<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=WordSection1>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>I must not concur. That’s not the worst thing. Picture
this:<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>They break into my client’s zencart, oscommerce or CC
processor integrated cms (as joomla and drupal have plugins/extensions
and I have clients using them). The get into the client’s site and modify
the CC credentials to process using their bogus merchant account. Maybe they
put a hack in to steal their CC numbers. Now you have a security breach that
has big legal implications that you and/or your client have to legally disclose
in the US. You probably have clients screaming at you about bogus charges on
their card. Eventually the site is defaced and their tracks are covered by
wiping most of your database. <o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>Finally your client’s reputation is damaged/destroyed and
they are angry with you and spread the word they got hacked on your platform damaging
your reputation, etc…<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>I would think it’s far from the worst thing. Of course it
may be worse if you are the client than the hosting company.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'> Thanks,<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'> -Stephanie<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<div style='border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt'>
<div>
<div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'>
<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span
style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>
blueonyx-bounces@blueonyx.it [mailto:blueonyx-bounces@blueonyx.it] <b>On Behalf
Of </b>James Darbyshire<br>
<b>Sent:</b> Saturday, September 25, 2010 10:30 AM<br>
<b>To:</b> BlueOnyx General Mailing List<br>
<b>Subject:</b> [BlueOnyx:05461] Re: Dealing with /admin URL 'hijacking<o:p></o:p></span></p>
</div>
</div>
<p class=MsoNormal><o:p> </o:p></p>
<p>I disagree. Certainly it is not best practise for any admin functions to be
accessible through a generic /admin url, but I would rather someone was trying
to attack my CMS than my Server admin panel, where they have much higher
security privileges than in my CMS.<o:p></o:p></p>
<p>Worst case they graffiti my pages and I have to restore to a backup.<o:p></o:p></p>
<p>If they get into my BO admin area they can royally screw with my server, and
it possibly would not be as obvious/easy to detect.<o:p></o:p></p>
<p>Regardless, it's no big deal.you just have to remember to change your BO
settings when the config gets overwritten.<o:p></o:p></p>
<p>Regards,<o:p></o:p></p>
<p>James Darbyshire<o:p></o:p></p>
<p>Sent from my Samsung Droid™<o:p></o:p></p>
<blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'>
<p class=MsoNormal>On 25/09/2010 11:54 PM, "Abdul Rashid Abdullah"
<<a href="mailto:webmaster@muntada.com">webmaster@muntada.com</a>> wrote:<br>
<br>
Stephanie hit the nose on the target. I would prefer to modify the CMS<br>
rather than BlueOnyx. When you migrate to a new system, you will deal
with<br>
the issue all over again. It is best to change it upfront.<br>
<br>
PLUS I am not sure who said something about BlueOnyx security and they<br>
deleted it for that reason but I would say that it is FAR better to rename<br>
the admin of a CMS as there is by far a higher likelihood of an exploit on<br>
the CMS than on BlueOnyx coming into play. Zen Cart as an example
EXPLICTLY<br>
encourages all of the users to rename to something unique and specifically<br>
warns you if I am remembering correctly if you don't do it. It is one of<br>
their counter measures for not getting hacked.<br>
<br>
Regards,<br>
<span style='color:#888888'><br>
Rashid</span><o:p></o:p></p>
<p><span style='color:#500050'><br>
<br>
On 9/24/10 7:08 AM, "Stephanie Sullivan" <<a
href="mailto:ses@aviaweb.com">ses@aviaweb.com</a>> wrote:<br>
<br>
> Jeff,<br>
> <br>
> I've yet to meet a...</span><o:p></o:p></p>
</blockquote>
</div>
</div>
</body>
</html>