phpwiki-talk

[Phpwiki-talk] Known attacks against PhpWiki wikis?

[Robert D. <rob...@ya...>]

Hello again,

I have another question about security. Have there been any known
attacks against PhpWiki wikis? Excluding vandalism of pages. Has 
it ever happened that someone successfully obtained a database
password and (1) really messed up the wiki -- e.g., in such a way
that it couldn't be reloaded from an archive, or 
(2) got access to stuff other than the wiki content?

Sorry to ask so many questions -- I am trying to convince a 
skeptical third party that it's safe to run PhpWiki. Thanks for
your help. I appreciate it very much.

Robert Dodier


__________________________________
Do you Yahoo!?
Yahoo! Hotjobs: Enter the "Signing Bonus" Sweepstakes
http://hotjobs.sweepstakes.yahoo.com/signingbonus

Re: [Phpwiki-talk] Known attacks against PhpWiki wikis?

[Zot O'C. <zo...@wh...>]

On Fri, 2004-01-16 at 12:34, Robert Dodier wrote:
> Hello again,
> 
> I have another question about security. Have there been any known
> attacks against PhpWiki wikis? Excluding vandalism of pages. Has 
> it ever happened that someone successfully obtained a database
> password and (1) really messed up the wiki -- e.g., in such a way
> that it couldn't be reloaded from an archive, or 

I have not heard of this.

> (2) got access to stuff other than the wiki content?
> 

2 easy ways to prevent this:

1)  Run this on a web site with a user and group that is different than
the norm.  Have a wikiuser and wikigroup.  Put apache in the wiki
group.  Then use flatfiles (gdbm).  The most that can happen is the
files is trashed/removed.

2)  Do that anyway, but when creating the tables create them as wikidba
and grant permissions to wikiwebuser.  Never use these these users for
anything else.  The most that can happen, happen to the wikiwebuser
accessible data.  All the rest of your tables are owned by non-owner web
users, right?  If not tell the concerned party to stop looking for
trouble, you've already found it!


> Sorry to ask so many questions -- I am trying to convince a 
> skeptical third party that it's safe to run PhpWiki. Thanks for
> your help. I appreciate it very much.

Ask them what their worry is, then find it on their stuff.....  If they
are non-technical, do not suffer the arguments very long, it is not
worth it.  People who are paranoid, are, well paranoid.


-- 
Zot O'Connor

http://www.ZotConsulting.com
http://www.WhiteKnightHackers.com

Re: [Phpwiki-talk] Known attacks against PhpWiki wikis?

[Reini U. <ru...@x-...>]

Robert Dodier schrieb:
> I have another question about security. Have there been any known
> attacks against PhpWiki wikis? Excluding vandalism of pages. Has 
> it ever happened that someone successfully obtained a database
> password and (1) really messed up the wiki -- e.g., in such a way
> that it couldn't be reloaded from an archive, or 
> (2) got access to stuff other than the wiki content?

the sceptical party is wrong.
1) I know of no phpwiki abuse so far, but other wikis had been 
reportedly abused. but not massively and not that they couldn't be 
restored from the daily database backup.
the typical wiki abuse is not via the db directly (db password and host 
security abuse), it is done by writing a short script which does the 
necessary POST requests to the system.
it makes no sense and is typically deleted by the next visitor or by the 
admin, whoever detects first.
we have no such robot detection code yet included, because then we have 
to analyse the sessions, store the visitor IP and timestamp. but I once 
had some code to prevent from abusive robots, which got caught in a 
loop. now it is not needed anymore.
ward's wiki has such code included, which was needed then.

2) not to my knowledge. but every system intruder has access to 
everything else than the wiki content. and there are dozens of 
intrusions worldwide per day.

> Sorry to ask so many questions -- I am trying to convince a 
> skeptical third party that it's safe to run PhpWiki. Thanks for
> your help. I appreciate it very much.

the sceptical party is right. it's not safe to run phpwiki such it is 
not safe to run any service which is accessible to the world, such as a 
webserver, fileserver or mail server.
-- 
Reini Urban
http://xarch.tu-graz.ac.at/home/rurban/