A few days ago, an incident happened to me that has prompted
writing of this article. I’m sure that if this is an issue for me and one of my Web sites, it’s an issue for many others. With my personal Web site, I use a nationally known Internet Host provider to host it. They’ve hosted my site for years, and I can’t really complain about their services (except that you can rarely find a real “person” to talk to).
However, a few days ago, I wanted to give a good friend of mine, Dave Barry, access to FTP into my Web site to download a particular file. Rather than using an FTP program, he used IE (Internet Explorer) to FTP into
site. The strange thing is, before I even gave him my username and password, Dave was inside
server where my site is hosted!
Dave said that
server, and any sites hosted on that server, were wide open for attack. He was able to see
System 32 Directory, passwords, etc. The good news for me is that Dave is a Certified Internet Webmaster Security Professional Instructor, so he knows exactly what he’s talking about (and I don’t).
He ran a report to show
vulnerability of my Web site. That report indicated that there were seven high risk vulnerabilities, four medium risk, and two low risk. It also said that it was imperative that I take immediate action in fixing
security issues of
network.
Now isn’t this a comforting thought, especially since I’ve never questioned
security of my Web site? I use one of
top Web hosting firms in
country. This problem should NOT have happened.
I contacted
hosting company, and they’re checking into it. At one point, they said, “A little further research on my part found that anonymous FTP is erroneously enabled on your website.” Then, in a later e-mail, they changed their mind, “I did misspeak last night when I said that anonymous access was enabled, as I could not upload any files at all, though I could view some directories and files, evidently some relatively innocuous system data files.”
Dave disagreed, and he promptly sent me two files to prove how vulnerable and insecure
system is. I sent them those files as well as
security report Dave ran, and they’re continuing to look into it. To date though, a week later, they still haven't gotten back with me on it.
In my case, though this is a very disturbing situation, it isn’t
end of
world. I don’t sell anything on my Web site – it’s there for informational purposes only.
But, for those of you who actually sell goods or services over
Internet, this could be a huge, and extremely distressing, problem. As Dave said, “I could crash
entire server in a matter of minutes.” But, he’s one of
good guys wearing a white hat, not a hacker. He’s also responsible for 40+ Web sites through his company, all of which are extremely secure.