Backup
rorobe
1 Nov 2006 01:17
Hi there, was just wondering if you actually take a mirror backup of everybodys uploads in case of some unfortunate event? I would hate to have to upload these all again... reason for asking is that someone hacked my website and deleted everything.....
Thanks Willam.
Thanks Willam.
shedli
1 Nov 2006 05:46
Hi William,
Yes, we do mirror all the data, and in addition we are extremely paranoid and systematic about backups and security. We've really done everything possible to prevent that sort of thing from happening, so there's very little to worry about.
BTW, sorry to hear about your site - what happened, exactly?
Yes, we do mirror all the data, and in addition we are extremely paranoid and systematic about backups and security. We've really done everything possible to prevent that sort of thing from happening, so there's very little to worry about.
BTW, sorry to hear about your site - what happened, exactly?
rorobe
1 Nov 2006 10:32
My web hosting company are currently investigatng why the files in all my folders have suddenly dissapeared? Hacked i guess....
marcus
3 Nov 2006 14:57
Sites are quite often hacked by having badly written applications/packages running on it. Eg: escaping sql queries instead of using bind variables (see http://www.google.com/search?q=sql+injection), client side validation only etc.
Last I checked phpbb still used their escape string routine, despite the bug that was presented in Postgres 8.0.8 (?), some Oracle versions etc. This is why we use this not quite as good looking forum. ;-)
Is your scripting engine (php, asp...) allowed to execute scripts? Write to folders? Read or Write to some other pathes that the web root? Do you use an encoder (ioncube or zend)? One way hashed passwords? Database only listens to localhost? etc
Running this site on https is also a sign of paranoia. I ask the security interrested to install http://wireshark.sourceforge.net/ and see what happens when you f.ex fetch mail, ftp... Everything you see in wireshark anyone can see if you are using wlan and wep won't help much either. Using a directional antenna, it's possible to spy from houndreds of meters away. Kismet is a well known tool to sniff other's traffic anonymously. It's often used with wireshark.
Or your ISP simply made a mistake but don't want to admit it.
No system is safe; eventually something might happen, which is why we store no credit card info, do some manual checks on money transactions, checksums on db entries, etc. Hopefully we're under the radar for the professional cracker. A cracker can ddos us or be mean in general, but can't get any money from it.
Sorry for the rant, but I'm the nerd. ;-)
Marcus, pond5
Last I checked phpbb still used their escape string routine, despite the bug that was presented in Postgres 8.0.8 (?), some Oracle versions etc. This is why we use this not quite as good looking forum. ;-)
Is your scripting engine (php, asp...) allowed to execute scripts? Write to folders? Read or Write to some other pathes that the web root? Do you use an encoder (ioncube or zend)? One way hashed passwords? Database only listens to localhost? etc
Running this site on https is also a sign of paranoia. I ask the security interrested to install http://wireshark.sourceforge.net/ and see what happens when you f.ex fetch mail, ftp... Everything you see in wireshark anyone can see if you are using wlan and wep won't help much either. Using a directional antenna, it's possible to spy from houndreds of meters away. Kismet is a well known tool to sniff other's traffic anonymously. It's often used with wireshark.
Or your ISP simply made a mistake but don't want to admit it.
No system is safe; eventually something might happen, which is why we store no credit card info, do some manual checks on money transactions, checksums on db entries, etc. Hopefully we're under the radar for the professional cracker. A cracker can ddos us or be mean in general, but can't get any money from it.
Sorry for the rant, but I'm the nerd. ;-)
Marcus, pond5