Support

Hi Ralf,

What if the scanner simply ran once a day, triggered by a site access?

The scan is exactly like the backup. It cannot run triggered by site access. Remember, I've tried that with backup and the problems were so many that I had to kill that feature. It's the only case of removing a feature from my software, ever.

After reading a bit more, I realized that scanning can be a resource intensive process. So if I could choose a few files that I'd like to be checked often and notified about changes (such as the main index.php), that would be nice ...

This gives a false sense of security. If I were to hack your site here's what I'd do:
- Find a way to upload arbitrary files to your site
- Upload a malicious file (e.g. a C99 variant) with an inconspicuous name like README.php deep inside your site's directory structure
- Wait for one to two months. This makes sure that all your backups and your host's backups include my malicious file.
- Hack your site and remove my malicious file.
Up next, you figure out you're hacked. You run the file scan and you see that only a few files have been modified, none was added. Cool, you think, all you have to do is restore a backup. My monitoring CRON job, running over a botnet or Tor so that you don't track me down, tells me you did so. Ha ha! I just relaunch my attack. Hacked again. Repeat as often as you want until I am bored.

Am I missing a point here, or would this be a point you could look into someday?

You are missing something. In my real world scenario above a file scan checking only specific files gives you a false sense of security. By the time these files are modified the damage is long and deeply done. Not to mention that checking even a dozen files has an adverse hit on your server's performance.

I have no access to cron jobs on any of my hostings

CRON jobs is to a hosting plan what water supply is to a condo. Would you ever buy a condo without water supply? I mean, yeah, you can probably survive but it will be a smelly, inconvenient mess. Go to a real host which supports CRON jobs.

Hello Ralf,

I disagree about the false of security being useful. I could give you a garbage bag and ask you to wear it as a vest, telling you that it'll protect you from bullets, then send you to fight in the war. This is what false sense of security means, Would like me to do that? I would consider myself a big SOB if I would ever do that. Don't ask me to send you to get killed, I won't do it, sorry.

Regarding the automatic emails, yes, that's missing. It's already on my to-do list for the next version. I had to complete some work on the Akeeba Engine (the engine which powers both Akeeba Backup and Admin Tools' file scanner) to allow that. The changes are complete and tested. Now I can add the email feature :)

Regarding the scanner being manipulated by a hacker, yes, that's a real concern. It would require an elaborate hacker but it's possible. There is an alternative. Take daily backuos of your site and compare them with SiteDiff, or use a third party service. In fact, I don't consider Admin Tools' file scanner to be a panacea. It's supposed to be part of your overall security strategy. Ideally you should be using AT along with a third party service and log inspection to have a real sense of security.

Your vest example is perfect.

That's something which has nearly happened to me. When I was serving in the military (it's mandatory for all Greeks, I'm not a big fan of aggression as a means of dispute resolution) I had to stand guard at the back entrance of the camp. We were given a bulletproof vest because half a mile to the north there was a gypsy camp and these guys, when drunk, would sometime end up shooting towards our camp with shotguns. I thought the vest was a good idea, it made me feel secure. Little did I know that they forgot to give me the part of the vest which actually blocks the bullets: the steel plates. So I was a sitting duck for four hours, all the while thinking I'm (relatively) bullet-proof. Oops! Luckily for me that day the gypsies didn't get drunk or were out of ammo. So, yeah, I've been in the position of wearing a non-bulletproof "bulletproof" vest and I did not enjoy it at all. I'll be damned if I willingly put anyone in that spot – or its Internet equivalent.

To avoid scanner manipulation, maybe you should not make the scanner too good, otherwise it becomes too popular and too interesting as a target for hackers ...

Anything which runs on a server can be a potential target for abuse or manipulation ;)

For what is worth, I finished writing the email feature for the PHP file scanner yesterday. I plan on releasing a new version of Admin Tools this week :)