Forensic UpdateObservations from the Foregenix Forensic Lab.

One of the very common security faux pas that we are still encountering seems to be the result of a misunderstanding by hosting providers, web developers and general IT staff about how to restrict access to remote administration services. 

In cases where firewall controls have been implemented on the eCommerce systems we've investigated, they have typically been used with good intentions to only allow access to the web service ports (obviously necessary) and the remote administration services such as the File Transfer Protocol (FTP) service and interactive login services for administration, e.g. Telnet or Secure Shell (SSH) on Linux servers, and Terminal Services / Remote Desktop on Microsoft Windows servers, among others.  A primary mistake that is often made is in terms of how the restrictions are applied, or more specifically: who is permitted access vs who is not permitted access. In most of our investigations, we've round that the firewall rules were applied using a blanket approach, i.e. the all or nothing approach: if the web developers need remote login capabilities, the firewall rules permit all Internet sources to connect to the remote login service port(s) and reliance is placed on the protection provided by authentication controls - user IDs and passwords. It would be a far better security practice to disallow access from all the Internet and then only implement specific rules granting access to administrators from specifically authorised, static source IP addresses. Better yet, would be to manage those permissions with formal change control procedures that ensure you only permit that kind of administrative access when it is needed, and block all access again after the changes have been signed off. Taking the defence-in-depth principle a step further, it is recommended to implement a second factor for the authentication controls, such as using digital certificates or tokens. 

Implementation of the firewall rules is vital - in almost every website investigation we have conducted, we have found that the remotely accessible administration services were subjected to regular and extensive brute force attacks.  By not managing who is prevented from attempting to see the login prompts, the system becomes an easy target for attackers to focus their automated user ID and password guessing tools on. The source locations from which these types of attacks have been originating are widely varied, from the usual suspects of Russia, China and America, to just about any country you could randomly select. In addition to the extra load put onto the web server by such activities, the problem is often compounded by lazy developers who take the easy route when it comes to selecting their passwords. And easily guessable passwords amount to easy pickings for the attackers.

So while it is important to be aware of the constant stream of new and technically complicated vulnerabilities that are being identified and used to exploit systems, it is just as important as it ever has been, to ensure that the basics in terms of security controls are taken care of.  

A few of the important security controls that the above discussions lead onto, are:

We will be discussing logging in more detail in upcoming articles.  If you have any questions about any of the information in this article, please get in touch.