<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=WordSection1>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:#1F497D'>Ah, James,<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:#1F497D'>Indeed security through obscurity is not security. However,
changing default paths improves the odds of avoiding an attack and can be an
important part in an overall security plan. In fact suggesting one thing is “the
answer” is not at all my intention and I hope you are not trying to suggest
there is “a solution”...<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:#1F497D'>And if the client is breached, gets shell, and well, whatever,
the server is potentially much more at risk. Far more so than if the client was
not breached.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:#1F497D'>In any case, I may not have been clear in my wording when I was
writing about who is responsible where. The client may claim the hosting
company had some complicit negligence. Even if not true, legal fees can be
staggering and the overhead of a defense great.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:#1F497D'>Reputations can be trashed, even when not deserved, and that has
repurcutions. <o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:#1F497D'>If my client gets hacked it’s bad for them and that is bad
for my buisness, especially if they go out of business.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:#1F497D'> Thanks,<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:#1F497D'> -Stephanie<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<div style='border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt'>
<div>
<div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'>
<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span
style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>
blueonyx-bounces@blueonyx.it [mailto:blueonyx-bounces@blueonyx.it] <b>On Behalf
Of </b>James Darbyshire<br>
<b>Sent:</b> Saturday, September 25, 2010 7:38 PM<br>
<b>To:</b> BlueOnyx General Mailing List<br>
<b>Subject:</b> [BlueOnyx:05466] Re: Dealing with /admin URL 'hijacking<o:p></o:p></span></p>
</div>
</div>
<p class=MsoNormal><o:p> </o:p></p>
<p>Steph,<o:p></o:p></p>
<p>But what you are suggesting is that security by obscurity is the answer in
this case - which is a dangerous path to follow.<o:p></o:p></p>
<p>It may be easier for someone to break into the CMS than into the BO backend,
but once they are into BO then they can do everything you suggested, not only
to one site, but to every site on that host.<o:p></o:p></p>
<p>I don't know how uou run your business, or how the law works in the US, but
here in Australia the client is responsible for the security of what they
install on their website, and the host is responsible for the security of the
server. If a CMS was hacked, I would not be responsible.<o:p></o:p></p>
<p>Of course the optimal solution would be to use some kind of TLS and
intelligent intrusion detection software on both systems which locks access out
when it thinks an attack is taking place.<o:p></o:p></p>
<p>Rashid, I suspect you are correct on saying that BO authentication is
probably harder to crack than that of a stock CMS, but the point sound be that
yes an attacker can get into one website and cause havoc, but only within that
CMS on that specific site. Other sites will be unaffected. I would also hazard
a guess that many people are not as vigilant as you or I, and do not frequently
change their passwords.<o:p></o:p></p>
<p>In short, I don't believe security by obscurity is the answer in either
case, but I would rather the attacker accessed one site only, and not the server
which has access to all.<o:p></o:p></p>
<p>Regards,<o:p></o:p></p>
<p>James Darbyshire<o:p></o:p></p>
<p>Sent from my Samsung Droid™<o:p></o:p></p>
<blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'>
<p class=MsoNormal style='margin-bottom:12.0pt'>On 26/09/2010 1:28 AM,
"Stephanie Sullivan" <<a href="mailto:ses@aviaweb.com">ses@aviaweb.com</a>>
wrote:<o:p></o:p></p>
<div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span
style='font-size:11.0pt;color:#1F497D'>I must not concur. That’s not the
worst thing. Picture this:</span><o:p></o:p></p>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span
style='font-size:11.0pt;color:#1F497D'> </span><o:p></o:p></p>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span
style='font-size:11.0pt;color:#1F497D'>They break into my client’s
zencart, oscommerce or CC processor integrated cms (as joomla and drupal
have plugins/extensions and I have clients using them). The get into the
client’s site and modify the CC credentials to process using their bogus
merchant account. Maybe they put a hack in to steal their CC numbers. Now you
have a security breach that has big legal implications that you and/or your
client have to legally disclose in the US. You probably have clients screaming
at you about bogus charges on their card. Eventually the site is defaced and
their tracks are covered by wiping most of your database. </span><o:p></o:p></p>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span
style='font-size:11.0pt;color:#1F497D'> </span><o:p></o:p></p>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span
style='font-size:11.0pt;color:#1F497D'>Finally your client’s reputation
is damaged/destroyed and they are angry with you and spread the word they got
hacked on your platform damaging your reputation, etc…</span><o:p></o:p></p>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span
style='font-size:11.0pt;color:#1F497D'> </span><o:p></o:p></p>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span
style='font-size:11.0pt;color:#1F497D'>I would think it’s far from the
worst thing. Of course it may be worse if you are the client than the hosting
company.</span><o:p></o:p></p>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span
style='font-size:11.0pt;color:#1F497D'> </span><o:p></o:p></p>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span
style='font-size:11.0pt;color:#1F497D'>
Thanks,</span><o:p></o:p></p>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span
style='font-size:11.0pt;color:#1F497D'>
-Stephanie</span><o:p></o:p></p>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span
style='font-size:11.0pt;color:#1F497D'> </span><o:p></o:p></p>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span
style='font-size:11.0pt;color:#1F497D'> </span><o:p></o:p></p>
<div style='border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt'>
<div>
<div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><b><span
style='font-size:10.0pt'>From:</span></b><span style='font-size:10.0pt'> <a
href="mailto:blueonyx-bounces@blueonyx.it" target="_blank">blueonyx-bounces@blueonyx.it</a>
[mailto:<a href="mailto:blueonyx-bounces@blueonyx.it" target="_blank">blueonyx-bounces@blueonyx.it</a>]
<b>On Behalf Of </b>James Darbyshire<br>
<b>Sent:</b> Saturday, September 25, 2010 10:30 AM<o:p></o:p></span></p>
<p><span style='font-size:10.0pt;color:#500050'><br>
To: BlueOnyx General Mailing List</span><span style='font-size:10.0pt'><o:p></o:p></span></p>
<p class=MsoNormal><b><span style='font-size:10.0pt'>Subject:</span></b><span
style='font-size:10.0pt'> [BlueOnyx:05461] Re: Dealing with /admin URL
'hijacking</span><o:p></o:p></p>
</div>
</div>
<p><span style='color:#500050'><br>
<br>
<br>
<br>
I disagree. Certainly it is not best practise for any admin functions to be
accessible through ...</span><o:p></o:p></p>
</div>
</div>
</div>
<p class=MsoNormal style='margin-bottom:12.0pt'><br>
_______________________________________________<br>
Blueonyx mailing list<br>
<a href="mailto:Blueonyx@blueonyx.it">Blueonyx@blueonyx.it</a><br>
<a href="http://www.blueonyx.it/mailman/listinfo/blueonyx" target="_blank">http://www.blueonyx.it/mailman/listinfo/blueonyx</a><o:p></o:p></p>
</blockquote>
</div>
</div>
</body>
</html>