Security Audit or 3rd party Review

One tool I've used is Grendel Scan. It seems to have some false positives and false negatives, but does a pretty good job all things considered.

So far I'm not particularly impressed with results I've seen from the 3rd party testing tools. Most of them include so many false positives that they are basically useless.

--
_{Growing Venture Solutions | Drupal Dashboard | Learn more about Drupal - buy a Drupal Book}

Interesting results from the scan. Gendel is pretty easy to set up.

Interesting how it looks for backups of critical files like - http://drupal.org/user/Copy%20of

Not a security issue for Drupal as the 'Copy of' is just ignored. Doesn't look good in the scan though.

The cookie named SESS338ffb41f0808e2ff9668877c9996301 appears to be used to track session state. 
However, some duplicate cookie values were detected. If SESS338ffb41f0808e2ff9668877c9996301 is 
usedto track session state, all values supplied by the web server should be unique. Detection of duplicate 
values implies that the generation algorithm outputs predictably named cookieJar. 

Have to look more at this as "If the session ID is session ID is generated in a predictable manner, an attacker could hijack legitimate sessions by guessing the session IDs of authenticated users."

The Nikto findings are mostly about just removing the default .txt files in root. That's not a big deal if you're keeping your site up-to-date. If you let your security updates lag though then you've got issues.

Like the 'Copy of' issue there are links like '/forum/viewtopic.php' that are scanned for that probably should be blocked. Not that they do anything, but it indicates to the scanner that there's a chance.

So it seems like the most critical issue this tool identified (and there were hundreds of tests) was possible issues with cookies and some false positives.

Now this is a powerful enough tool that I should really run it also as an authenticated user too to see what the results are.

Mike

OpenConcept | CLF 2.0 | Podcasting

It occurred to me that it would be useful to extend the Grendel Scan application to hit places where we know there might be weaknesses. Just checking for backup files within /sites , /sites/example.com/ & /sites/example.com/files would be useful. Same with SQL.

Knowing the cURL, ImageMagic or GD are often enabled for Drupal, are there opportunities to probe for these issues from the outside? Knowing intimately what can be made more secure, can we look for possible weaknesses in Drupal in a more automated way (without providing hackers with all of the keys)..

As far as the request for Apache to have a security audit -- seems a bit silly since it drives 60% of the Internet. Same with PHP, lots of folks are looking at the fundamentals, but as always there are ways to configure them more securely.

So much of this is about establishing best practices, setting up and maintaining a good environment of techies & software.

Also for those who toss out FUD at the security of open source software, this scan is an excellent tool to check out how well fortified their website is.

Mike

ps. Thanks for the welcome Ingo86.

OpenConcept | Twitter | Podcasting