6 ms·
Should they then not just reply with "You're on the list because of the malware payload at <URL>"?
by lucb1e 4y ago
Should they then not just reply with "You're on the list because of the malware payload at <URL>"?
- abpavel 4y agoNo, because they would cause the following scenario: Malicious attacker looks for exactly what Microsoft detected, and fixes each specific detection while keep operating the undetected ones. The end result would be operational malicious site, without being detected.
- dtjb 4y agoThe fact that Microsoft detected malware is already known, publicly.
- deleted 4y ago[deleted]
- salawat 4y agoSo what? Just leave legit users in the dark because assholes exist? This type of logic needs to die. Assholes continue to exist because we enable them to by not raising the bar high enough that compromise is impractical, and no longer easy money.
- from 4y agoPeople underestimate the extent to which a bunch of opaque "anti-abuse" algorithms control things. Everyone is given a risk score and if you exceed an internal threshold they will never respond to your support requests until your complaint gets on the HN frontpage. Then as justification to continue their pointless cat and mouse game the abuse department types will come in and say "well if we told you why we arbitrarily decided to <steal your money/delete your 20 year old email account/prevent you from logging in with a weird error message> then the real criminals would know how we detected them!"
- Dylan16807 4y agoIn the specific scenario where they're running multiple kinds of malware on the same site, they won't know which one got detected. Is that really something to worry about so strongly that we screw over legitimate websites? A malicious actor can already know exactly what's detected if they run one malware at a time per site.
- algoritmi 4y agoI believe they will if you use their vulnerability management offering it should come up with such details. We can not expect companies to give free security advice. Secondly, providing such info without consent might result in legal actions from not so smart companies.
- _8j50 4y agoHow does MS know they aren't hosting it on purpose? That might cause them to just change the malicious URL.
- bell-cot 4y agoActual bad guys, hosting $Evil on purpose, are extremely unlikely to need any "change the URL" hints.
- _8j50 4y agoThey don't need one but having one maximizes campaign life.
- BoorishBears 4y agoHow on earth does it do that? If I put malware at xyz.com/mybadpage and MS starts flagging xyz.com, how on earth do I "maximize campaign life" by being told xyz.com/mybadpage has malware?
- krisoft 4y agoImagine that you have put malware in xyz.com/mybadpage1, xyz.com/mybadpage2, and xyz.com/mybadpage3 pages. MS flags you, and you query MS. They tell you they see malware on the first two urls. Now you gained information about their blindspots. You can capitalise on this multiple ways. You can remove the first two and hope they remove the flag. You can design your next attack better so it is more like mybadpage3. Etc
- bell-cot 4y agoDisagree: $Evil_Site_Owner can easily test MS's blind spots by putting malware on numerous web sites, then seeing which of those sites are flagged. And if MS is not systematically scanning all the URLs...well, "MS failed to notice malware at $URL, which my web server logs say MS has not visited" is pretty useless information. (Not that I think MS should enumerate malicious URL's, unless $Site_Owner is paying for scanning service. A "we noticed malware at $URL" is generally 95% of the possible value of such disclosures.)
- burnished 4y agoJust a guess, but I think they don't want to serve as an oracle for the people whose malware they are trying to block. Not saying that isn't shit or frustrating.
- tomxor 4y ago> don't want to serve as an oracle for the people whose malware they are trying to block Those people don't have a registered business; The people contacting Microsoft do. There are probably a bunch of excuses we can come up with that would make sense... but I think most people know the real reason, it's the same as with Google and Apple... they don't do customer support, and they don't take responsibility for any negative effects their services might have on others, at least not until someone big enough makes a fuss or lawyers get involved.
- deleted 4y ago[deleted]
- inetknght 4y ago> Those people don't have a registered business; The people contacting Microsoft do. I don't think you understand how sophisticated malware distribution can be. There's absolutely nothing stopping a "legitimate business" from distributing malware.
- IshKebab 4y agoHe's not saying there is. He's saying that it's pretty unlikely that the malware authors are going to phone Microsoft and ask why their site is flagged, so putting in some reasonable road blocks that a legitimate business would definitely jump over (e.g. talking to real people) would be plenty to remove the oracle issue.
- burnished 4y agoThey don't? How do you know? Having one seems like it would be a real benefit.
- 4y ago
- jcrawfordor 4y agoshould? probably. But I also get, from a capitalist perspective, why they don't: they probably get enough "we swear our website is actually fine" tickets each day that they would need a sizable dedicated team to offer that kind of assistance. I don't think any of the browser vendors, Google and Mozilla included, will go to any real effort to help the reporter. At least I haven't seen them do so. I think they take the view, and I don't totally blame them, that securing your website is your problem, and they aren't going to offer security consulting for free.
- lucb1e 4y agoThey're already checking where the malware is when reviewing a report or unlisting request. The email template would need exactly one value: the URL they found. Likely they already store this info somewhere so that the next time anyone reviews the domain, the reviewer cannot overlook it. In that case, the system could be completely automated, sending the info to the hostmaster or tech-c of the domain or something.
- counttheforks 4y agoIf they provided proof they wouldn't get "we swear our website is actually fine" tickets. Or if they did, it would be easy to resolve them: Post the proof. If you launch a product that targets other businesses and has the capability of destroying them, you better take responsibility for that.
- 300bps 4y agoIn this case, that sure would be helpful. Now imagine that you're running a website that is intentionally trying to trick people into installing malware. You've successfully evaded tools like Smart Screen but now you've ended up on the list. You're not sure which one of your virus payloads set off their screen so you open a ticket. And Microsoft is supposed to tell you exactly how to get off their list again?
- izacus 4y agoYes, Microsoft should. Because hunting for shit people shouldn't be an excuse to hurt innocent people ever. Just like you shouldn't be beaten by the cops without knowing a reason for it.