Today I am doing a review of a new security software called SecureDash

I became interested in this software because unfortunately we live in a age where websites get hacked every single day. Bored 16 year old kids with big brains and social awkwardness do it for fun. Twenty somethings do it for revenge or to make a statement. Older people do it for profit. As internet marketers we rely on our websites and the truth is that most websites are not very secure at all and we can lose countless hours of work and potentially thousands of dollars in income if our sites are hacked.

Security Dash is a cloud based software that claims to be the answer to our problems. It claims that with it, anyone can secure their site in as little as 60 seconds just by copying and pasting some code. Here is a list of the attacks it claims to protect its users from.

*NOTE: The image of SecureDash was removed in response to a DMCA Complaint that the vendors of SecureDash filed in a pathetic attempt at silencing this honest review.

In order to test this I was given access to a ‘JV account’ that is a shared account that was given to everyone the vendors are trying to get to promote this as an affiliate. Most of the people who got this access are going to pop in, have a look around, perhaps put the ‘security code’ on their site, and that will be that. Most affiliates are not professional software developers, I am, so I took a much more in depth look at this system. I had a look at the ‘security code’ and I even tried to hack (a little) one of the other affiliates sites that was testing this (he does not know I did that). Let me explain to you what I found.

First off, I noticed that the very first ‘attack’ that this system claims that it will protect against is DDOS. DDOS stands for Distributed Denial Of Service. This is basically an attack where the attackers uses dozens, hundreds, or even thousands of machines to send an overwhelming amount of traffic to a website in order to ‘bog it down’ so no one else can access it. Imagine if I had 500 people call your phone over and over, no one else could call you, because you would always be busy with the garbage calls I am having people make. Thats basically what a DDOS attack is.

Now Im not going to go into a lot of depth explaining how the ‘security code’ that you get from Security Dash works, but I will say this. It will not prevent a DDOS. It might let you know that one is happening, but it for sure wont prevent it. In fact it also wont even be super useful in helping you stop it once it starts happening. I let one of the vendors know this:

The response I got was not really so great. I was basically told that DDOS was just one of the attacks SecureDash protects against (even though it doesn’t) and that it allows you to ban people via IP address (it sort of does but not really, more on that later). Honestly I felt like my concern was just being blown off and not answered. Unfortunately that does not change the fact that SecureDash is not going to stop a DDOS, so we can scratch that one off the list.

Two other attacks that this has listed jumped out at me right away besides DDOS. First was Phishing, which makes no sense at all. Phishing is where a site (or email) pretends to be something its not. Its an attack on the internet user not the website. The second was Waterhole attack, which really is not a specific attack in the first place but more like an overall hacking strategy. Honestly at this point I felt like the creator of this system just put up a bunch of hack sounding terms, even if they made no sense, and said it protects against them in the hopes that the majority of users would not be technically proficient enough to realize that using them in this context makes little sense.

But there where some legitimate attacks listed here that happen on websites (such as SQL Injection)  so I decided to keep testing anyway. Thats when I found the huge weakness with this entire system. But before I explain this one glaring problem I do want to make something clear. Even though this does provide some measure of security despite this problem, the security is limited to attention not prevention. That is, as I said in my message above to Tom, SecureDash really does not do much to prevent attacks automatically, instead its more about alerting attacks in most cases and letting the user know that an attack is happening. This might be ok still though, if not for its major weakness which I will explain now.

Remember when I said that in order to use this you simply copy some PHP code (which I inspected) and put it on your site. Nice and easy right. Well the problem is that SecureDash can only monitor files, programs, and pages that have this code on it. It can do nothing if the code is not present.

Now every website is different, but first off, if you have an HTML website you are not going to be able to use this without changing the name of every file on your site or creating a custom HTACCESS file to force your server to treat your HTML files like PHP. Regardless of if your site files are PHP or HTML, if you have a custom designed site you will also have to add the code to every single site file manually. Thats kind of a pain.

Fortunately many people dont have custom sites anymore. They use a CMS like WordPress, and sure enough the tutorials specifically talk about a quick and easy way to add this code on every page of your WordPress site. They tell you, and show you how, to simply add their ‘security code’ to your WordPress theme’s header file. Nice. Problem solved right? Not really because there is still a gaping hole here. The plugins. Everyone who has a WordPress site has some plugins and following the instructions provided inside of SecureDash will not protect you from vulnerabilities in the plugins. Even worse, attacks that are made to your site though any of the plugin files wont even be noticed or monitored by SecureDash. Its a massive flaw in the system, a gaping hole, that is easily exploited and that leaves you open to all kinds of potential problems even if you are using SecureDash as instructed. Let me give you a specific example:

I initially thought to test how good SecureDash works by putting the ‘security code’ on my own blog (this blog) and seeing if I could find any vulnerable points still. But I decided that doing that would not be a fair test since I know all about my own site so I would have an advantage. So what I decided to do is head over to a site that was owned by one of the other potential affiliates, and that had the ‘security code’ from the JV account I was given access to on it.

I knew nothing about the site when I went to it. The first thing I did was view the home pages source. From that I was easily able to see several plugins that the site was using. Within 30 second I found one that had a flaw in it. It was poorly designed and outdated and allowed me to browse its directory:

Its important to point out that I was also logged into SecureDash so I can see if the system was monitoring my activity. It indeed did register my IP address visiting the home page, but it did not know that I was remote browsing the plugins directory. It couldn’t know that, because it cant know anything that the site visitor does if its ‘security code’ is not present, and its code was only in the WordPress theme (and I was not in the WordPress theme).

From here I can poke around without SecureDash ever knowing it, and indeed I even used it to block my IP address, which prevented me from visiting the sites home page, but did absolutely nothing to prevent this remote access, from me manually going through the plugin directory’s or loading those files (again because its ‘security code’ was not present here). Now poking around is not totally terrible in itself, but there are some things I could do. For example if I wanted to launch a DDOS attack I could use a botnet (if I had one, Im not actually a hacker, but hackers do have them) to constantly request any of the files that I had unsecured access to, using up resources and causing server issues without SecureDash ever even knowing a thing. I could also download the plugins that I can see are installed on this site, look for security issues in them and exploit them without SecureDash ever knowing.

The problem stems from the fact that SecureDash can’t know anything about any file that does not have its code on it, and if you have a WordPress site there are going to be tons of files without its code. Truth be told though, even if you could (you cant, but if you could) make sure the SecureDash code was on every page of your site it still is little more than a monitoring tool and not really much of a ‘protection’ tool. From what I can see the only thing it can really do as far as protection is ban IPs and only from visiting pages / files that have its code on it. This is not something that is very useful given that you can ban IP’s from the entire site, all files, very easily in cPanel.

Over all I found SecureDash to provide a ‘facade’ level of security. Its like a $2 lock that you buy at the general store. It might make you feel good to have it, but its not really doing much at all to protect you. I personally would not spend my money on this and because of that I have no choice but to say:

 A quick note about the reviews I do on this site. The product vendors give me access to their products for free in order for me to do my review. However I make no promises to them regarding the results of my tests or what I will write in my review. Should you click a link that takes you to a sales page for a paid product for sale this link will be an affiliate link and I will be paid a percentage of the sales price should you decide to invest in it.

About the Author

Brett Rutecky

•  
•  

Brett Rutecky is a full time online marketer, web developer, and entrepreneur. He has developed scores of Facebook apps, dozens of custom web sites and hundreds of scripts.

More articles by Brett Rutecky »

• Related:
•  
• Reviews

 

 

 

 

 

StockDreams Review

 

 

 

 

 

NexusGPT Review

 

 

 

 

 

AI Staff Review