Re: MYSQL and PHP

["Gerald Quakenbush" <geraldq () mastermindsecuritygroup com>]

Absolutely - if all you do is store the passwords in a file and then need a
key to decrypt the file you have to figure out what to do with that key.

There is no such thing as a security system that is both useful and
impenetrable. Often our job as security professionals is to "raise the bar" on
security to make systems hard enough to penetrate that system compromise
becomes a manageable risk. Thus, encrypting that file and managing the keys
carefully raises the bar.

There are a variety of key management strategies; some of them are pretty
complicated. The more diligent you get with key management the more complex
your software may become.

One PHP app I seen a while back had a username and password in the PHP source
much like that shown in the original post here. However, that username and
password only had SELECT access on a table that was used to validate the
user's credentials and one other table that held additional database access
information. Not a perfect solution, but raises the bar a bit.

Another solution I've seen is to store the keys on another system, typically
behind another firewall. When the application starts, it would have to make a
connection to the key server, authenticate in some manner, and retrieve the
key. If the hacker roots the box, it is only a matter of time until he can
figure this all out, but slowing down the hacker is the whole idea.

Gerald Quakenbush
Author of 'Web Hacker Boot Camp'
http://www.quakenbush.com

Robin Wood (dninja () gmail com) wrote:
> On 5/16/06, Gerald Quakenbush <geraldq () mastermindsecuritygroup com> wrote:
> > John -
> >
> > Of course, one should also get the code updated and have it read and encrypted
> > file and decrypt the credentials.
> >
> >
> > Gerald Quakenbush
> > Author of 'Web Hacker Boot Camp'
> > http://www.quakenbush.com
>
> Doesn't this give you a chicken and egg situation of where do you
> store the key for the encrypted file?


-------------------------------------------------------------------------
Sponsored by: Watchfire

Watchfire named worldwide market share leader in web application security 
assessment by leading market research firm. Watchfire's AppScan is the 
industry's first and leading web application security testing suite, and 
the only solution to provide comprehensive remediation tasks at every 
level of the application. See for yourself. 
Download a Free Trial of AppScan 6.0 today!

https://www.watchfire.com/securearea/appscansix.aspx?id=701300000007t9c
--------------------------------------------------------------------------