1

I have a PHP based website with a MySQL database. A few days ago I received an email containing all the users in the database along with their decoded passwords (the passwords were encoded using MD5).

After changing all passwords (ftp, database and the passwords from all the users), I received an email with the new info of the users.

I have used mysql_real_escape_string and htmlentities to sanitize the user inputs. Don't know what else to do in order to protect the site from another intrusion. Does anyone have any ideas on how could this have happened and what I can do to prevent it?

Your help is greatly appreciated!

9
  • 2
    did you check your FTP logs to see who's accessing the site? You might also want to switch to something like bcrypt to encrypt your passwords
    – JohnP
    May 10, 2011 at 7:01
  • 1
    Check your web server log to see where the attack is coming from and which files are being attacked. Post part of the logs here so we can help you.
    – afarazit
    May 10, 2011 at 7:01
  • 1
    Securing servers and web apps is a huge topic - you will need to provide some more information to even get speculative answers, like what kind of server your site is running on.
    – Pekka
    May 10, 2011 at 7:02
  • While you changed all passwords there could be still a backdoor process running on the host.
    – PeterMmm
    May 10, 2011 at 7:03
  • There are so many reasons why this could happen. From FTP access through simple passwords (you shouldn't access MySQL from any IP unless it's your server, BTW) and so on. You should really, REALLY read carefully the best practices in security for PHP apps. Also, don't use MD5 for passwords, for god's sake! You gotta encrypt them, not only encode them...
    – Vicente Plata
    May 10, 2011 at 7:04

2 Answers 2

12
  1. Ask the attacker. They contacted you (instead of keeping quiet and just sell the info) so presumably they also want to help you.

  2. Check all your SQL queries, looking for missed input escaping and such. Keep an extra eye on queries to the user table, especially if you do a SELECT *.

  3. Avoid SELECT * as much as you can - just select the fields you need.

  4. htmlentities does not correctly escape data to be inserted in SQL queries. You should always use mysql_real_escape_string for that. htmlentities and htmlspecialchars are used to sanitize data before ehoing it to the browser.

  5. Consider using prepared statements, for example with PDO. This will massively ease the task of securing against SQL injections, since data doesn't need to be escaped at all. (you still need htmlentities before echoing to the browser, but XSS is a different topic).

5
  • 1
    +1d you for the first point. That should be the first step.
    – JohnP
    May 10, 2011 at 7:05
  • 3
    +1 Another option is "0. Take the site off line if it hasn't already happened"
    – Pekka
    May 10, 2011 at 7:07
  • Pekka, indeed! One attacker contacting you does not mean he's the only one knowing about the flaw. This type of information is spreading fast. May 10, 2011 at 7:10
  • Already tried to contact the attacker. He didn't want to give any more information.
    – miha
    May 10, 2011 at 9:19
  • In addition to securing the site itself.. Don't use MD5, use a stronger hashing algorithm. And salt your hashes with additional random data to prevent rainbow table attacks. And require strong passwords.. presumably the passwords weren't very good if the attacker was able to get ALL of the source passwords from just an MD5 hash. May 10, 2011 at 16:03
1

Try to change your SQL querys to Prepared Statements.

Also contact your hoster to get some help from them.

Check for the latest patches of your CMS if you´re using one.

Use MD5 with a salt and multiple MD5 hashing rounds.

1
  • There's no proof that multiple hashing rounds would give better security. Multiple rounds may actually rise the collision rate. The other ones are good ways, though. Contacting the hoster may give some really good information if you're asking the right questions (they can check FTP logs, access logs etc).
    – Emil Vikström
    May 10, 2011 at 7:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .