So that's actually really simple,
but I guess then if the criminal hacked the merchant's website,
they could hack the CSP as well.
Right,
so now we're back to the challenge of once someone entirely owns your site,
it's going to get more difficult because they could
either just delete the CSP altogether,
they could add their own host name into the CSP,
I mean, they could circumvent the problem,
and of course, they could delete the SRI hash as well.
So this is not going to help you if you get your server owned.
We're going to have to talk about different stuff in
terms of getting your server owned.
So let's talk about that.
How do we stop our servers being owned?
So, we've got to look at the different types of attacks we have against servers.
So we see things like, you know,
we were talking earlier about unpatched frameworks,
you mentioned Struts earlier on, of course,
Struts was the vector by which people got into,
and Equifax, which was very big news.
Recently we've seen a lot of news about Drupal, Drupalgeddon.
Drupalgeddon 2 is the alarming thing, there's been a Drupalgeddon 1.
Drupalgeddon 2?
Okay.
I know, there's more than one Drupalgeddon.
So, obviously,
that's sort of all the fundamentals that we learned
from the likes of the OWASP top 10, keep your frameworks up-to-date,
don't have SQL injection.
If you get SQL injection, then you've got a problem.
And SQL injection, just in case you're thinking,
yeah, but how does that change CSPs and things,
you can get remote shell on a machine with SQL injection.
From when I was at Visa and we used to look at all the compromised reports,
none of them were advanced persistent threats.
They were just what you talked about.
There was, we didn't patch vulnerabilities, and people got SQL injection.
SQL injection died out over time.
It's still there,
but it's nowhere near as prevalent --- Still the number one in the OWASP top 10.
I know.
And one of the great things is that lots of medium-sized
merchants all use a product called Magento.
It's a bit like Drupal,
but if you're building stores it's the sort of content management,
shop-in-a-box type of system.
It's really powerful.
It's had lots of vulnerabilities over time.
They've been patched by Magento, but not all merchants patch.
So you see, well, yeah.
Because remember,
security is not their day job; their day job is
buying things and selling things.
The number of data breaches I see end up Have I Been Pwned
because someone hasn't patched their forms.
I put two in literally just yesterday from a forum that
hadn't been updated for five years.
And if you can do it on Magento, and if you go to Shodan,
Shodan will show you all those Magento installations that are vulnerable.
So let's qualify that.
And there are courses where I show Shodan,
but just in case, like, go and watch those,
but just in case you haven't seen those,
Shodan is a search engine for the Internet of Things.
You can go in there and search for things like response headers,
because the server often returns a response header because marketing,
or it returns an x-powered-by header or something like this.
In Shodan indexes that you search Shodan,
you find the Magento instances, and there we are.