Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PhpMyAdmin Project Successfully Completes Security Audit

phpmyadmin.net

Post reply on HN
Print view View original

61–70 of 112 posts

Re: PhpMyAdmin Project Successfully Completes Security Audit

#61

Post by IkmoIkmo »

zhte415 wrote: post #42
dsacco wrote: post #33

Earlier quoted context omitted.

Given that the assessment occupied two weeks with two consultants, between $25,000 - $35,000. I don't have intimate knowledge of NCC Group's pricing structure because I don't work there. But I have friends who do, and similarly situated consultancies that I've worked for are in the $10,000/week range for a one-off assessment with non-senior staff. This is also somewhat close to what I charge through my own smaller co…

$10,000/week range seems low for a week long audit, but depends on time charged. Most audits I've worked on, while a week long, have a 2 week pre-audit familiarization period for the audit team, and a 1 week long post-audit report-writing period. This means a 1 week audit is an actual week of investigation, and for $10,000 this sounds low. Via the article, it seems like a leading client / lead of future potential cli…

We're currently doing an audit, non-security audit though, but auditor salaries will probably not deviate that much. We hired a top-five audit firm and were billed roughly $400 per hour in total for two auditors (senior, junior) plus some work by the partner, mostly at the beginning and end.

The scope of their work of course is what drives the total cost, but a single full-time week would usually range $15-20k.

Re: PhpMyAdmin Project Successfully Completes Security Audit

#62

Post by tetrep »

eterm wrote: post #56
opinion1 wrote: post #46

Earlier quoted context omitted.

Yes. The way it works is that two smart hackers go into the office each day and spend eight hours trying to think of as many creative ways of tapping on the target application as possible. Nothing is off-limits except what is agreed up front, but you're obviously expected not to interfere with production operations. The client is generally expected to set up a testing environment substantially similar to production,…

They're a very worthwhile process for SMEs and companies that haven't had one before. At one of my previous employers (I won't say which) they were marvelling at the ways in which the contractor was able to do privilege escalation by editing a form to change their user level from the "3" or "4" in the drop-down to "1". The fact that they got full rights so quickly really drove home the need for security to be a featu…

> Now the cynical would point out that standard pen testers would have found that, and maybe they would, but the speed at which a contractor could find these issues and then see the full breadth of the surface compared to pen testers was great.

What's the difference between a contractor and a pen tester?

I consider one a function of how you are employed and the other a function of role. IE the two overlap and are not directly comparable.

Re: PhpMyAdmin Project Successfully Completes Security Audit

#63

Post by mintplant »

tetrep wrote: post #62
eterm wrote: post #56

Earlier quoted context omitted.

They're a very worthwhile process for SMEs and companies that haven't had one before. At one of my previous employers (I won't say which) they were marvelling at the ways in which the contractor was able to do privilege escalation by editing a form to change their user level from the "3" or "4" in the drop-down to "1". The fact that they got full rights so quickly really drove home the need for security to be a featu…

> Now the cynical would point out that standard pen testers would have found that, and maybe they would, but the speed at which a contractor could find these issues and then see the full breadth of the surface compared to pen testers was great. What's the difference between a contractor and a pen tester? I consider one a function of how you are employed and the other a function of role. IE the two overlap and are not…

I think eterm is comparing security auditors (with code access) to pen-testers (no code access).

Re: PhpMyAdmin Project Successfully Completes Security Audit

#64

Post by pg_is_a_butt »

arrmn wrote: post #35

Stupid question, how does a security audit work? Do the consultants just read through the code? Do they try to find security bug like they do on bug bounty programs?

yes. i had to do a security audit with NCC Group before... they need all your source code, all your build processes, all your environment setup scripts... basically everything. imagine training a whole new team now to build and maintain your company from scratch. then they tell you everything you already knew but management told you not to bother fixing. then management yells at you for not fixing it earlier. then everyone is fired and NCC Group takes over.

Re: PhpMyAdmin Project Successfully Completes Security Audit

#65

Post by sciurus »

dsacco wrote: post #36
sciurus wrote: post #9

Earlier quoted context omitted.

Interestingly, Google specifically excludes CSV vulnerabilities like that from their bug bounty program. > CSV files are just text files (the format is defined in RFC 4180) and evaluating formulas is a behavior of only a subset of the applications opening them - it's rather a side effect of the CSV format and not a vulnerability in our products which can export user-created CSVs. This issue should mitigated by the ap…

To add a bit of color here, Google is correct to exclude CSV vulnerabilities. There is no way (through this vulnerability) to compromise a Google host, a user account managed by a Google host or sensitive data associated with a user account. As framed, this is kind of similar to using a Google web tool to edit an XML file, export it and compromise someone using external entity injection. In that context, you're not r…

It probably helps that Google's applications encourages their users to open spreadsheets in Google Sheets, instead of office software running on the users' machines.

If you work on a web application where users can generate reports that contain input from other users, and a common workflow is for users to download those reports and open them in Excel, they aren't going to be happy if your site is a vector for attacks. Saying "Oh, but it's an attack against your laptop, not against our servers; WONTFIX." is going to be tough to justify.

Re: PhpMyAdmin Project Successfully Completes Security Audit

#66

Post by fideloper »

I really hate the idea of having a web interface to my database anywhere, no matter how secure they say it is. Social engineering (over direct "hacking") lends itself to circumventing technical security.

No matter their technical security (Although I'm super happy they test phpmyadmin!), I still wouldn't trust it on my servers.

Granted you can lock phpmyadmin down via ip restriction, vpn, etc - that's definitely good, but, if you can forgive a bit of generalization, those measure tend to be above people's head or too restrictive for those using phpmyadmin.

If we do connect to a database using a GUI (usually an app instead of phpmyadmin), however, my preference is through an SSH tunnel. This lets us connect securely (over SSH), and still allow MySQL to not be globally accessible from the outside world - meaning, you can still using MySQL's built-in network security features (bind-address and username hosts, along with firewall restrictions) to lock down MySQL.

Re: PhpMyAdmin Project Successfully Completes Security Audit

#67

Post by labster »

fideloper wrote: post #66

I really hate the idea of having a web interface to my database anywhere, no matter how secure they say it is. Social engineering (over direct "hacking") lends itself to circumventing technical security. No matter their technical security (Although I'm super happy they test phpmyadmin!), I still wouldn't trust it on my servers. Granted you can lock phpmyadmin down via ip restriction, vpn, etc - that's definitely good…

> I really hate the idea of having a web interface to my database anywhere,

Aren't those called "applications"? And yes, I hate them too.

Re: PhpMyAdmin Project Successfully Completes Security Audit

#68

Post by ivanhoe »

fideloper wrote: post #66

I really hate the idea of having a web interface to my database anywhere, no matter how secure they say it is. Social engineering (over direct "hacking") lends itself to circumventing technical security. No matter their technical security (Although I'm super happy they test phpmyadmin!), I still wouldn't trust it on my servers. Granted you can lock phpmyadmin down via ip restriction, vpn, etc - that's definitely good…

Why do you presume that web app has to be run public? You can easily limit access to web app by IP, or you can put it on a private network that you will access through VPN. That would make it more secure than most web services that we trust regularly, like gmail or paypal...

Re: PhpMyAdmin Project Successfully Completes Security Audit

#69

Post by acomjean »

smaili wrote: post #2

Does anyone still use this? I didn't realize this was still actively maintained.

Yes. A lot of times its available on shared hosting behind some login. Esp, if you don't have shell access on inexpensive hosts.

Its been available at places I've worked. It was locked down by IP. The database was restricted to access by ip too, in theory making outside access more difficult.

I used it a lot (less now) and honestly, I kind of like it. The interface is a little kludgy, but it gets the job done. Queries are editable, exportable in various formats. You can construct a search via gui then edit the SQL it generates . It seems to have a lot of functionality built in, user/table management etc..

For local instances I use sequel pro too (the ssh login function it has is nice and works well).

Re: PhpMyAdmin Project Successfully Completes Security Audit

#70

Post by dvt »

fideloper wrote: post #66

I really hate the idea of having a web interface to my database anywhere, no matter how secure they say it is. Social engineering (over direct "hacking") lends itself to circumventing technical security. No matter their technical security (Although I'm super happy they test phpmyadmin!), I still wouldn't trust it on my servers. Granted you can lock phpmyadmin down via ip restriction, vpn, etc - that's definitely good…

For a prospective hacker, I don't think there's much of a (functional) difference between a graphical interface or a shell.
Post reply on HN