6 ms·

Very important that you develop complete confidence that there isn't anything wrong with your product. It's not uncommon, in fact it's very common, for compromi

Very important that you develop complete confidence that there isn't anything wrong with your product. It's not uncommon, in fact it's very common, for compromise kits for websites to take measures to avoid detection. A common one is only serving the malicious content when a specific referrer is present (I've seen this be Yahoo Search in the case of compromised Drupal installations multiple times, not really sure why). It might be wise to engage a security firm to conduct an investigation if you don't have in-house expertise in this area. You should definitely review logs carefully for any unusual inbound traffic. Sometimes looking up your own domain on services like virustotal can reveal the problem, as it might turn up samples of malware retrieved from your website. I say this because I have been involved in this exact situation multiple times: website flagged by some or other security service, website operator has no idea why and insists it is fine, website turns out to be serving the landing page of a major pharma scam campaign unnoticed by the website operator due to anti-detection measures.

golemiprague 4y ago
celestialcheese 4y ago
Hijacking for tangentially related question: > It might be wise to engage a security firm to conduct an investigation if you don't have in-house expertise in this area. Any good security firms you recommend for a small to midsize website?
- m3047 4y ago
  Do you practice know your customer (are you required to)? Is this shared hosting? Who runs the site? Who is responsible for security? What are your assets? Any other way(s) for them to be compromised? Where are your backups; did someone get ahold of those? What about all of the garbage that people pull in from the webs (and into their customer's browsers)? Do you know why fonts.google.com is controversial? Is some ad network participating in a watering hole attack? Got a chatbot on your payment page? Once you have a handle on that, you can start looking for answers. If that's too much to ask, then the time to start paring down your attack surface is before there are questions. Use hosting that provides such guarantees. Use an MxP. Don't keep customer information you don't need. What you quote is facile.
Jnr 4y ago
This is a good suggestion to check your system carefully. I have seen and investigated cases where malware runs for everyone except in certain locations or even excluding only the site operators. Look for weird scripts, includes, base64 decode and exec calls in your codebase/site.
lucb1e 4y ago
Should they then not just reply with "You're on the list because of the malware payload at <URL>"?
- abpavel 4y ago
  No, because they would cause the following scenario: Malicious attacker looks for exactly what Microsoft detected, and fixes each specific detection while keep operating the undetected ones. The end result would be operational malicious site, without being detected.
  - dtjb 4y ago
    The fact that Microsoft detected malware is already known, publicly.
  - deleted 4y ago
    [deleted]
  - salawat 4y ago
    So what? Just leave legit users in the dark because assholes exist? This type of logic needs to die. Assholes continue to exist because we enable them to by not raising the bar high enough that compromise is impractical, and no longer easy money.
    - from 4y ago
      People underestimate the extent to which a bunch of opaque "anti-abuse" algorithms control things. Everyone is given a risk score and if you exceed an internal threshold they will never respond to your support requests until your complaint gets on the HN frontpage. Then as justification to continue their pointless cat and mouse game the abuse department types will come in and say "well if we told you why we arbitrarily decided to <steal your money/delete your 20 year old email account/prevent you from logging in with a weird error message> then the real criminals would know how we detected them!"
  - Dylan16807 4y ago
codegeek 4y ago
In this case, Microsoft "SmartScreen" is a big culprit. Just google "microsoft smartscreen false positive". Tons of support forums on this including even some product companies explaining to their users on how to unblock because of false positives. It happened to some of our customers as well and it is very difficult to explain why we cannot do much except them asking to whitelist somehow or turning off this stupid thing.
- natch 4y ago
  Both can be true.
runjake 4y ago
This! I worked with a very well-known university that unknowingly had been compromised and was being flagged for malware by various protective services. They, assuming it was just a false positive, put up a banner at the top of their webpages that said they were falsely being flagged and that visitors should ignore any warnings and essentially shut off any protections for their website. Meanwhile their site was compromised and attempting to dump payloads onto visitors. Have you ensured you are not compromised?

golemiprague 4y ago

celestialcheese 4y ago

Hijacking for tangentially related question: > It might be wise to engage a security firm to conduct an investigation if you don't have in-house expertise in this area. Any good security firms you recommend for a small to midsize website?

m3047 4y ago
Do you practice know your customer (are you required to)? Is this shared hosting? Who runs the site? Who is responsible for security? What are your assets? Any other way(s) for them to be compromised? Where are your backups; did someone get ahold of those? What about all of the garbage that people pull in from the webs (and into their customer's browsers)? Do you know why fonts.google.com is controversial? Is some ad network participating in a watering hole attack? Got a chatbot on your payment page? Once you have a handle on that, you can start looking for answers. If that's too much to ask, then the time to start paring down your attack surface is before there are questions. Use hosting that provides such guarantees. Use an MxP. Don't keep customer information you don't need. What you quote is facile.

Jnr 4y ago

This is a good suggestion to check your system carefully. I have seen and investigated cases where malware runs for everyone except in certain locations or even excluding only the site operators. Look for weird scripts, includes, base64 decode and exec calls in your codebase/site.

lucb1e 4y ago

Should they then not just reply with "You're on the list because of the malware payload at <URL>"?

abpavel 4y ago
No, because they would cause the following scenario: Malicious attacker looks for exactly what Microsoft detected, and fixes each specific detection while keep operating the undetected ones. The end result would be operational malicious site, without being detected.
- dtjb 4y ago
  The fact that Microsoft detected malware is already known, publicly.
- deleted 4y ago
  [deleted]
- salawat 4y ago
  So what? Just leave legit users in the dark because assholes exist? This type of logic needs to die. Assholes continue to exist because we enable them to by not raising the bar high enough that compromise is impractical, and no longer easy money.
  - from 4y ago
    People underestimate the extent to which a bunch of opaque "anti-abuse" algorithms control things. Everyone is given a risk score and if you exceed an internal threshold they will never respond to your support requests until your complaint gets on the HN frontpage. Then as justification to continue their pointless cat and mouse game the abuse department types will come in and say "well if we told you why we arbitrarily decided to <steal your money/delete your 20 year old email account/prevent you from logging in with a weird error message> then the real criminals would know how we detected them!"
- Dylan16807 4y ago

codegeek 4y ago

In this case, Microsoft "SmartScreen" is a big culprit. Just google "microsoft smartscreen false positive". Tons of support forums on this including even some product companies explaining to their users on how to unblock because of false positives. It happened to some of our customers as well and it is very difficult to explain why we cannot do much except them asking to whitelist somehow or turning off this stupid thing.

natch 4y ago
Both can be true.

runjake 4y ago

This! I worked with a very well-known university that unknowingly had been compromised and was being flagged for malware by various protective services. They, assuming it was just a false positive, put up a banner at the top of their webpages that said they were falsely being flagged and that visitors should ignore any warnings and essentially shut off any protections for their website. Meanwhile their site was compromised and attempting to dump payloads onto visitors. Have you ensured you are not compromised?