Software can be used for many great things but there is a gloomy dark side. It also comes in the form of malicious programs and the web is literally infested with these harmful applications. Sadly, thousands of internet users download malicious software everyday, blind to the fact that they are essentially inviting threats right into their systems. These risks have the potential to be even more dangerous when a website is involved. Any software code running on a web server poses a great threat for the mere fact that it contains an executable file. This means that it can be executed by anyone in the world with an internet connection. Just imagine if there was an executable file on your desktop computer that could be executed by anyone at anytime. If this was the case, that program would have to completely secure in order to prevent the execution of malicious code on your system. The same goes for programs consisting of PHP or CGI scripts.
What makes executable programs even worse is that many of them accept parameters such as a user name or email address, making them more vulnerable to exploitation. Needless to say, the web was a lot safer some five to eight years ago when the internet phenomenon wasn’t as huge. Today, hackers are highly skilled and more determined than ever. They will do whatever it takes to break into home-based PCs, network servers, and even the applications on your website. If your scripts are not probably secured, you stand the risk of losing essential data that can stir up all sorts of trouble.
Here are just a few examples of what can happen when your scripts are not properly secured:
Hijacking of your mail server: You may ask, “what’s the point?”. The answer all boils down to legality. Although you couldn’t tell on the surface, spam is illegal in most countries and if the authorities catch you doing it, you could find yourself in big trouble. By hijacking the mail server, a spammer can use your domain to distribute mass mailings of spam. When the authorities find out, it all leads back to you.
Hijacking of your website: Ever run across a family-friendly site and wondered why is was littered with pornographic images? This my friend is website hijacking, more commonly known as defacing. A poorly configured script can invite an intruder into your site, give them enough time to setup their own credentials and leave you out in the cold.
Attacks on other machines: Leave the door open for a hacker and they just might force you to participate in a strike against other machines. Known as a DDoS attack, the hacker slips through your insecure script and installs a rootkit which opens a backdoor that gives them complete control over the server. This could eventually cause problems for both you and your web host.
With the responsibility of administering the server, it is up to your web host to provide a secure environment. As a webmaster however, it is up to you to make sure your web applications are properly scripted and secure. Software can add instantly functionality to your site but if you’re not careful, it can also be your worst nightmare.