|By Jyoti Bansal||
|May 10, 2015 07:00 PM EDT||
We’ll explore in this blog frequent channels of attacking and exploiting a PHP application. This blog is by no means an official guide to the security of your application, and you should always consult with your team of security experts on the best practice for your application environment.
For starters, we’ll cover some of the most common attacks that you should be aware of. Almost all modern frameworks, libraries, and extensions have built-in mechanisms to patch these popular methods of attacks, but we’ll cover them nonetheless. These attacks are extremely simple to do and very easy to thwart, but they are very damaging if left exposed to the public.
Cross-Site Scripting (XSS)
All the data that you present to your users are not entirely hosted by you, contrary to popular belief. Modern web applications are extremely dynamic and pull data from various sources. In some instances, your site could provide the ability for a user to leave comments via a form. From inside that form, a hacker could paste a <script> tag pointing to a malicious script on another remote server.
Further, the hacker can place more than just a <script> tag. XSS involves <iframe>, <body>, and even <img> exploits. How do you avoid this? You sanitize all the data that you receive from users!
This exploit is creative and, frankly, deadly to your database. Imagine, for instance, that you are passing information from one page to another via hidden fields in a form.
In this case, you are accessing $_POST[‘user’], and the value is 23 and $_POST[‘password’]. Then, you move on to the database to perform a SELECT from your user table where user = 23. This particular attack overrides the SQL and inserts an additional statement so that your query returns true. For example, where you normally perform this:
SELECT user_id FROM user WHERE user_id = ‘23′ and password = ‘bla’
this hacker could override that by making you execute this:
SELECT user_id FROM user WHERE user_id = ‘23′ and password = ‘bla’ OR ‘true’ = ‘true’
The query above can run successfully and return true, even though the password is incorrect, causing your hacker to gain access by only knowing the user_id and not knowing the password at all!
To learn how to avoid database hacks, you can scroll down to the Database section (below).
Security Best Practice
OK, we’ve covered a couple of the most common attacks look like. Let’s dive into software development best practices and how they can help protect you from being vulnerable to attacks.
Security is a moving target. There is no perfect method of protecting yourself from the infinite exploits that could potentially exist. What does one do in this case in order to avoid being compromised? There are some basic best practices that should be implemented in your PHP environment.
Keep your PHP Upgraded
Always keep your PHP version up-to-date. I cannot stress this enough. You would probably be shocked at the amount of PHP users today who are running vulnerable versions of PHP, going as far back as PHP 4! Even within the PHP 5 series, always keep up-to-date with the latest version, and keep in mind that the PHP group does drop support and will end-of-life a version, regardless of who is running it. This means your PHP version could be outdated and vulnerable.
Keep SSL on at all times
There used to be a time when SSL was only used for when dealing with financial or health records. In other words, SSL was used when federal regulatory bodies required it. However, best practice is beginning to dictate that SSL always be turned on at all times throughout the lifetime of a customer session. The threat to security has unfortunately become so prevalent that even the most basic of requests can come under threat. For this reason and others, turning on SSL at all times has become a common practice in most web applications.
Validate everything that you collect and that is sent to you
All information that is passed to your application is suspect. There is no exception to this rule. Even if you receive this information from a third-party web service API, there is no guarantee that their data is not contaminated. You cannot vouch for the security of another company, so it is probably best to practice good data validation against information received from the outside world.
This information can be in the form of input from your users, partner access to your web service API, or perhaps even local files you are opening with PHP to parse through. Before any data is processed, saved to a database, or returned to your customers, you should always run the data through basic sanity checks.
Also, keep in mind that the session data that you set can be jeopardized. For example, when you set a cookie value on the client side, that value can be manipulated; so, the next time you access it, you should validate that data. You probably shouldn’t see sensitive information in your cookies, but just in case, verify the data, too.
Take a look at the filter_var() and filer_input() functions and see how you can fit it into your sanitation workflow. Configure your php.ini for optimal security. Your php.ini file may contain serious security flaws if you do not configure your environment correctly. I wrote another blog piece on this topic that you can read. In that blog post, I have a section that covers a basic introduction to security, but also covers other basic declaratives that you should be aware of.
Follow proper Error Reporting practices
The general rule when it comes to error reporting is: report everything in development, display nothing in production.
This means that, while you are in development mode, you want to be aware of all potential issues with your PHP application – including Notices, Warnings, and, of course, Errors. However, in production, you never want error information to be displayed to your visitors. Not only will you avoid upsetting your customers, but you’ll also avoid displaying secure information that could be used against you if it fell into the wrong hands.
Configuration Files – Keep them safe and hidden
All modern frameworks and web applications require configuration files. These are the files that contain access information, connection info, passwords, database connectivity, and environment-specific variables. Obviously, this file is extremely sensitive and should never be compromised. You do not want these files in your public web directories. Configuration files should always be at least one directory above your public web folders and accessed from within the application itself by a front controller or the framework.
Front Controller Method – Keep PHP files private
This approach is possible with almost all modern PHP frameworks. The only file that should be exposed in your public web root folder is your front controller or index.php. Your front controller then instantiates your framework object, dispatches all requests to the internal router, and includes the necessary framework files by going one level down. This way, you never have any of your application files exposed to the Internet and only have a single point of entry that you can lock down to make more secure.
Database Abstraction Libraries are your friend
If you are using a framework, you are probably using a database abstraction layer. Alternatively, at the least, you could be using MySQLi or PDO. Regardless of what method you use to interface with your database backend, all data should be sanitized before being inserted into your database. Specifically, by using prepared statements, you ensure that your database libraries perform all the tedious work of extracting and removing potentially malicious data hidden inside your inputs. Remove unnecessary PHP extensions. You do not want to have more extensions than you need. Perform a quick phpinfo() on your PHP runtime to find out how many extensions you have loaded and remove all the extensions that you do not need. By including extensions that you do not need, you are introducing potential performance overhead and security risks. The more variables you can remove from the equation, the less you have to worry about. It is just good practice, in general, not to load more extensions than necessary.
This list barely scratches the surface in regards to PHP security. There are more advanced topics, including proper password hashing and encryption techniques, proper session and cookie management, file and permissions techniques, web server and firewall configurations, and more. I hope this post, at least, provides a basic introduction to PHP security topics as a starting point in securing your application and your customer data.
Interested in gaining end-to-end visibility of your PHP application? Check out a FREE trial today!
The post Introduction to PHP Security – Part 1 appeared first on Application Performance Monitoring Blog | AppDynamics.
SYS-CON Events announced today that Hitachi Data Systems, a wholly owned subsidiary of Hitachi LTD., will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City. Hitachi Data Systems (HDS) will be featuring the Hitachi Content Platform (HCP) portfolio. This is the industry’s only offering that allows organizations to bring together object storage, file sync and share, cloud storage gateways, and sophisticated search an...
Apr. 25, 2017 06:15 PM EDT Reads: 298
With major technology companies and startups seriously embracing IoT strategies, now is the perfect time to attend @ThingsExpo 2016 in New York. Learn what is going on, contribute to the discussions, and ensure that your enterprise is as "IoT-Ready" as it can be! Internet of @ThingsExpo, taking place June 6-8, 2017, at the Javits Center in New York City, New York, is co-located with 20th Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry p...
Apr. 25, 2017 06:15 PM EDT Reads: 933
@GonzalezCarmen has been ranked the Number One Influencer and @ThingsExpo has been named the Number One Brand in the “M2M 2016: Top 100 Influencers and Brands” by Analytic. Onalytica analyzed tweets over the last 6 months mentioning the keywords M2M OR “Machine to Machine.” They then identified the top 100 most influential brands and individuals leading the discussion on Twitter.
Apr. 25, 2017 05:45 PM EDT Reads: 1,004
The Internet of Things is clearly many things: data collection and analytics, wearables, Smart Grids and Smart Cities, the Industrial Internet, and more. Cool platforms like Arduino, Raspberry Pi, Intel's Galileo and Edison, and a diverse world of sensors are making the IoT a great toy box for developers in all these areas. In this Power Panel at @ThingsExpo, moderated by Conference Chair Roger Strukhoff, panelists discussed what things are the most important, which will have the most profound e...
Apr. 25, 2017 05:15 PM EDT Reads: 2,167
@ThingsExpo has been named the Most Influential ‘Smart Cities - IIoT' Account and @BigDataExpo has been named fourteenth by Right Relevance (RR), which provides curated information and intelligence on approximately 50,000 topics. In addition, Right Relevance provides an Insights offering that combines the above Topics and Influencers information with real time conversations to provide actionable intelligence with visualizations to enable decision making. The Insights service is applicable to eve...
Apr. 25, 2017 04:45 PM EDT Reads: 2,635
The age of Digital Disruption is evolving into the next era – Digital Cohesion, an age in which applications securely self-assemble and deliver predictive services that continuously adapt to user behavior. Information from devices, sensors and applications around us will drive services seamlessly across mobile and fixed devices/infrastructure. This evolution is happening now in software defined services and secure networking. Four key drivers – Performance, Economics, Interoperability and Trust ...
Apr. 25, 2017 04:45 PM EDT Reads: 382
Multiple data types are pouring into IoT deployments. Data is coming in small packages as well as enormous files and data streams of many sizes. Widespread use of mobile devices adds to the total. In this power panel at @ThingsExpo, moderated by Conference Chair Roger Strukhoff, panelists will look at the tools and environments that are being put to use in IoT deployments, as well as the team skills a modern enterprise IT shop needs to keep things running, get a handle on all this data, and deli...
Apr. 25, 2017 04:30 PM EDT Reads: 2,294
SYS-CON Events announced today that Grape Up will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct. 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Grape Up is a software company specializing in cloud native application development and professional services related to Cloud Foundry PaaS. With five expert teams that operate in various sectors of the market across the U.S. and Europe, Grape Up works with a variety of customers from emergi...
Apr. 25, 2017 04:15 PM EDT Reads: 2,006
SYS-CON Events announced today that T-Mobile will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. As America's Un-carrier, T-Mobile US, Inc., is redefining the way consumers and businesses buy wireless services through leading product and service innovation. The Company's advanced nationwide 4G LTE network delivers outstanding wireless experiences to 67.4 million customers who are unwilling to compromise on ...
Apr. 25, 2017 04:00 PM EDT Reads: 951
SYS-CON Events announced today that CollabNet, a global leader in enterprise software development, release automation and DevOps solutions, will be a Bronze Sponsor of SYS-CON's 20th International Cloud Expo®, taking place from June 6-8, 2017, at the Javits Center in New York City, NY. CollabNet offers a broad range of solutions with the mission of helping modern organizations deliver quality software at speed. The company’s latest innovation, the DevOps Lifecycle Manager (DLM), supports Value S...
Apr. 25, 2017 03:00 PM EDT Reads: 460
With billions of sensors deployed worldwide, the amount of machine-generated data will soon exceed what our networks can handle. But consumers and businesses will expect seamless experiences and real-time responsiveness. What does this mean for IoT devices and the infrastructure that supports them? More of the data will need to be handled at - or closer to - the devices themselves.
Apr. 25, 2017 02:45 PM EDT Reads: 525
Bert Loomis was a visionary. This general session will highlight how Bert Loomis and people like him inspire us to build great things with small inventions. In their general session at 19th Cloud Expo, Harold Hannon, Architect at IBM Bluemix, and Michael O'Neill, Strategic Business Development at Nvidia, discussed the accelerating pace of AI development and how IBM Cloud and NVIDIA are partnering to bring AI capabilities to "every day," on-demand. They also reviewed two "free infrastructure" pr...
Apr. 25, 2017 02:45 PM EDT Reads: 1,255
DevOps is often described as a combination of technology and culture. Without both, DevOps isn't complete. However, applying the culture to outdated technology is a recipe for disaster; as response times grow and connections between teams are delayed by technology, the culture will die. A Nutanix Enterprise Cloud has many benefits that provide the needed base for a true DevOps paradigm.
Apr. 25, 2017 02:30 PM EDT Reads: 545
Most technology leaders, contemporary and from the hardware era, are reshaping their businesses to do software in the hope of capturing value in IoT. Although IoT is relatively new in the market, it has already gone through many promotional terms such as IoE, IoX, SDX, Edge/Fog, Mist Compute, etc. Ultimately, irrespective of the name, it is about deriving value from independent software assets participating in an ecosystem as one comprehensive solution.
Apr. 25, 2017 01:45 PM EDT Reads: 334
New competitors, disruptive technologies, and growing expectations are pushing every business to both adopt and deliver new digital services. This ‘Digital Transformation’ demands rapid delivery and continuous iteration of new competitive services via multiple channels, which in turn demands new service delivery techniques – including DevOps. In this power panel at @DevOpsSummit 20th Cloud Expo, moderated by DevOps Conference Co-Chair Andi Mann, panelists will examine how DevOps helps to meet th...
Apr. 25, 2017 12:30 PM EDT Reads: 1,237
SYS-CON Events announced today that Hitachi, the leading provider the Internet of Things and Digital Transformation, will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Hitachi Data Systems, a wholly owned subsidiary of Hitachi, Ltd., offers an integrated portfolio of services and solutions that enable digital transformation through enhanced data management, governance, mobility and analytics. We help globa...
Apr. 25, 2017 12:15 PM EDT Reads: 981
Five years ago development was seen as a dead-end career, now it’s anything but – with an explosion in mobile and IoT initiatives increasing the demand for skilled engineers. But apart from having a ready supply of great coders, what constitutes true ‘DevOps Royalty’? It’ll be the ability to craft resilient architectures, supportability, security everywhere across the software lifecycle. In his keynote at @DevOpsSummit at 20th Cloud Expo, Jeffrey Scheaffer, GM and SVP, Continuous Delivery Busine...
Apr. 25, 2017 10:30 AM EDT Reads: 661
SYS-CON Events announced today that SoftLayer, an IBM Company, has been named “Gold Sponsor” of SYS-CON's 18th Cloud Expo, which will take place on June 7-9, 2016, at the Javits Center in New York, New York. SoftLayer, an IBM Company, provides cloud infrastructure as a service from a growing number of data centers and network points of presence around the world. SoftLayer’s customers range from Web startups to global enterprises.
Apr. 25, 2017 10:15 AM EDT Reads: 2,108
The 20th International Cloud Expo has announced that its Call for Papers is open. Cloud Expo, to be held June 6-8, 2017, at the Javits Center in New York City, brings together Cloud Computing, Big Data, Internet of Things, DevOps, Containers, Microservices and WebRTC to one location. With cloud computing driving a higher percentage of enterprise IT budgets every year, it becomes increasingly important to plant your flag in this fast-expanding business opportunity. Submit your speaking proposal ...
Apr. 25, 2017 10:00 AM EDT Reads: 1,028
In his keynote at @ThingsExpo, Chris Matthieu, Director of IoT Engineering at Citrix and co-founder and CTO of Octoblu, focused on building an IoT platform and company. He provided a behind-the-scenes look at Octoblu’s platform, business, and pivots along the way (including the Citrix acquisition of Octoblu).
Apr. 25, 2017 09:45 AM EDT Reads: 1,234