21–30 of 52 posts
I always assumed cheap hosts were terrible, but this is mind boggling incompetence beyond what I would have imagined.
Management prefers to cut the cost of having to hire good security engineers, and wait for it to blow up first;
All this assuming the hacker would use a gift card to get a paid account to start.
Are the old hosting companies of the past still sharing the same disk with other users? I remember going cd .. and seeing a bunch of folders in /home from other users. If any one of those users used a chmod incorrectly I would be able to access their shit. It is not super likely for most files but well known files can be a problem. Beyond that, trusted CGI-BIN processes could probably be used to get around security c…
Allowing executable code (CGI, PHP) in such an environment is just a recipe for trouble.
Are the old hosting companies of the past still sharing the same disk with other users? I remember going cd .. and seeing a bunch of folders in /home from other users. If any one of those users used a chmod incorrectly I would be able to access their shit. It is not super likely for most files but well known files can be a problem. Beyond that, trusted CGI-BIN processes could probably be used to get around security c…
This was a while ago so I don't know if they found a solution. User home directories are private but you can easily guess common paths under them (eg wordpress).
I always assumed cheap hosts were terrible, but this is mind boggling incompetence beyond what I would have imagined.
> but this is mind boggling incompetence I disagree. It's very easy to make such mistakes, often even to miss them in code review. You also cannot simply cover all potential errors in integration tests, because there are infinitely many potential errors you can make. You need continuous or regular red-teaming or comparable security controls to reliably avoid such things, and you typically only have those at the reall…
This tier of the market is also where the less-technical customers tend to congregate, so even if you have great security, most of your customers aren't going to be in a position to be able to appreciate that. You could argue that security is a potential marketing plus, but then you could get the same "pop" by just claiming you have great security without actually providing it. It's not like your customers are going to be able to tell the difference.
Are the old hosting companies of the past still sharing the same disk with other users? I remember going cd .. and seeing a bunch of folders in /home from other users. If any one of those users used a chmod incorrectly I would be able to access their shit. It is not super likely for most files but well known files can be a problem. Beyond that, trusted CGI-BIN processes could probably be used to get around security c…
Are the old hosting companies of the past still sharing the same disk with other users? I remember going cd .. and seeing a bunch of folders in /home from other users. If any one of those users used a chmod incorrectly I would be able to access their shit. It is not super likely for most files but well known files can be a problem. Beyond that, trusted CGI-BIN processes could probably be used to get around security c…
I have a shared hosting account with Dreamhost. A while back I went looking for accessible stuff under other user's accounts. It was fairly easy to find both readable and writable directories. This was a while ago so I don't know if they found a solution. User home directories are private but you can easily guess common paths under them (eg wordpress).
I wish they had kept going till they found a web hosting firm that didn't have these issues. Can anyone -- not affiliated with such a firm -- recommend one? If you are affiliated with such a firm, and you respond anyway, please explain what you do differently.
We're working really hard on securing multi-tenant Kubernetes clusters and have some tricks up our sleeves from years in the cloud industry, but we have not yet completed any external audits - that said, as the CTO, I take security _extremely seriously_ and consider it my number 1 priority, if that helps! We use tech like containerd, gvisor, eBPF and lots more to secure users containers on our multi-tenant hosting tier.