Support

IMHO, any extension which calls back-end files from the front-end over the web is inherently insecure and shouldn't be used. Well, yeah, there are not many alternatives to VirtueMart, so we'll have to put up with it.

I am not going to implement a back-end password protection exception feature for two reasons:
1. It is not guaranteed to work on all servers (especially those running on Apache 1.3)
2. Adding an exception for an inherently insecure extension completely beats the purpose of securing your administrator area. The reason there is a back-end password protection is to disable hackers from accessing rogue entry point scripts in your site's back-end, which is pretty much what VirtueMart does. Access to rogue scripts is a VERY BAD idea as they don't pass the request through Joomla! and the possibility of having a major vulnerability is very high. Just take a look at VirtueMart's security record and it's an immediate q.e.d. of my point ;)

I would rather have the shop owner either never manage the store from the front-end or have him provide the username and password. After all, he can save the username/password combination to his browser's keychain and not be asked about it all the time.

There is only one problem with that setup that I can think of: the PayPal integration has an IPN callback script inside the administrator area. This is completely stupid. To make it even more stupid, the damn callback script has to be called outside of Joomla!. So, if you want to use PayPal with VirtueMart, you have to screw up your site's security.

While the admin query parameter is an alternative to back-end password protection, it can not protect rogue entry point scripts. It can only handle anything which runs through Joomla!. So, no, using the query string protection will not protect you for potential VirtueMart vulnerabilities.

IMHO, the best solution is to NOT use VirtueMart. It is a security nightmare. VirtueMart and security just don't mix. The only way to use VirtueMart is to consciously downgrade your site's security and expose VirtueMart's plethora of potentially vulnerable, directly accessible scripts to the web.

OK. Next time you hear me say "Friends don't let friends use VirtueMart" you will immediately understand what I have in mind ;)

I'm not talking of remote scripts (RFI - Remote File Inclusion) attacks only. A script which doesn't go through the Joomla! framework may be susceptible to a plethora of attacks such as XSS, local file inclusion, sensitive information disclosure, SQL injection and the list goes on forever... But you are right. There are no good alternatives for Joomla! or, better said, there are no free alternatives for Joomla!. redShop does much more than VM but it costs if you want the full feature set. Tienda is shaping up to be a very solid contestant, but it's at least 1-2 years from achieving that goal. There are other cart applications but, well, they're not even comparable to VM.

Regarding the proxy requests you listed above, mod_security is the best approach. You can try writing a whole encyclopaedia of .htaccess rules, but they will slow down the site to a screeching halt.

And I fully agree with you, there are only a handful of secure hosts. The downside is that they're more expensive and people, unfortunately, still think with their wallets instead of with their heads. For instance, one very popular and very slow, insecure and bad host wouldn't be around if people would go "hey, this guy offers 100x the storage and bandwidth of the other guys in a quarter of the price; that can't be right". And right it ain't. As any old timer will tell you, you only get what you pay for. If you pay for crappy hosting that's exactly what you gonna get. Oh, well... We can't save them all. At least we can save ourselves and our clients ;)

Yes, that last line really sums it up nicely! If a real hacker puts you on his sights, all you can do is have backups and pray - unless you're a high profile governmental organisation who can afford a top notch security team, in which case you might contain the damage.