by the number of live web-applications I see where SQL injection attacks are possible; in most cases the management doesn't see the risk so they're unwilling to fix the problem.
        • Funny...I work for a large company and you'd be surprised by the number of live web-applications developed by overpaid contractors which are rife with holes for SQL injection and XSS attacks. Present company excluded, certainly ;). And that's not even the ones developed by internal employees (yuck).

          In all seriousness, you are right though. It's amazing how bad programmers can render otherwise secure servers and development methodologies (like LAMP) totally insecure. On the intranet where I work, its e
          • by Feyr (449684)

            i had one developper tell me "they can't modify that field, it's protected by javascript!"

            the same guy also sent the clear text password in the change password field. said "what, you can see the password in the source?" when i confronted him about it

            so no, i'm not surprised
      • It seems to me like they are exploiting the term "hacking". Don't know if this is a silly question or not. But...Is there a way to quantify the use of the term? Is there a line in the sand that qualifies for hacking past the social norm?
        • by Pojut (1027544)
          Depends on how long the person that you ask has been with it...

          If they started with TRS-80's, their answer will be very different than if they started with Winnuke...
      • Re: (Score:2, Interesting)

        But the question is: when you have a cookie, what can you do with it? Can you steal important data? Can you turn that cookie into a breach? Good web sites that use them also tie cookies to your IP address, which means that if you steal my cookie, you got nothing but crumbs.

        In an aside to the main point, Good web sites take into account transparent proxies at an ISP level which might result in the user appearing to come from multiple IP Addresses (as the ISP might load balance requests to various proxies without binding a particular user to a particular proxy). This is a situation that I've come across with a website of mine.

        • Re: (Score:2, Interesting)

          by 0xygen (595606)
          Almost all load balancing proxies running across multiple IPs add the X-Forwarded-For http header, which many of the large sites take into account when looking for a "real" source IP. (IRL, many are SQUID or SQUID-based, which can add this header)

          Clearly, the danger with trusting these is that the attacker can then use their own fake X-Forwarded-For header to pretend to be the original user the cookie was stolen from.

          Does anyone have a good solution to this problem?
      • Re: (Score:1, Interesting)

        by Anonymous Coward

        Is a web site that's susceptible to an SQL injection attack hackable? Depends on where you get to inject the code. I'm sure that someone who put their mind to it could take a web site like, say, slashdot, and inject some SQL. Then they might be able to ... well, they could read all those posts that are on the web site.

        Erhm... pardon me? To me, "injection" means that you yourself insert code into the SQL query directly without any sort of escaping. If that's your definition too, I have trouble understanding what you just said.

      • by shiflett (151538)

        Joel, I'm afraid it is you who aren't getting it.

        I think Jeremiah Grossman says it best:

        I'm not certain how wise it is to ask a network security guy's opinion about web application security matters. Maybe he cross-trains.

        He's being funny, but he has a valid point. Here's an example from your comment:

        A lot of Cross-Site Scripting attacks let you steal cookies. So they probably found those. But the question is: when you have a cookie, what can you do with it? Can you steal important data? Can you turn tha

  • ...I'm sure he'll be shelling out $1,000 by the end of the day...
    • Re: (Score:2, Interesting)

      I'd doubt that. I recently had a scan done on a development site I am working on, and got a high vulnerability rating. Based on the weblogs, some simple correlation, and the fact that I quietly remove invalid characters rather than printing an error, my "High" rating of in-security is in fact a low... these guys don't read their work, its just like running Nessus or Nmap without checking your answers, if you don't look hard enough your not going to find the answer.
  • Their reply. (Score:5, Informative)

    by Aladrin (926209) on Wednesday February 14, 2007 @09:12AM (#18010426)
    For those who didn't notice, Acunetix replied on TFA and basically claimed his challenge would be unfair to the third-party websites. They offered to attempt to hack his own website instead and demanded that he post a notice saying he had vulnerabilities, if they find and exploit any.

    While I admit this is an interesting idea, it does nothing to prove or disprove their 70% claim.

    I have to agree with them that hacking websites is illegal and ethically wrong for them, though. Good call on their part.
    • by mfh (56)
      Yeah but without knowing for certain, 70% was a number clearly pulled from their nether-region. In fact 70% of all statistics are pulled from that same source of inspiration!
    • Re: (Score:3, Insightful)

      by Joebert (946227)
      Without actually hacking in & getting hold of data to begin with, they can not honestly state any statistics.
      They can only speculate without actual data.
      So unless they're full of shit to begin with, they've already done somthing unethical.
      • by mrcaseyj (902945)
        There are plenty of vulnerabilities that can be seen just by visiting the public areas of a site and viewing the page sources without hacking in.
    • by giafly (926567) on Wednesday February 14, 2007 @09:50AM (#18010782)

      So we will accept the wager and perform a security audit on the Network World site and attempt to breach any vulnerabilities found. This should be a fair substitute, since we are assuming that considering Mr. Snyder's comments, Network World is confident that its website is secure and any data it holds is unbreachable. - Network World [networkworld.com]
      My company has been through several security audits and they require several days of management time, plus telling the auditors all about your IT infrastructure and data compliance. Security audits are not about hacking - they check that you've hardened your infrastructure, have appropriate policies for e.g. 'phone queries, and avoid client data being unnecessarily exposed. They're similar to a VAT (sales tax) inspection.

      You should only agree an audit by totally trustworthy auditors, working for a major client, which is not the case here.
    • If they are able to hack the guy's website, then it probably means 90% of the sites are hackable. Assuming this guy is a real security expert.
  • by Neme$y$ (700253) on Wednesday February 14, 2007 @09:12AM (#18010434) Homepage Journal
    Reminds me of: "Three statisticians went out hunting, and came across a large deer. The first statistician fired, but missed, by a meter to the left. The second statistician fired, but also missed, by a meter to the right. The third statistician didn't fire, but shouted in triumph, "On the average we got it!"
    • by spellraiser (764337) on Wednesday February 14, 2007 @09:26AM (#18010546) Journal

      A statistician can have his head in an oven and his feet in ice, and he will say that on the average he feels fine.

      How many statisticians does it take to change a lightbulb? 1-3, alpha = .05

      Did you hear about the statistician who was thrown in jail? He now has zero degrees of freedom.

      In earlier times, they had no statistics, and so they had to fall back on lies.

      Smoking is a leading cause of statistics.

      Statistics are like a bikini - what they reveal is suggestive, but what they conceal is vital.

      Statistics in the hands of an engineer are like a lamppost to a drunk--they're used more for support than illumination.

      ---

      All jokes borrowed from here [btinternet.com].

  • by mfh (56)
    Great, as all the trolls attempt to hack into Slashdot and change this comment to something funnier.
    • Re: (Score:3, Funny)

      by spellraiser (764337)

      Why this particular comment? What's so special about it? This is incredibly self-centered of you, to assume that your comment will be a major target for the trolls.

      There's lots of good comments out there that would make better targets. This comment, for instance, is much more interesting. Not only is it longer, it's also a lot wittier and better thought out altogether. Oh, and did I mention that it's also self-referencing? Beat that!

      • Why this particular comment? What's so special about it?

        you should have seen it before I changed it.
  • by toupsie (88295)
    Then he can turn in Acunetix for a cash reward. We finally know what #2 is!

    1. Taunt Acunetix with 1,000 dollars cash to hack into web sites
    2. Turn Acunetix into the authorities when they provide proof of their hacking
    3. Profit!

  • Fools and there money are easily parted
  • by Funkcikle (630170) * on Wednesday February 14, 2007 @09:20AM (#18010498)
    Acunetix have just HACKED into Snyder's bank account and helped themselves to the $1000.
  • Acunetix accepts the challenge and they want to audit networkworld.com, they`ll find something for sure. That guy really has no ideea how unsecure web is.
  • Does 3 of 5 count? (Score:2, Interesting)

    by Anonymous Coward
    We've begun basic testing vendor and supplier web sites that we do business with (they are required to let us poke around as long as we notify them if we find anything).

    Three of five tested since we started in October threw an error when a ' was put in the login user name field. When the ' was replaced with

    a' or 'a' = 'a

    and no password, the three dumped us into the administrator's page (dirt-simple SQL injection). On the last one, it took us longer to find the login page than it did to get admin access. Non
  • I'll put $10k on the table with Snyder.

    In fact I had my site checked with Acunetix when I requested a trial.
    And as a crazy geek I have coded a WebIDS for my CMS and a security system so tight that's close to, I dare say, un-hackable.
    So I had them scan my site just for kicks and to see the HTTP requests they were using.

    Needless to say ALL I got were false positives, well I did have an e-mail address on the site for submitions of papers, code etc and they reported it as a personal data.

    I replied to them explaining that the site is perfectly safe, they checked again and I got a "We're sorry for the inconvenience." styled e-mail admitting the results were wrong.

    Anw, Acunetix can find vulnerabilities, but it's not *THAT* accurate, its good enough though.
  • I believe it (Score:4, Interesting)

    by Paulrothrock (685079) on Wednesday February 14, 2007 @09:24AM (#18010530) Homepage Journal

    My I used to work as a web developer for a small company that did a lot of other small company's web sites. The amount of corners we cut in order to get the sites out in the time that the salesman stated was scary.

    Passwords were often stored in the database in plain text. Credit cards, too. Data was taken directly from $_POST and put into SQL queries and curl calls to payment systems.

    And if, in the future, we found these vulnerabilities and wanted to fix them, we had to escalate them to the CEO (did I mention the CEO is also the sales guy) before we could do any work on them.

    If anything, 70% is low.

    • Come on, man. We've all been under pressure of deadlines, but mistakes like this are intentional or just plain sloppy. It takes absolutely minimal effort to encrypt passwords. And let's not even get into credit card numbers being stored as plain text...

      This is pretty sad on several levels. I just can't imagine them mentality of the developers who were too lazy to do things properly. And the people who use a site like yours (or your company), think their safe because a graphic reminds them they are, but e
      • I agree totally. That's why they're my EX-employer. I was sick of getting told that I didn't have enough time to do things the right way. And I was also afraid that if the site did get hacked, they'd pass the blame on to me.

        One of the developers I worked with never tested in Firefox. He said "Since IE is predominant, testing in Firefox isn't important." He also said some of his best work was in MS Access and that MySQL wasn't a "real database." Also, he "hacked" Mapquest by posting a for to the same place

        • by WNight (23683)
          Are you my ex boss? He was always saying really idiotic things like, "if you can afford to do it, you can afford to do it well."

          This is wrong. I *can* code a rails hack that looks a lot like the final app pretty quickly, sure. But that's a lot different than the million little checks that go into writing a real project, properly.

          Trust me, I *am* an expert software developer. The quick back-of-napkin hacks I do as a proof of concept as as stable as a building an architect would sketch in similar conditions.
          • I'm totally with you on the back-of-the-napkin type apps that technically work as illustrations of functionality. I do them all the time. However, my beef with my boss was that he was trying to sell these things as actual applications. And the unsuspecting clients didn't know what they were getting into.

            This was the same boss who didn't understand why we shouldn't be hosting development applications on our production server, or that a testing suite does not consist of one guy trying to break an application

            • by WNight (23683)
              Pardon me, I misread your original post to suggest you were this boss.

              But yes, I do agree. A lackluster test does not guarantee a hack project is high quality.
  • by blankoboy (719577) on Wednesday February 14, 2007 @09:25AM (#18010536)
    ...if we hire Acunetix, they will make our sites completely "non-hackable"?

    Ok then..."70% of Girls cannot reach orgasm!". I can prove it to you free of charge!

    Kudos to Joel for putting it to them!

  • If Acunetix is legit, then maybe they should take up the challenge without requesting funds if they succeed. That'd be the right thing to do, after consulting with lawyers to find out what the ramifications would be.

    However, $1000 isn't going to draw anyone else into the fray, I don't think... No rogue hacker will offer up a solution to open doors, or even acknowledge them for $1000, its not economically feasible for them to do so when the gains they can realize from NOT accepting the challenge outweigh the
    • by mwvdlee (775178)
      Acunetix cannot legally take this challenge, regardless of the accuracy of their claims.

      In fact, Snyder could easily be fined more than that $1000 for inciting Acunetix to perform data theft; he is basically asking them to provide him private data of atleast 3 websites.
      • Re: (Score:3, Interesting)

        by um... Lucas (13147)
        Well they could contact the 3 selected website operators, explain the situation and that it's for their own good, and offer to do all work onsite under their eyes or at least offer to share their results with the company in question and see those security holes closed before any acknowledgement of a result from the contest is announced.

        I know, companies don't like being hacked even if it's for the un-noble cause of "demonstrating the hole in their security" so that it can be fixed; but if the company in que
        • Re: (Score:2, Insightful)

          by delinear (991444)
          The problem with that is that these companies know mud sticks. If the report says they were hacked, then no amount of them saying they fixed the holes and are now more secure than ever will completely remove that taint. Not only that, if these companies cared so much about security in the first place there wouldn't be holes, the main problem is that security is often sacrificed in the name of economy, so they're unlikely to want to shell out money fixing holes if they can just carry on ignoring them for fre
          • I dont' think they "don't care" about security as so much that they haven't been informed of it. Their sites are probably outsourced, or even hosted inhouse on a default Linux or Windows installation. It "works" so no ones thought to turn off unneeded services and daemons, let alone configure their firewall to block unwanted traffic from reaching the servers.

            BTW, slashdot, what is the recommended distro for hosting websites? Is there one, or does every company that wants to host their own site have to go th
  • Those that have been hacked and those that can be but no-one's bothered to do so yet.

    Fact is that there is not such thing as an unhackable site/host, however one can at least make a network more trouble than it's worth to try to hack.

    What's that old saw: Anything that the human mind can build another human mind can figure out. Or something like that...
    • by aug24 (38229) on Wednesday February 14, 2007 @10:31AM (#18011220) Homepage

      there is not such thing as an unhackable site/host

      This is tosh.

      If you are seriously claiming that you could 'hack' any host running any software to get arbitrary permissions, or a shell session, or access an arbitrary file then you are just mad. On what basis do you say this? It's connected to a network therefore it can be hacked? Whuh?

      (I can't believe you were modded informative of all things. Insightful I might have laughed off, but informative?!)

      Justin.

      • Re: (Score:2, Insightful)

        by geekoid (135745)
        It's a common thought on /.

        False, but prevailant.
        • Re: (Score:2, Insightful)

          by Elbowgeek (633324)
          Apologies if I'm interpreting your comment incorrectly, but if you're saying that you believe there is such a thing as an unhackable web site, then I can truly say that I'd *never* hire you in an IT capacity. Like an army general who truly believes his forces are invincible, by the very expression of that belief you are defeated before even going into battle.

          *Always* assume you are vulnerable. Be paranoid. And spend time snooping and hanging around in the areas where the crackers (to use the *correct* te
      • by hackstraw (262471) *
        This is tosh.

        In theory, I agree with the grandparent post. In theory, there are always bugs in software, services, or something somewhere.

        My work got broken into via a silly code injection thing a few months ago, and we run a pretty tight ship, but we also allow many users to run unaudited code that is accessable via the web, and that is what happened.

        The thing that saved us and that saves others that really care about security is the layering of security. This person effectivly got in as the httpd user,
      • by MrMonty (366322)
        He's probably saying it in the same vein as "A gun's always loaded" and "There's no such thing as bug free code." That is, generally it's better to assume your site is hackable than to have a false sense of security. So yeah, insightful but not informative.

        On the other hand. If you consider social engineering a form of hacking, I'll agree %100. Whether it's by trickery or drugging the lead programmer, there'd always be a way to get access to files and information you're not supposed to.
      • To borrow a quote from Eugene Spafford:

        "The only truly secure system is one that is powered off, cast in a block of concrete and sealed in a lead-lined room with armed guards - and even then I have my doubts."

        This, and other Spaf quotes, and where they came from, can be found here. [purdue.edu]

  • Having dealt with tons of owned sites over the years I would say that 70% is
    a very low figure. I would also say that 90% of these tools the security vendors
    are throwing around are also trash. The point out obvious flaws in some cases
    but the tools are no where near as crafty as the human brain at exploiting
    web sites. Script kiddies using known vulnerabilities are one thing but stopping
    somebody hell bent on getting in is much, much tougher.
  • First this is a load of crap and they sound like morons. But second, I will pay them $50,000 if they can rob 3 banks chosen at random! Maybe we can get them in jail by the end of attempt #1? :D
  • I think that the numbers might be a little misleading, but I'm not sure that 70% is entirely incorrect. I think that it depends heavily on what sites are included in the sample, and how you define "can be hacked".
    For the first point, although big websites certainly have had their share of vulnrabilities, the number is certainly less than 70% (I would venture a guess that it's in the are of 25%, which is still way more than it should be) - but if you start adding in things like peoples home boxes running q
    • This is a misconception that really bothers me, and I've seen it a few times in this discussion already. Walking into a building with guns blazing Matrix-style, and swiping a server does NOT count as hacking.
      Anything that requires physical access to the target computer is outside the realms of computer security. (the assumed topic of discussion) The computer responds to requests, and if the computer responds inappropriately to a request, responding with inappropriate data, or performing an action (deleti
      • by miyako (632510)
        I agree that at some point computer security is no longer the issue, and physical security is. I was using hyperbole to demonstrate a point however. The point I was trying to make is that there are levels of security, and there are almost certainly instances where something "could, potentially" be exploited, but for which there is no known exploit, or where it's something like a brute force attack where it could be done, but it's highly unlikely to be done successfully.
        There are also considerations for t
      • by pmc (40532)
        Anything that requires physical access to the target computer is outside the realms of computer security.

        No it isn't. Physical security of computer system is but one part of computer security. The aim of computer security is to protect the following three things: confidentiality, integrity, and availability. If somebody nicks your computer then you've just lost two of these. Why do you think that datacenters are mini-fortresses? It is to give physical security. Personel security isn't outside the scope eith
  • I wonder (Score:4, Insightful)

    by dbmasters (796248) on Wednesday February 14, 2007 @09:59AM (#18010862) Homepage
    My first thought was "whats the percentage of sites run by Nuke's, Joomla's, Mambo's and such CMS systems". I mean, when PHPBB gets hacked (again) it affects a HUGE number of sites. My employer recently had a security audit and they found out what most of us developers have been telling them for a while...they had consultants build things, decrease timelines while increasing scope creep...things got fudged and now they don't understand why our sites failed. I look at some of the stuff I inherited and just look at it and say WTF? I built a little CMS for myself, a few people downloaded it and use it, it's grown and I just experienced my first real exploit in my 10 year career in web dev. it was a REAL learning experience for me. I know all the theory of security and all that, but practicing it is another matter when people want things yesterday it makes it hard resist cutting that little corner.
  • by teslar (706653) on Wednesday February 14, 2007 @10:09AM (#18010942)
    Professional Hitman Mr Smith is flogging a survey that claims 7 out 10 people he has checked have a lack of police protection posing a medium- to high-level risk of getting them murdered. The police's go-to security guy, Mr Doe, says that percentage is 'sensationalist nonsense' -- and he's willing to back that judgment with $1,000 of his own money. In fact Mr Doe will pay up if Mr Smith can whack 3 of 10 people chosen at random from his survey list."
    • Ah, but the police will outsmart him once he has become mentally unstable enough to turn himself in!
    • by trongey (21550)

      Professional Hitman Mr Smith is flogging a survey that claims 7 out 10 people he has checked have a lack of police protection posing a medium- to high-level risk of getting them murdered. The police's go-to security guy, Mr Doe, says that percentage is 'sensationalist nonsense' -- and he's willing to back that judgment with $1,000 of his own money. In fact Mr Doe will pay up if Mr Smith can whack 3 of 10 people chosen at random from his survey list."

      Now that's entertainment!

  • ground rules (Score:3, Interesting)

    by eck011219 (851729) on Wednesday February 14, 2007 @10:27AM (#18011156)
    I was about to post something spouting off an opinion before reading the article, but figured I'd better check it first. I was GOING to say, "but do that many sites contain information worth stealing?" But I then wimped out and read the article.

    According to the article, the ground rules (in particular, what kinds of sites are fair game) are still up in the air. So this whole thing is still lacking in some pretty basic parameters, which makes use of such a definitive range of percentages kind of silly. It's like saying, "70% percent of some people are redheads." That sounds like a lot of redheads, but without defining the "some people" part, it's just wind.

    It's an interesting thought and gets people talking about it, which is certainly not a bad thing. But it's little more than that at this point.
  • Yeah, trust them, we have had people in Russia doing scans of our sites with cracked versions of their software. When we contacted them about it, they basically said they gave up trying to protect their OWN SOFTWARE. As far as their software goes, it does ok in terms of giving them a layout a host's website, and looking for possible SQL injection variables. I have NO respect for this kind of fear mongering and therefore it is pretty hard to trust them with something so important, just because it does ONE th
  • The subject line of their e-mail reads - "Acunetix Accepts the Network World Challenge" - but, as you'll see, that claim isn't any more supportable than the company's press release, which they at least have the good graces to concede was "apocalyptic."

    http://www.networkworld.com/community/?q=node/1150 1 [networkworld.com]
  • I'm surprised (Score:3, Interesting)

    by Nom du Keyboard (633989) on Wednesday February 14, 2007 @12:06PM (#18012460)
    I'm surprised that 7 of 10 sites even contain personal data. Just what sites was he checking?
  • Dynamic vs Static? (Score:4, Insightful)

    by Odin_Tiger (585113) on Wednesday February 14, 2007 @12:12PM (#18012544) Journal
    Even for as advanced as the web on the whole has become, I still suspect that most sites are static HTML. Unless they're talking about vulnerabilities in httpd's as well as vulnerabilities in site design, I think they're sunk, because unless you're doing something at least moderately complex with scripts and databases, you're site is probably very secure. The bet needs a qualifying limiter or something to clarify that it only applies to *AMP sites or some such, because the average geocities, angelfire, or similar-quality privately hosted site is just not really hackable, because everything that makes up the website is already publicly viewable...images and text, no personal data that isn't intentionally exposed, and there is nothing on the box / vm / whatever other than the site. At best, if the box is misconfigured or unpatched, they can claim that it is defaceable, but that's not nearly the same thing.
  • In fact Snyder will pay up if Acunetix can get personal data out of 3 of 10 sites chosen at random from their survey list.

    If any story deserved an "itsatrap" [slashdot.org] tag, this is one!
  • www.voterlistsonline.com Don't even need to see it, and it already scares you, right? ;_)

1 1 was a race-horse, 2 2 was 1 2. When 1 1 1 1 race, 2 2 1 1 2.

Working...