How Do I Prevent Code Exploits?
Code Exploits and Web Developers with Rob Baldwin.
There are a number of security issues that frequently fall down the gap when it comes to whose responsibility they are to look after. One such issue is that of code, and whose job it is to keep it up-to-date.
What is the hosting provider's responsibility?
It's the responsibility of any hosting provider to provide their customers with a server and IP address, network connections and -- in our opinion -- at least a shared hardware firewall as minimum as well.
Can't the hosting provider automatically update code?
When it comes to updates, there are issues of functionality to contend with. While we patch the operating system for Windows and put patches in place for Linux if requested, we can't do every update automatically. There are simply too many content management systems and open source web application frameworks out there - you can't just auto-update everything because it can break website functionality and stop the server from displaying content.
Why are so many exploits in code taking place?
The frequency with which code exploits are occurring may be correlated to the increasing usage of open source software. A number of content management systems, such as WordPress and Drupal are often free, attracting businesses to the idea of managing their own code. However, the problem with this software arises because a lot of the groundwork has been done for users. Without having built it from the ground up, there are bound to be gaps in understanding. People are then faced with a bit of a dilemma; do they keep updating it and risk coming up against problems they don't know how to fix, or leave it? If it becomes out-of-date then this is where vulnerabilities occur and hackers can get in and do what they want.
Can't a firewall prevent this?
A firewall knows whether to let traffic in or out depending on the port. If it's come through port 80 as a normal request, the firewall doesn't see it as risky and it lets it in. Once you're behind that firewall, you could have something in your code that allows you to update content without validating whether it's a picture, for example. If there's no validation method, all a hacker would have to do is upload a script of sorts and then they're into that box. From there, they can run root commands and take control of the server.
Who should be taking care of code?
There's a missing link in this whole chain and that is basically a server admin and/or web developer. They need to be able to understand how to use a server, how to update their code and if there are problems, bug fix the issues. To have everything working long term, we need to have us -- the hosting provider -- doing the infrastructure side of things and keeping the network ticking over while the client focusses on their primary business activities - providing products or services to their customers - and finally the web developer making sure there are regular code reviews. Some of our account managers call this combination the holy trinity!
What happens if they don't?
Once a vulnerability has been exploited at root level then the only realistic way to solve it is to simply start again. If an affected server is impacting other users on the network, we have to act. So if there's too much throughput coming into or going out of a server, or if there's a risk of cross-contamination, we have to black hole it. The next step is to arrange for a KVM at the data centre and help the client clean it up. Recovery time for them to go through and clean up or migrate can be astronomical, especially if they have lots of CMS sites built by various third party developers, many of whom are no longer contactable or overseas and hard to reach. In this time, they'll have their clients screaming at them down the phone because their site or email service is down. It's a nightmare scenario and one that can bring a business to its knees.
What's the solution?
The most effective way to protect against exploits in code is to connect the dots with that missing link and ensure a web developer is looking after that side of the business on an on-going basis, whether that's part time or a full time role. The fight against cybercrime is a constant battle; having a gap in your front line of defence is simply not an option.
