5 ms·
This is quite ironic because I used to work in the security team at GoDaddy, writing tools to scan and clean websites infected with malicious code injected the
by guessmyname 8y ago
This is quite ironic because I used to work in the security team at GoDaddy, writing tools to scan and clean websites infected with malicious code injected the same way. To find out that the company is using the same technique (for something less malicious?) is very surprising to me. I guess they never asked for a review of this feature to the security team, otherwise I doubt they would have approved it.
- sk5t 8y agoThe very notion that GoDaddy could be in a position to "clean" websites of malicious code is--what's the word?--stupefying? profoundly unsettling? mystifying?
- Wintereise 8y agoWhy? For those of us who've worked in hosting, it's a routine thing that you help customers do every day. At their scale, trying to automate it hardly seems surprising.
- bpchaps 8y agoCould you give an example of when a customer would need that? I'm missing something.
- gscott 8y agoA lot of SQL injections are malicious ad scripts that will be named the same on each hack. It would be pretty easy to remove something like that as it passes back through Godaddy's router. I would hope they notify the website owner because otherwise you wouldn't know that you have a problem.
- guessmyname 8y agoIf a customer’s website is being hosted in a shared account, the infection will quickly spread across the other websites in the same server unless the hosting provider takes the matter in their own hands. Years ago, it was common to simply suspend the infected website until the webmaster finished the cleanup by themselves. Nowadays, instead of suspending a website for a minor infection, some hosting providers simply clean the malicious code automatically, or offer a premium cleanup service if the infection is more complex.
- thaumaturgy 8y ago> If a customer’s website is being hosted in a shared account, the infection will quickly spread across the other websites in the same server unless the hosting provider takes the matter in their own hands. Not at any professional hosting service. It's not hard to secure the environment so that it'll take a classier attack than guessing somebody's WP login to get access to any other sites on the host. The actual problem for hosting services is that compromised sites can be used to annoy visitors or other hosting services. edit: okay, I don't care about the points, but I'm getting really curious why people disagree with this.
- ggggtez 8y agoMost hosting providers don't want to host malware, as it's against their terms. Instead of banning an account, trying to identify affected customers proactively sounds reasonable. Injecting your own code in their site does not.
- thaumaturgy 8y agoI can't tell if you're trying to respond to me, or just making a public service announcement. In any case, yes, I agree.
- perennate 8y agoI agree. If it's possible for the infection to "spread across the other websites in the same server", then that implies that clients can access and modify each other's files, which is not the case with any shared hosting provider I've heard of. What is more plausible is malicious server-side code eating up server resources, and that load impacting the websites of other customers, but that has its own solutions which are different from automated detection of malicious JavaScript code.
- thaumaturgy 8y agoMost of the compromises I've dealt with over the years fall into just a handful of categories: 1. Data theft. So, ripping off a database or intercepting credentials while people log in. 2. Embed a link into page output which will try to download something from somewhere somehow. It might be phishing, or (usually) it's some kind of JS trying to infect the user with malware. Lazy attacks work by just popping up a convincing-enough warning message with a link that lets the user download the malware themselves, and it's effective enough. 3. Credit card theft. Using a third party service with iframes makes this harder, but not impossible. 4. Dropping some kind of web-based shell, like C99. #1 doesn't get anybody to care. If that's all that ever happened, I'm pretty sure shared hosting providers would still be saying, "sucks to be you." #3 causes headaches for the site owner and makes them care, but still not the hosting provider. #2 got the hosting providers' attention once Google launched Safe Browsing. Suddenly this put some of the responsibility for maintaining a safe network back onto the hosting providers. Their first solution was to just shut down sites discovered to have malicious code, but that really irritated the customers. So gradually hosting providers started trying to be a little more helpful. #4 is a big headache for hosting providers, because those things don't get picked up automatically by Google, and the shells can be used to irritate other hosting providers, who will definitely start lodging complaints with whoever's upstream of the hosting provider. Not on this list is, "try to infect other sites on the same server", because shared hosting environments have had easy access to a variety of tools for a long time now that prevents that. In a LAMP environment, that used to include SuexecUserGroup; more modern LAMP environments now use php-fpm and have PHP processes running from distinct unprivileged user accounts. There's also the usual php.ini values, like open_basedir, which limit access to the filesystem or to other PHP functions (allow_url_fopen). I won't say it's impossible for an infected site to attack another site on the same server in a shared hosting context, but you'll need a get-out-of-jail card and those are harder to come by. No professional shared host would allow one site to access or modify another site on the same server.
- jedieaston 8y agoIf someone takes control of their website and puts malicious stuff on there, GoDaddy being able to ask the customer “Hey, did you mean to do that?” and helping them roll it back is handy.
- JChase2 8y agoWordpress plugins get injected with crap all the time, same with joomla, pretty much any site running a super old php version with their CMS, etc.
- bpchaps 8y agoIs this common in web hosting? I'd be pretty livid if my web host was modifying traffic, regardless of the intent.
- JChase2 8y agoI work for a competitor and we definitely do not do this, so I don't think it's ubiquitous at any rate.
- joecool1029 8y agoIt's not unheard of. Some platforms offer New Relic RUM integration which breaks shit (like XML sitemaps). I am guessing the hosting provider gets access to the information the client also gets, but that's just a guess without any evidence. It would just make sense in the absence of regulation.
- icdsoft 8y agoThis is something absolutely unthinkable in our company. However, we have heard of other providers using similar tactics in the past, so always do your research before trusting a provider with your website.
- pas 8y agoThere used to be a lot of web hosting companies that offered free hosting and injected their ad frame.
- user5994461 8y agoIt's very common with features like A/B testing, analytics, advertising and CDN. This should be inserted by the customer instead of filtering traffic, but not necessarily. It's very user friendly to only have a button to turn something on or off.
- sulam 8y agoIt’s pretty surprising to me that they could ship a feature like that without an enforced review by security and probably several other teams (legal and pr come to mind immediately).
- ShakataGaNai 8y agoLast time I got a "your site is infected with malware" alert from GoDaddy...it was for a domain parked with GoDaddy.