> Unfortunately, everyone thinks I'm crazy and cannot see the
> impact that the
> placement of the root folder may have. What sort of concrete
> evidence is
> out there for me to use to support my case? ...Or am I just being
too
> paranoid about the placement of the root folder?!?
Most attacks (see nimda et al.) attack scripts/files placed in common
folders.
the location of the files can be as important as the url. if you put
your files in a different webroot, you should try to avoid the common
locations like vti_bin, cgi_bin in the urls as well.
the location of common system files is important, too. most attacks
are not interactive, so there is no attacker to coordinate an attack.
so an attack makes assumptions on the location of system files like
cmd.exe etc.
Stefan Osterlitz
begin 666 ATT00007.htm
M/"%$3T-465!%($A434P@4%5"3$E#("(M+R]7,T,O+T141"!(5$U,(#,N,B\O
M14XB/@T*/$A434P^#0H\2$5!1#X-"CQ-151!($A45% M15%5258](D-O;G1E
M;G0M5'EP92(@0T].5$5.5#TB=&5X="]H=&UL.R!C:&%R<V5T/5=I;F1O=W,M
M,3(U,B(^#0H\345402!.04U%/2)'96YE<F%T;W(B($-/3E1%3E0](DU3($5X
M8VAA;F=E(%-E<G9E<B!V97)S:6]N(#8N,"XT-#$W+C B/@T*/%1)5$Q%/E)%
M.B!,;V-A=&EO;B!O9B!W96(@<F]O=#PO5$E43$4^#0H\+TA%040^#0H\0D]$
M63X-"CPA+2T@0V]N=F5R=&5D(&9R;VT@=&5X="]P;&%I;B!F;W)M870@+2T^
M#0H\0E(^#0H-"CQ0/CQ&3TY4(%-)6D4],CXF9W0[(%5N9F]R='5N871E;'DL
M(&5V97)Y;VYE('1H:6YK<R!))VT@8W)A>GD@86YD(&-A;FYO="!S964@=&AE
M(#PO1D].5#X-"@T*/$)2/CQ&3TY4(%-)6D4],CXF9W0[(&EM<&%C="!T:&%T
M('1H93PO1D].5#X-"@T*/$)2/CQ&3TY4(%-)6D4],CXF9W0[('!L86-E;65N
M="!O9B!T:&4@<F]O="!F;VQD97(@;6%Y(&AA=F4N)FYB<W [(%=H870@<V]R
M="!O9B!C;VYC<F5T92 \+T9/3E0^#0H-"CQ"4CX\1D].5"!325I%/3(^)F=T
M.R!E=FED96YC92!I<SPO1D].5#X-"@T*/$)2/CQ&3TY4(%-)6D4],CXF9W0[
M(&]U="!T:&5R92!F;W(@;64@=&\@=7-E('1O('-U<'!O<G0@;7D@8V%S93\F
M;F)S<#L@+BXN3W(@86T@22!J=7-T(&)E:6YG('1O;SPO1D].5#X-"@T*/$)2
M/CQ&3TY4(%-)6D4],CXF9W0[('!A<F%N;VED(&%B;W5T('1H92!P;&%C96UE
M;G0@;V8@=&AE(')O;W0@9F]L9&5R/R$_/"]&3TY4/@T*/"]0/@T*#0H\4#X\
M1D].5"!325I%/3(^36]S="!A='1A8VMS("AS964@;FEM9&$@970@86PN*2!A
M='1A8VL@<V-R:7!T<R]F:6QE<R!P;&%C960@:6X@8V]M;6]N(&9O;&1E<G,N
M/"]&3TY4/@T*#0H\0E(^/$9/3E0@4TE:13TR/G1H92!L;V-A=&EO;B!O9B!T
M:&4@9FEL97,@8V%N(&)E(&%S(&EM<&]R=&%N="!A<R!T:&4@=7)L+B!I9B!Y
M;W4@<'5T('EO=7(@9FEL97,@:6X@82!D:69F97)E;G0@=V5B<F]O="P@>6]U
M('-H;W5L9"!T<GD@=&\@879O:60@=&AE(&-O;6UO;B!L;V-A=&EO;G,@;&EK
M92!V=&E?8FEN+"!C9VE?8FEN(&EN('1H92!U<FQS(&%S('=E;&PN/"]&3TY4
M/CPO4#X-"@T*/% ^/$9/3E0@4TE:13TR/G1H92!L;V-A=&EO;B!O9B!C;VUM
M;VX@<WES=&5M(&9I;&5S(&ES(&EM<&]R=&%N="P@=&]O+B!M;W-T(&%T=&%C
M:W,@87)E(&YO="!I;G1E<F%C=&EV92P@<V\@=&AE<F4@:7,@;F\@871T86-K
M97(@=&\@8V]O<F1I;F%T92!A;B!A='1A8VLN('-O(&%N(&%T=&%C:R!M86ME
M<R!A<W-U;7!T:6]N<R!O;B!T:&4@;&]C871I;VX@;V8@<WES=&5M(&9I;&5S
M(&QI:V4@8VUD+F5X92!E=&,N/"]&3TY4/CPO4#X-"@T*/% ^/$9/3E0@4TE:
M13TR/E-T969A;B!/<W1E<FQI='H\+T9/3E0^#0H\+U ^#0H-"CPO0D]$63X-
("CPO2%1-3#X`
`
end
