[jcrawfordor]

Very important that you develop complete confidence that there isn't anything wrong with your product. It's not uncommon, in fact it's very common, for compromise kits for websites to take measures to avoid detection. A common one is only serving the malicious content when a specific referrer is present (I've seen this be Yahoo Search in the case of compromised Drupal installations multiple times, not really sure why). It might be wise to engage a security firm to conduct an investigation if you don't have in-house expertise in this area. You should definitely review logs carefully for any unusual inbound traffic. Sometimes looking up your own domain on services like virustotal can reveal the problem, as it might turn up samples of malware retrieved from your website.

I say this because I have been involved in this exact situation multiple times: website flagged by some or other security service, website operator has no idea why and insists it is fine, website turns out to be serving the landing page of a major pharma scam campaign unnoticed by the website operator due to anti-detection measures.

[runjake]

This!

I worked with a very well-known university that unknowingly had been compromised and was being flagged for malware by various protective services.

They, assuming it was just a false positive, put up a banner at the top of their webpages that said they were falsely being flagged and that visitors should ignore any warnings and essentially shut off any protections for their website.

Meanwhile their site was compromised and attempting to dump payloads onto visitors.

Have you ensured you are not compromised?

[lucb1e]

Should they then not just reply with "You're on the list because of the malware payload at <URL>"?

[burnished]

Just a guess, but I think they don't want to serve as an oracle for the people whose malware they are trying to block.

Not saying that isn't shit or frustrating.

[tomxor]

> don't want to serve as an oracle for the people whose malware they are trying to block

Those people don't have a registered business; The people contacting Microsoft do.

There are probably a bunch of excuses we can come up with that would make sense... but I think most people know the real reason, it's the same as with Google and Apple... they don't do customer support, and they don't take responsibility for any negative effects their services might have on others, at least not until someone big enough makes a fuss or lawyers get involved.

[inetknght]

> Those people don't have a registered business; The people contacting Microsoft do.

I don't think you understand how sophisticated malware distribution can be.

There's absolutely nothing stopping a "legitimate business" from distributing malware.

[IshKebab]

He's not saying there is. He's saying that it's pretty unlikely that the malware authors are going to phone Microsoft and ask why their site is flagged, so putting in some reasonable road blocks that a legitimate business would definitely jump over (e.g. talking to real people) would be plenty to remove the oracle issue.

[burnished]

They don't? How do you know? Having one seems like it would be a real benefit.

[Dylan16807]

Saying they detected malware already does that.

Being slightly more specific shouldn't be a problem.

[dylan604]

Sure, maybe not display it in the publicly visible warnings, but if the admins of a domain email you from the same domain as the flagged site, then maybe providing more detail at that point is an acceptable method of fixing the issue.

Saying "we know you are compromised and know exactly where, but we're not going to tell" is very childish. Now, if they said for a nomial fee, we'd be happy to share the results of our work, would be another thing totally.

[dathinab]

"we know you are compromised and know exactly where, but we're not going to tell"

The sad think is they didn't even tell that, they gave the admins no ways to be able to differentiate between:

- we don't care if we destroy your company with a false positive and

- we are sure we are right, if you didn't do it intentionally you are probably compromised

[justsomehnguy]

TXT DNS records are used by Google, Microsoft and LE exactly for this purpose.

[dylan604]

Not sure what you are saying here. I've only ever used TXT DNS records by copying&pasting whatever the original certbot told me to do or when setting up custom domain with 3rd party email. I have no idea what they do, who can read them, when, where, why, etc.

Are you saying that if you have this info correctly set up, these companies can verify your email domain is the same to provide assistance? What does law enforcement do with this info?

[ben174]

Except that it could help attackers beefen up their tools. A certain amount of obscurity is good to keep the attackers from having too much information.

I've been in the situation where a company kinda 'ghosts' me before. And found out I was indeed the bad player (unintentionally, of course).

[300bps]

In this case, that sure would be helpful. Now imagine that you're running a website that is intentionally trying to trick people into installing malware. You've successfully evaded tools like Smart Screen but now you've ended up on the list.

You're not sure which one of your virus payloads set off their screen so you open a ticket. And Microsoft is supposed to tell you exactly how to get off their list again?

[izacus]

Yes, Microsoft should. Because hunting for shit people shouldn't be an excuse to hurt innocent people ever.

Just like you shouldn't be beaten by the cops without knowing a reason for it.

[_8j50]

How does MS know they aren't hosting it on purpose? That might cause them to just change the malicious URL.

[iforgotpassword]

If you're hosting it on purpose, then you already know that it's the culprit and would've tried to change it anyways. I don't really see a scenario where telling the person who opened the ticket what the issue is would weaken the security measures or detection strategy.

[_8j50]

That's not what is being said here, the domain is blacklistes and my comment was about MS not the bad guy telling the site owner the malicious URL. If you tell them the URL, they will change it and claim it was a compromise so they can increase campaign lifetime.

[BoorishBears]

... MS is telling everyone that the root domain is on a black list. A malicious actor doesn't need more than that, they already know the exact URL that malware resides at.

A non-malicious actor doesn't know, so telling them the exact URL at least tells them where the compromised asset might be.

[_8j50]

Yes a malicious actor needs more than that because compromised domains are valuable and keeping them alive longer means more money...

A non-malicious actor who needs the URL isn't monitoring or responding to the incident properly. Threat actors do take advantage of this and simulate a fake cleanup. Actually they exclude certain ips and asns on phishing kits so that visiting the url gives you a 404 or a webhosts "cleanup" page.

[abpavel]

Easy. Scenario: Malicious attacker looks for exactly what Microsoft detected, and fixes each specific detection while keep operating the undetected ones. The end result would be operational malicious site, without being detected.

[_8j50]

That's exactly what I am saying...

[bell-cot]

Actual bad guys, hosting $Evil on purpose, are extremely unlikely to need any "change the URL" hints.

[_8j50]

They don't need one but having one maximizes campaign life.

[BoorishBears]

How on earth does it do that?

If I put malware at xyz.com/mybadpage and MS starts flagging xyz.com, how on earth do I "maximize campaign life" by being told xyz.com/mybadpage has malware?

[krisoft]

Imagine that you have put malware in xyz.com/mybadpage1, xyz.com/mybadpage2, and xyz.com/mybadpage3 pages. MS flags you, and you query MS. They tell you they see malware on the first two urls. Now you gained information about their blindspots.

You can capitalise on this multiple ways. You can remove the first two and hope they remove the flag. You can design your next attack better so it is more like mybadpage3. Etc

[_8j50]

You move it to xyz.com/anotherbadpage and tell MS it has been cleaned up. They do this all the time. Speaking from first hand experience. This is a very simple topic, why are there so many people not understanding this?!

[lucb1e]

I considered that but it didn't seem logical. If it's on purpose, it would be trivial to change the URL and then go "ok it's clean now please remove the flag"

How does keeping secret (from the bad guys) where the malware is thwart the bad guys?

[_8j50]

MS is already stopping the bad guys by blocking the domain. You are supposed to do proper IR and clean up after yourseld including finding out the cause of the compromise which MS can't help with. What happens in the real world is people delete the file or webshell and think the bad guys are gone and if MS unblocks them then the campaign continues.

Or the bad guys themselves do that pretending to be the site owner. MS analysts can only inspect the normal site and the malicious URL that has now been removed in order to unblock it.

This is how abuse and IR works, I am surprised at the naivette of the responses here.

[ascar]

What are you even talking about? What is IR?

What happens is a website is blocked and the site operator has no idea why. The defense of "we can't share any information as to why you got punished as it might help bad actors avoid punishment" should not be an acceptable stance. It's the equivalent of being thrown to prison without due process and just ignoring false positives. It's a very "natural" way of acting, but that does not make it the right one.

[_8j50]

IR is incident response, it means you find out everything the bad guys did and how it was compromised and fix it all. You should contact a security company or professional to help you if you don't know. I have used the webshells of compromised sites where the owner tries to cleanup but the webshell is still there hosting different campaigns.

You should secure your site better and have someone who knows what they are doing (there are paid WAF and web security vendors) monitor and respond to security incidents. You are not being punished, MS is protecting its customers. You should blame the hacker not MS for the impact of the hack. It's like someone messed with your car tank and tires and the police stop you from driving it because it is unsafe to other drivers, they are not punishing you but protecting other people from being hurt by your property.

[m3047]

I live in the USA. Victim blaming "they did something to deserve it" is at best unethical. In court theoretically I would have the right to demand to see evidence. "Hold my beer" is not likely to be sufficient except in egregious circumstances.

With that said, there is an epidemic of muppet thinking right now. It's not just the intertubes. Suppose a credit card company pulls your credit report because they say you applied for credit with them. No funds are stolen. You demand they show proof. They say nope, because TTPs. So: how do I know it's a one-off, and not data theft by fraud at scale? Off goes a letter to the FTC...

Do you think like a muppet? Here is satirical example (http://athena.m3047.net/temporizing.html):

    TEMPORIZING FOUND NOT TO BE A FORM OF LYING
    
    "Temporizing", which is speculating from what we know now as to the
    motives of actors in the past and presenting that as historical fact,
    has been found not to be a form of lying. "Social proof demonstrates
    that temporizing is not lying" said a social commentator.
    
    The news was greeted optimistically as a good day for humanists and
    levels the playing field because "now the standards of proof we need
    to meet for the existence of society are the same as for religion".
    
    "People must have known about this in the past because it seems
    like they should have" said a man in the street. "Everybody who
    believes in science trusts society" said another.

[_8j50]

I have no idea what your post is about but from MS's perspective it isn't the site owners but MS's users around the world that are victims of thr threat actor that need protection. If it truly is a compromised site then the site owner is also a victim but as owners it is also their duty to secure and cleanup their site that is currently endangering the public.

[salawat]

Microsoft is not the Guardian of the World. If they take it upon themselves to act as such without being a responsible Netizen (cooperating with other site operators to provide a higher quality Net) then they are more interested in cementing their own position rather than being a part of a civilized Net.

Imagine if I just suddenly started spreading around rumors of your malfeasance and shadyness, and untrustworthyness.

It's a big deal.

[_8j50]

They are not guarding the world but their windows users that don't use chrome but edge and IE (MS browsers) in this case, google and firefox also do this by default.

Leave it to HN to get me to defend even MS lol.

[m3047]

If it truly is a compromised site then the site owner needs to clean it up; but starting the sentence with "If.." doesn't make it so.

Alex Pinto's classic research into the (lack of) overlap among threat indicator feeds should be a shot across the bow; I worked with threat indicators for a decade. To fend off muppet thinking I would like to remind everybody that they're selling threat indicator feeds; nobody that I know of sells not-a-threat feeds. A false positive means a site was falsely reported as a threat [sp]; a false negative does not mean that it is good, it simply means it is omitted from the list of threats.

In my experience vendors are a lot more worred about false positives than dropping something which is a threat on the floor (false negatives in context). However, moral hazard pushes them to publish things which turn out to be false positives anyway, because at the end of the day they're selling FUD.

My network, my rules. Something doesn't have to be a threat for it to be blocked from a private network in my opinion; there are lots of reasons for that, including minimizing potential threats. Something could be hosted on stinky infrastructure, but it's unknown or hasn't been demonstrated to be a threat. Profiles for operational security vary, and so does the appetite for proactively blocking (and whitelisting necessary resources): just because it's legal doesn't mean it doesn't put me at a competitive disadvantage if people know what I'm doing. I have no problem with people sharing and discussing such indicators, but there has to be attribution to the sharer: they have a reputation to be considered with equal concern as that of the indicators they publish.

If you're going to do something public with such information, you can't point fingers at "AI" and indicators you found in a paper bag on the bus: you do that, then you own it. Saying the victim deserves it is something you'd better be prepared to defend in court.

[ranger_danger]

In many of these extreme cases where it's non-obvious what is wrong, the victim IS often the one responsible.

Example: Viral video shows police pulling unarmed (and allegedly innocent) suspect out of a parked car that sparks outrage. It's later found out that the victim was previously evading police pursuit just minutes before, and was trying to blend in with the other cars in a lot.

[abpavel]

No, because they would cause the following scenario: Malicious attacker looks for exactly what Microsoft detected, and fixes each specific detection while keep operating the undetected ones. The end result would be operational malicious site, without being detected.

[dtjb]

The fact that Microsoft detected malware is already known, publicly.

[salawat]

So what? Just leave legit users in the dark because assholes exist? This type of logic needs to die. Assholes continue to exist because we enable them to by not raising the bar high enough that compromise is impractical, and no longer easy money.

[from]

People underestimate the extent to which a bunch of opaque "anti-abuse" algorithms control things. Everyone is given a risk score and if you exceed an internal threshold they will never respond to your support requests until your complaint gets on the HN frontpage. Then as justification to continue their pointless cat and mouse game the abuse department types will come in and say "well if we told you why we arbitrarily decided to <steal your money/delete your 20 year old email account/prevent you from logging in with a weird error message> then the real criminals would know how we detected them!"

[Dylan16807]

In the specific scenario where they're running multiple kinds of malware on the same site, they won't know which one got detected.

Is that really something to worry about so strongly that we screw over legitimate websites?

A malicious actor can already know exactly what's detected if they run one malware at a time per site.

[algoritmi]

I believe they will if you use their vulnerability management offering it should come up with such details.

We can not expect companies to give free security advice. Secondly, providing such info without consent might result in legal actions from not so smart companies.

[jcrawfordor]

should? probably. But I also get, from a capitalist perspective, why they don't: they probably get enough "we swear our website is actually fine" tickets each day that they would need a sizable dedicated team to offer that kind of assistance. I don't think any of the browser vendors, Google and Mozilla included, will go to any real effort to help the reporter. At least I haven't seen them do so. I think they take the view, and I don't totally blame them, that securing your website is your problem, and they aren't going to offer security consulting for free.

[lucb1e]

They're already checking where the malware is when reviewing a report or unlisting request. The email template would need exactly one value: the URL they found.

Likely they already store this info somewhere so that the next time anyone reviews the domain, the reviewer cannot overlook it. In that case, the system could be completely automated, sending the info to the hostmaster or tech-c of the domain or something.

[counttheforks]

If they provided proof they wouldn't get "we swear our website is actually fine" tickets. Or if they did, it would be easy to resolve them: Post the proof.

If you launch a product that targets other businesses and has the capability of destroying them, you better take responsibility for that.

[codegeek]

In this case, Microsoft "SmartScreen" is a big culprit. Just google "microsoft smartscreen false positive". Tons of support forums on this including even some product companies explaining to their users on how to unblock because of false positives. It happened to some of our customers as well and it is very difficult to explain why we cannot do much except them asking to whitelist somehow or turning off this stupid thing.

[natch]

Both can be true.

[Jnr]

This is a good suggestion to check your system carefully.

I have seen and investigated cases where malware runs for everyone except in certain locations or even excluding only the site operators.

Look for weird scripts, includes, base64 decode and exec calls in your codebase/site.

[celestialcheese]

Hijacking for tangentially related question:

> It might be wise to engage a security firm to conduct an investigation if you don't have in-house expertise in this area.

Any good security firms you recommend for a small to midsize website?

[m3047]

Do you practice know your customer (are you required to)? Is this shared hosting? Who runs the site? Who is responsible for security? What are your assets? Any other way(s) for them to be compromised? Where are your backups; did someone get ahold of those?

What about all of the garbage that people pull in from the webs (and into their customer's browsers)? Do you know why fonts.google.com is controversial? Is some ad network participating in a watering hole attack? Got a chatbot on your payment page?

Once you have a handle on that, you can start looking for answers. If that's too much to ask, then the time to start paring down your attack surface is before there are questions.

Use hosting that provides such guarantees. Use an MxP. Don't keep customer information you don't need. What you quote is facile.