Hacker News new | ask | show | jobs
by _8j50 1400 days ago
MS is already stopping the bad guys by blocking the domain. You are supposed to do proper IR and clean up after yourseld including finding out the cause of the compromise which MS can't help with. What happens in the real world is people delete the file or webshell and think the bad guys are gone and if MS unblocks them then the campaign continues.

Or the bad guys themselves do that pretending to be the site owner. MS analysts can only inspect the normal site and the malicious URL that has now been removed in order to unblock it.

This is how abuse and IR works, I am surprised at the naivette of the responses here.
1 comments
ascar 1400 days ago
What are you even talking about? What is IR?

What happens is a website is blocked and the site operator has no idea why. The defense of "we can't share any information as to why you got punished as it might help bad actors avoid punishment" should not be an acceptable stance. It's the equivalent of being thrown to prison without due process and just ignoring false positives. It's a very "natural" way of acting, but that does not make it the right one.

link
_8j50 1400 days ago
IR is incident response, it means you find out everything the bad guys did and how it was compromised and fix it all. You should contact a security company or professional to help you if you don't know. I have used the webshells of compromised sites where the owner tries to cleanup but the webshell is still there hosting different campaigns.

You should secure your site better and have someone who knows what they are doing (there are paid WAF and web security vendors) monitor and respond to security incidents. You are not being punished, MS is protecting its customers. You should blame the hacker not MS for the impact of the hack. It's like someone messed with your car tank and tires and the police stop you from driving it because it is unsafe to other drivers, they are not punishing you but protecting other people from being hurt by your property.

link
noAnswer 1400 days ago
> It's like someone messed with your car tank and tires and the police stop you from driving it because it is unsafe to other drivers, they are not punishing you but protecting other people from being hurt by your property.

The police says why they stopped you though! Which implies what you have to change in order to be able to drive again. They will not say "you have to figure it out on your own or the guys who messed with your car would have it more easy."

link
_8j50 1400 days ago
Yes, because the police serve you but MS serves its customers and even the police will not diagnose your car for you, they might say "we see gas leaking, stop driving" but they won't tell you if the fuel line, tank, injector,etc are responsible. MS's block is for MS customers not the public, MS also is not the only vendor that does this, there are dozens of vendors that provide domain reputation services like this to their customers. MS can block random sites and is their right, if you disagree stop using edge and use firefox maybe.
link
LawTalkingGuy 1400 days ago
> MS can ___ and is their right, if you disagree stop using ____.

This is a pretty weak position to fall back to.

MS is disparaging their business and is trying to make themselves unaccountable. And they aren't customers so they have nothing to walk away from.

link