Adam Bannister11 August 2021 at 10:58 UTC Updated: 13 August 2021 at 10:29 UTC

Pen testers and vendor disagree over appropriate mitigations

Security researchers have achieved remote code execution (RCE) and privilege escalation on web hosting platform cPanel & WHM via a stored cross-site scripting (XSS) vulnerability.

cPanel & WHM is a suite of Linux tools that enable the automation of web hosting tasks via a graphical user interface (GUI). cPanel is used in the hosting of more than 168,000 websites, according to Datanyze.

During a black-box pen test, RCE was also demonstrated via a more convoluted CSRF bypass chained with across-site WebSocket hijacking attack that was possible because WebSockets failed to check their requests Origin header, according to a technical write-up published by Adrian Tiron, cloud AppSec consultant at UK infosec firm Fortbridge.

The Websocket hijacking attack was tested in Firefox, since Chrome has SameSite cookies enabled by default.

The web hosting firm has not fixed these flaws it only patched a separate, XXE vulnerability reported by Fortbridge because attackers must be authenticated with a reseller account with permission to edit locales, which is not a default configuration.

The Locale interface can only be used by root and Super Privilege resellers that root must grant this specific ACL to, Cory McIntire, product owner on the cPanel security team, told The Daily Swig.

This is labelled a Super Privilege with a warning icon in the server admins WHM interface and also flagged as such in the cPanel documentation, he added.

DONT FORGET TO READ Top Hacks from Black Hat and DEF CON 2021

When you expand this icon, it is explained to the server admin that they will be allowed to insert HTML into this interface, as many of our customers expect to be able to do.

He added: Again, this is an option root must enable for the reseller and should only be done so for users that are trusted as though you are giving them root to your server.

However, Tiron believes the XSS could have been fixed while maintaining the intended functionality.

He told The Daily Swig: What theyre saying is correct, in a sense that this covered by the documentation, but just because its documented doesnt make it secure. People dont often read documentation and theyre not [usually] security experts either, so they won't be able to make the right decision most of the time.

Weve seen this approach quite a lot recently, with other vendors weve worked with. The correct approach should be secure by default, not its documented, its your responsibility now.

Catch up on the latest cybersecurity vulnerability news

The researcher suggests the issue could have been completely mitigated by applying some filtering/encoding on that vulnerable input.

He added: Even if they consider the edit locale as a super privilege this wasnt clear to us during the pen test and it was definitely not clear to our customer either.

cPanels McIntire said that to protect themselves the server admin would simply have to remove any Locale Super Privileges granted to untrusted resellers.

We appreciate Fortbridges responsible disclosure to us and hope that these explanations will ease any worries our customers may have regarding this issue, he continued.

It is of upmost importance that you only give Super Privileges to people you would trust with root on your server.

Tiron said cPanel was notified of the vulnerabilities during May and June of this year.

RECOMMENDED A whole new attack surface Researcher Orange Tsai documents ProxyLogon exploits against Microsoft Exchange Server

Read more:
Web hosting platform cPanel & WHM is vulnerable to authenticated RCE and privilege escalation - The Daily Swig

Gerry Miller, CEO & Founder, Cloudticity

In April, software giant Microsoft made a lot of headlines announcing itsmultibillion-dollar acquisition of Nuance, the cloud-based clinical intelligence developer best known to healthcare providers for its Dragon and PowerScribe speech-recognition products.

Business analysts and reporters zeroed in on impressive financial details and utilization potential for ambient AI technologies in health settings. But more than anything, the deal shows how serious Microsoft is about its healthcare IT ambitions and how central itsAzurecloud service is to those goals.

Longbeforethe acquisition news (or even the launch of Microsoft Cloud for Healthcare last year), Microsoft has been aggressively investing in making its Azure cloud computing service attractive to healthcare for hosting, building, testing, deploying, and managing applications and services. Its worth noting that all Nuances leading speech-to-text healthcare products, designed to integrate nicely with electronic health record (EHR) systems, are software-as-a-service (SaaS) offerings built on Microsoft Azure.

The Cloud and Healthcare IT

In the age of digital transformation, the healthcare industry is leveraging the cloud for more than nifty EHR documentation services. Organizations need its flexibility to rapidly scale resources without big capital expenditures, build and host myriad applications, facilitate collaboration, generate clinical/operational insight, and deal with expanding volumes of health data. In the hyperconnected and data-deluged modern world, the cloud is really the only feasible option for computing and storage infrastructure moving forward in most industry sectors and that includes healthcare. Microsoft knows this.

But cloud utilization in healthcare comes with unique requirements health data are sensitive, protected, and subject to distinct regulatory constraints. In the US, maintainingHIPAAandONC Cures Act Final Rulecompliance and ensuring the privacy and security of as well as appropriate accessibility to protected health information (PHI) is compulsory.

And while public cloud providers like Microsoft Azure supplyguidanceand resources for designing CURES Act- and HIPAA-compliant environments, that doesnt mean that everything on Azure is automatically safe for healthcare use. Cloud utilization comes with shared responsibilities, and healthcare organizations using the cloud are responsible for their own regulatory compliance and data protection functions and processes.

The IaaS Shared Responsibility Model

In a traditional data center, the organization owns and is responsible for security entirely from physical space and server hardware to the network and data and applications. With Infrastructure-as-a-Service (IaaS) and public clouds like Azure, the security responsibilities are shared between the user (in this case, the healthcare organization) and the cloud infrastructure provider (Microsoft).

For example, Microsoft ensures that its physical infrastructure is secured, and assumes responsibility for hardware and facility access control across geographical locations. It also ensures that its Azure cloud service is fault-tolerant and reliable, with failover provisions for outages.

But customers using Azure are responsible for securing the data they put in the cloud and the way their applications behave (for example, by enforcing complex password policies and authentication measures to ensure that hackers cant easily break-in).

Microsoft will sign a HIPAA Business Associate Agreement (BAA) with Azure healthcare customers that define and covers in-scope services, as is required by law for HIPAA compliance. But the healthcare organization using Azure still bears responsibility for achieving and maintaining its state of HIPAA compliance and ensuring its cloud instances are configured correctly.

This IaaS shared-responsibility model is a lot like renting an apartment. The landlord may be responsible for the safety and soundness of the building as a whole, but youre still responsible for locking the door to your own apartment.

The Future of Healthcare IT

It may sound like all this requires outsized effort just to manage IT, but the truth is that modern healthcare IT is experiencing a complex evolution. There are many industry-specific considerations organizations must navigate to master cloud utilization, and regulatory compliance is only one of them. On the other side of all that effort lies technological capability that can profoundly transform day-to-day operations.

The upsides of cloud power are too significant to ignore: scalable, agile, cost-efficient technology resources running secure, reliable, and largely automated services that extend capabilities while actually reducing complexity.

Microsofts continued interest in the healthcare industry is a good thing and its cloud service is helping to drive a virtuous cycle in healthcare innovation. For example, automatic speech recognition is an incredibly compute-intensive function. Without Azures cloud power, would Nuance have even become a healthcare trailblazer worthy of such high valuation? The cloud model has enabled the development and use of tools that can listen as a doctor chats with a patient to automatically generate EHR documentation. Its pretty amazing when you think about it and it will power more evolutionary leaps in healthcare IT moving forward.

About Gerry Miller

Gerry Miller is CEO and founder of Seattle-based Cloudticity, a digital enablement partner for the healthcare industry. Gerry is a serial entrepreneur and healthcare fanatic with over 30 years in the technology industry. Prior to Cloudticity, Gerry was brought in as the chief operating officer at ePrize; he turned around a failing company that was eventually sold for a fourfold return on the initial private equity investment. Before ePrize, Gerry spent eight years at Microsoft, first as chief technology officer for the US central region, then running the global business unit that oversaw General Motors (Microsofts second-largest customer), growing that account from $20MM to over $100MM in three years. Prior to Microsoft, Gerry spent nearly a decade in the technology consulting and startup industry. He holds all five AWS certifications.

Read more:
Cloud Technology and Healthcare Evolution: Microsoft in the Spotlight HIT Consultant - HIT Consultant

Big Tech corporations worked in concert this past January to deplatform Parler, a fast-growing social network friendly to conservatives. Parlers vendors, such as Amazon Web Services, bowed to influential ideological forces and weaponized their Terms of Service, basing their actions on the expectation that Parler could not moderate content to AWSs satisfaction on a timely basis (a subjective standard impossible for any company of any size to meet).

When AWS enforced their evolving content moderation policies on Parler, with maximum consequences, the entire tech industry realized they could do it to anyone.Watching AWS and partners arbitrary enforcement against specifically and only Parler, while ignoring the many other offenders they host, highlighted the vulnerabilities any conservative company reliant upon the cloud faces.

CaucusRoom.com is a social network designed to help conservatives gather, encourage and engage locally. We are a small but growing player among conservative platforms that see a need, and a business opportunity. Operating on the Cancel Cloud posed a liability to our company legally, financially, and technically. Now unshackled from Big Techs chains, CaucusRoom is better off in every respect.

Tech startups use cloud platforms because they offer cost-effective, incremental, and instantly scalable access to hosting, infrastructure, data storage, and a host of other key services. However, these platforms and hosting providers tend to breed ecosystems of tightly integrated sub-vendors and service-boosters, which can severely disincentivize a company from operating outside of the ecosystem, colloquially known as a walled garden or vendor lock-in. In addition to the constellation of services it already offers, AWS owes much of its market dominance to its well-established network of cloud platforms and providers.

At CaucusRoom, not only did we subscribe to some AWS services, but nearly every other platform we subscribed to in turn extended AWSs services to host our website and core services, run our infrastructure, and store our data. These services include container orchestration, managed databases, caching systems, static content storage, load balancers, to name a few. The myriad contracts multiplied our vulnerability to a cancel moment, as each sub-vendor must adhere to AWSs terms in addition to their own terms.

When AWS deplatformed Parler, all of AWSs parasitic sub-vendors booted Parler as well. Imagine being booted off of a Mac when all of your programs are made for Mac, and you cant find any other computer designed to run your programs.

Fortunately for CaucusRoom, our tech stack was still small and nimble enough to maneuver off the cloud on our own terms. Within days of the Parler deplatforming, we received about a dozen calls from conservative-friendly data centers and tech vendors. We easily found a data center with owners anxious to help companies like ours. The customer service is fantastic. Every person we work with is someone weve personally met can you imagine saying that about a Big Tech company?

The move took about a month of preparation, testing, and transitioning. Backend infrastructure management is a different engineering discipline than the front-facing website seen by our users, but fortunately, our engineers spoke the language. If needed, our data center hosts also offer a team ready to personally help make the transition, and our monthly fee includes a few hours of their engineering time whenever needed. Now we are using the hardware we want, directly, and without a gaggle of woke gatekeepers.

CaucusRoom is now faster off of the cloud. We can move data around more easily to speed up queries. We can balance traffic in ways that reduce bottlenecks. Colocation of the core services for the site significantly increases responsiveness and eliminates the need for many third-party cloud services.

But what about the cost? The total monthly cost is just a few hundred dollars more per month (about 10 percent). Its a bargain given the engineering time saved, and the assurance offered to our investors and users.

By moving off of the cloud, we reduced our total number of online hosting vendors by 80 percent, while increasing our selection of possible data solutions. Each time we eliminate a data vendor, we eliminate a potential cancel moment that could paralyze our site.

If we do find ourselves in need of a move, shifting quickly to a new data center becomes much easier it would take minutes, instead of weeks, to untangle our data contracts and sign new ones. The same goes for the engineering required.

As a startup, eliminating potential risk is critical to raising investment. Its also important to reassure potential customers in our case, those customers include political campaigns and conservative causes looking for a new home away from Facebook. Conservative digital campaign directors know they are not safe from cancellation on Facebook or Twitter, and they need confidence that any new platform they use cannot be arbitrarily wiped off the internet.

In the chaotic world of politics, as in business, its important to focus on what you can control. After Parlers deplatforming, anyone with a website may control less than he previously thought. We encourage you to take an inventory of your websites tech stack. How many of your vendors, and their terms, are subservient to a Big Tech master?

Beware of vendor lock-in and keep your stack nimble. Get a few bids for services from conservative-friendly data centers. Most will bend over backward to help you cancel the cloud, and even help with any engineering needed to make the move. Your costs wont go up much, but if they do make sure and tell your investors and supporters youre hosted on a freedom-loving data center. They will likely double-down, reassured that youve reduced your risks.

In just a few weeks after moving off the Cancel Cloud, CaucusRoom added new investors and landed a major national network of conservative activists. Our product improved, our risks decreased, and our future capabilities expanded.

Matt Knoedler is the Co-Founder and CEO of CaucusRoom.com. Nathan Carlson is the companys Lead Engineer.

See the article here:
How We Cancel-Proofed Our Online Start-Up By Leaving The Cloud - The Federalist

Its no secret that entrepreneurs need high-performing websites. Your site is the key to boosting your visibility and scaling your company. To ensure that your website performs as it should, youll need to choose the best web hosting service.

Before you can even choose a provider, its important to learn about the different types of web hosting. To help you get up to speed, lets explore the most popular types of web hosting services.

Colocation means renting a space for your hardware and servers, from a third-party data centre. Usually, colocation providers include the physical space, security, cooling systems, networking, and redundant power. You pay to host your personal servers in a colocation, maintaining ownership of the servers, networking equipment, and the storage.

By using a colocation service you can limit the size of your data centre, and reduce the associated expenses. Colocation offers a scalable business solution, companies can access higher bandwidth levels, to support their growing web traffic.

Cloud Hosting uses the Internet to provide access to computing resources, websites and apps. It differs from traditional hosting because it does not rely on just one server.

Cloud-hosting offers a powerful solution, using a network of both physical and virtual servers. There are many cloud hosting benefits, including:

Some businesses want web hosting services that are optimized to their WordPress site. These businesses can choose WordPress Hosting, which generally falls under two categories.

Shared WordPress hosting is a shared model specifically designed for WordPress sites. Managed WordPress Hosting offers extra advantages, including staging, server caching, better security, and improved page speed. Improved security is particularly useful for WP sites.

WordPress is the most popular CMS in the world, hackers continually attempt to identify WordPress vulnerabilities and exploit them.

Shared Hosting provides a basic web hosting solution. When you choose this option youll be sharing resources with multiple websites, all on the same server.

Shared hosting is the least expensive hosting system. A large group of people are paying the server costs, meaning you can get a basic plan for around 2-12 per month.

Shared hosting sites are incredibly easy to set up, you wont need any tech knowledge to get started. These hosting packages are best for amateur bloggers and small startups. The downsides? You may experience slower page speeds, plus shared hosting isnt a particularly scalable solution.

Dedicated Hosting means that your site has its own very own server. With a server thats dedicated to your site alone, youll experience improved performance and ultimate flexibility. Like cloud hosting, dedicated hosting is incredibly powerful.

It can be an expensive option, so why would you pay out? Here are a few reasons:

Virtual Private Server hosting uses a shared server to replicate the experience of a dedicated server. Technically youre still using a shared physical server, however, your website gets a virtual space to call its own.

VPS systems offer improved performance compared with a shared hosting system. They arent quite as powerful as dedicated hosting systems, yet they can offer a similar experience, at a reduced price.

With a VPS system, you can adjust the environment and install apps without the support of the hosting provider. These hosting systems are private, scalable, cost-effective, and reliable.

Using tech you can improve your business in plenty of different ways. To enhance the performance of your site, you need the best web hosting solution. Colocation services and cloud-based services both offer powerful and cost-effective business solutions. If youre a new startup on a limited budget, you might prefer to start with a shared hosting service.

Whichever type of hosting service you choose, its advisable to compare a few different providers.

Read the rest here:
The 6 Most Popular Types of Web Hosting Services in 2021 - London Post