4

This is about a (currently fictional) case where a very small group of one or more individuals is running a custom web site / web application.

The site would be a typical server-side PHP/client side JavaScript site, consisting of somewhere between 100 and 10000 files.

The individuals working on the site are quite early in their web journey and for various reasons they do not have the manpower to go through all of the files (or the funds to hire someone to do it for them).

For example, they might:

  • Be running an open-source project, or other non-profit project
  • Have started recently and have not yet made much profit.

So for what-ever reason they are currently, in a sense, small-scale actors even though their site may by now be receiving a large amount of visitors.

Considering the lack of manpower and funds, and the sheer amount of files that would need to be examined to determine if their site has been compromised, it would be best to automate such checking-processes as much as possible.

Note: This question is specifically about determining whether a web site or web app has been compromised. Understandably no software may be able to determine this completely automatically. But some software may be able to for example run automated comparisons between the current files and past versions of the files.

It would be great if the software can scan the host (e.g. to determine changed configuration settings) separately from the web app.

The question I wanted to ask is whether any software (or service) exists for this purpose. It should be available either for a relatively low cost (e.g. less than 100 USD per month) or be open source.

Improve this question
5
  • Software can detect it given a few natural constraints. You'll most likely have, or should have, the source code of your site somewhere off-site. This allows you to check if the off-site version is different from the online version. This process can of course be automated.
    – holroy
    Commented Oct 15, 2015 at 21:08
  • Thanks @holroy, what software can then be used for automating the process?
    – user12547
    Commented Oct 15, 2015 at 21:10
  • Loads of variations of software. Possibly even your way of publishing to your site can tell if your previous version has changed. If not some kind of synchronisation software will do the trick.
    – holroy
    Commented Oct 15, 2015 at 21:14
  • 1
    The problem with using OS level software to detect a cormpromise is that attackers can and do use rootkits to modify the OS at a relatively low-level to hide their activities, such that it's not possible to accurately detect their presence. As such the only reliable way to do this would be to shut down the system, boot an alternate OS, and then use tools to attempt to detect the compromise (e.g. integrity checking tools, or rootkit detection software)
    – Rory McCune
    Commented Oct 15, 2015 at 21:14
  • please tell what kind is your adversary to defend against. you need that for threat modeling. for example if you are defending against data misuse from "cloud" hosting provider companies then obviously uploading data to them won't make any good. the point is please tell who your adversary is.
    – n611x007
    Commented Oct 21, 2015 at 23:35

1 Answer 1

Reset to default
1
+25

My suggestion would be Codeguard.

Features:

  • Backup your entire site to the cloud.
  • Monitoring to see changes/added files via daily email reports.
  • Automatic backups of new changes/added files.
  • Restore to previous versions of files.

Pricing:

  • $5/month for 1 website, unlimited databases, 5GB of storage
  • $39/month for 12 websites, unlimited databases, 50GB of storage
  • $79/month for 25 websites, unlimited databases, 125GB of storage
  • $239/month for 100 websites, unlimited databases, 500GB of storage

View plans

Codeguard's website

I've used the service myself before and it's really smooth to be able to see all updates/changes to your files. I like it but the website I used it on wasn't very big. Therefore I cannot tell you how this works with large files and for popular websites. But I would think it works well.

Improve this answer
2
  • funny a couple of days ago I was wondering if this kind of service existed. I will definitely check them out. Thank you!
    – user12547
    Commented Oct 20, 2015 at 2:29
  • I hope you like it and it works like you want it to! :)
    – L.Johnson
    Commented Oct 20, 2015 at 6:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.