It’s happening all around us. Some of the biggest, smartest software systems on the planet are being intruded, compromised and monitored by hackers who crave the challenge of peering inside a secure network.
With each new breach, the good guys put up new walls and fences, before being breached again. Not all hackers are bad, although some are.
In no particular order or sequence, here are three jaw-dropping hacks that highlight the necessity to select a web host that takes security — your security — ultra-seriously and has walls high enough to give hackers a run for their money.
Hack 1: “I’ve got a prompt, I’ve got a prompt”
Steve “The Woz” Wozniac loves him. His name is Kevin Mitnick, often labeled America’s most dangerous hacker of all time. In Mitnick’s book Ghost In The Wires he describes his penchant for social engineering, a way to make people inside organizations give-up valuable security information adjacent to launching a programming hack.
Around 1987, he set his sites on hacking the Digital Equipment Corporation’s (DEC) VMS operating system. DEC is widely regarded as having built the worlds FIRST mini-computer, the PDP-11 often called the “SuperMini”.
Standing between two pay phones with two receivers held to each ear he established a phone conversation with a sys admin in the VMS development team while his friend, Lenny, on the other line, sat in front of a computer.
By knowing enough “background” information about the VMS dev team (and the way they operated) he coaxed the DEC sys admin to type in a “show users” command while Lenny connected to the dial-up modem at the DEC department.
Within seconds Lenny shouted into Mitnick’s ear: “I’ve got a prompt, I’ve got a prompt”. With full admin privileges Lenny located a dormant account on the DEC system and proceeded to give the two hackers full admin privileges.
Over the next several weeks the hackers proceeded to data mine and exploit the entire DEC network including downloading the massive VMS operating system. The DEC team suspected a breach but could not pinpoint the source. Some of the brightest minds in America working at DEC were comically induced to believe that they were the victims of an international hacking outfit. Mitnick did this just for the hell of it.
Hack 2: Cloud power drives Wireless Security Breach
Think twice before putting all your eggs in the Amazon cloud cradle. While a big name in cloud computing, you may be safer selecting another web host with secure dedicated servers, colocated boxes or shared infrastructure residing in Tier-3 data centers.
The reason: Towards the beginning of 2011 a research hacker found a way to use the Amazon cloud platform to break the password protection for wireless networks.
Reuters UK reported that Thomas Roth needed only 20 minutes to test 400,000 passwords per second, before he gained access to business and wireless networks using cheap, available Amazon networks.
Roth wanted to convince skeptical network admins that a commonly used method for scrambling data that travels across Wi-Fi network passwords is not strong enough to keep persistent intruders from compromising networks.
Ok to be fair to Amazon, the above does not necessarily indicate a weakness on their system but it does point out how their servers can be used maliciously if so required.
The takeaway point is to regularly check-in with your web host to see what steps they are taking to elevate their security systems. For instance, Anhosting offers rock-solid firewalls on all hosting packages to prevent database hacks, viruses and other threats to your website. They also offer industry-leading anti-spam software and round-the-clock support from Engineers whose only job is to make sure your server stays up and remains safe.
Hack 3: Tim Thumb leaves WordPress door open
If you regularly read our blog you probably already know about the recent Zero Day vulnerability that left millions of WP blogs and Content Management Systems at the mercy of hackers.
Exploiting vulnerabilities in the TimThumb image resizing utility used by gazillions of WordPress blogs, hackers were able to upload executable files and hack .htaaccess files that redirected to Russian URLS.
This malware intrusion will surely not be the last as WordPress continues to challenge Joomla and Drupal as one of the top Content Management Systems.
However, leading web hosts like Anhosting are ever vigilant in their methods to protect your data and ensure all software is patched and up to date.
Rules of the game
Experts generally agree that no system is safe from a determined hacker. Even the Pentagon and Sony are have been hacked.
However, just like locking your door offers some level of security, so does adding extra protection in the form of an alarm system or security company. Follow the same principles in selecting a web host.
If you run your own servers to host your website in-house you are even more vulnerable. Consider these possible exploits (as compiled by the Anhosting security team):
• IP Spoofing
• Denial of Services (DOS)
• Exploitable Port Ranges
• MSSQL and MySQL Exploitation
• Remote Administration tools
While intimidating, reputable web hosts deploy hardware firewall protection that’s maintained, upgraded and monitored 24/7, 365 days per year. Anhosting, for instance, secures data on shared Linux servers inside Tier-3 data centers.
Here is a granular list of measures employed by the Anhosting security team that help protect your data and website files:
• Redundant power sources
• Multiple network carriers
• On-site professional staff
• SAS 70 Type II compliant
• Tier 3 classification
• 30″ raised floor
• Advanced canopy cold row cooling
• VESDA smoke detection system
• 24×7 security and digital video surveillance
Filed under:
Tips & Tricks, Web Hosting by
creeves
Leave Comment »