Malware Measures & Vulnerabilities

How we fixed a Malware Infected Site - True Customer Story

 Email Article |  Twitter |   LinkedIn 

Malware Infection, Cleanup and Vulnerability Analysis and Consulting Services…

ALERT: TRUE STORY BELOW..

Want to understand how simple it is to secure your site?  Sure, we’ll take a real customer example from this week to document the story.

(Names and Certain Elements removed to protect confidentiality)

Context:

Large financial news information site that was recently infected several times.  Running an older (but not so old) version of WordPress.  Established site, running for years, great following.

Attacks:

Several different approaches, including a desktop infection, which then infected the site.  Infections spread internally from there.

Impacts:

Malware was being distributed to its 2000+ unique viewers a day.  Due to the depth of the attack, google has reindexed the site with all of the pornographic and male-enhancement site links, meta tags, etc.  Effectively, the site (and business) is in bad shape, SEO results are suffering.

The Approach:

Customer signed up for a free scan, which resulted in the 1st metric on the chart below (roughly 1,640 High and Medium Vulnerabilities)  – Keep in mind, this is a fairly large site.

The customer took the recommendations and executed some of them (upgrading Wordpress being the first).  After contacting our support group, we went through the rest of the report, and summarized the findings, and recommendations.

Luckily the Malware Alert Attack Site! flags have been removed from most browsers..

Conclusion:

As a result, we’re now down to 2 high severity issues, and about 70 medium severity.  Direct Malware injections were removed.  Now we’re going through the last steps to remove the last stragglers of the infection,  (some things are set to reinfect after removal, etc.), and CLOSE THE DOORS on the site.

We’ll wrap up the work in a day or so, and the customer will be free from the existing hacks, and we will be monitoring his site on a daily scan basis (for both vulnerabilities and Malware) for the next few months.

Actual Screenshots from the Reporting Tool @ SiteSecurityMonitor.com
 

Total Issues: Below are the issues detected on this scan, and the last scan.

 Latest scan ( 2009-12-03 xxxxxx AM )

Malware Survey Data - customer perspective

 Email Article |  Twitter |   LinkedIn 

One big thing that is missing from this industry is empirical trend data that supports the TRUE risks and costs associated with hacking and malware infections. To date, we’ve written quite alot about customer-specific impacts when they are infected… The ‘results’ run the gambit of 1000’s of dollars of losses over time, loss of SEO rank, customer reputation, etc. However, one part that has been missing is the true impact around the realm of supporting actors in these instances.

For example, if there is a site that is infected with a simple malware redirect. Instead of only looking at the impacts directly to the website owner (which are onerous enough!), we’re starting to look at the impacts to the service providers for that customer.

It's not just the webhoster. It's the affiliates for that site that may lose sales. It's the adnetwork that is presented on that site that receives negative feedback for the ads being present on an infected site. It's the content readers that also receive the infection, or are impacted by the reduction in traffic. It's the direct advertisers that are affiliated with the website, that are now also negatively impacted on either/or image, reputation or traffic perspectives.

So we here at SSM are undertaking a small series of end-user surveys (specifically those that were impacted) about their total ‘experience’ with the solution. Questions like: Who did you call first? How were you told? Did your SEO rankings take a hit? Was your webhoster helpful? Did you switch hosts/designers/products based on the infection. What other steps have you taken, etc.?

Thus far (early in our survey), some interesting facets have already arisen.

Primarily:

1) Clients learned of their defacement primarily through their customers or colleagues. Because they don’t regularly monitor their site, they had no idea that they were infected.
2) Their web host provider was NOT helpful, not beneficial during the resolution process. Surprisingly enough, only a small percentage ’switched’ providers due to this.
3) Google was their main source of information on this issue, but the information was confusing, not really related, and generally was unhelpful overall.

We will be publishing more results as the data becomes more solid. We are still running the survey, so if you (or someone you know) went through this very personal hell, please forward them this survey link URL: http://surveys.verticalresponse.com/a/show/527087/2a7f185d4a/0

(securely hosted by vertical response – anonymous is ok too!)
-Jason

Malware Scanning - Customer Scenario

 Email Article |  Twitter |   LinkedIn 

Malware…  Yes, its been around for many years.  However the attack vector has changed.  Long ago the primary distribution method was by sharing dirty data (yes, exchanging floppy disks….remember those days?!

Then it went onwards into distributing viruses and malware via email (this is the early days of outlook express!).  Then, came the solutions to block this (antivirus on your email, desktop solutions that block installs on your PC, etc.)

Now however, it is much more sophisticated.  As unfortunately some of you have experienced, the hackers are now cracking PCs and websites to inject malware.  Hence the term ‘drive-by malware’.  By infecting your website the hackers are now able to enjoy a free distribution method for their wares – your website.  Target any sized website, inject your bad code, and watch the infections grow by the minute!

Consider this scenario…  we have a customer who came to us (name not mentioned of course), that had been injected my malware.  The alerts went up in Google HQ.  His site was dropped from search engine rankings immediately.  So, boom – there goes all of his google traffic (in this case, responsible for about 2,000 unique visitors a day).

Worse yet, now that Google was aware to his sites problems, the browser vendors now pick up on this and start warning ALL people visiting his site with this nice little alert:

Malware Reported Attack Site

So now, he has -0- traffic from Google.  ALL of his users are now getting told this is ‘an attack’ site.  All bookmarked entries, links from other sites, etc. ALL reflect that this site is now worse than the worse of worse!  You are evil!  You are spreading the scourge of the earth!  How could you!

Now, this guy is in a panic.  He’d just started a major campaign (offline and online), and had paid for alot of advertising that was non refundable.  He was loosing 1000’s of dollars a day, and his business was evaporating before his eyes.

Personnally, I don’t like to scare monger my customers into solutions.  I think it is a disservice that many of our competitors do.  However, I do like to highlight true to life stories, and their true impacts.

In this case, we were able to quickly shut down his site to stop the spread.  Taking the site offline also minimized any infections he was spreading (because, in reality, he was).  After stripping out the hacked code, we scanned all of his site (100’s of pages) and plugged up any holes the web vulnerability scanner found (there were more than one in his shopping cart and forum systems).  Turns out, some of the lovely little hit counters and subscriber forms he had on his site were wide open as well.

Anyways, after the cleanup, and a few runs through our malware scanner to ensure we were clean, we stood the site backup and asked please, please please! Google, please allow his site to be back in your good graces…

After about 36 hours, Google’s scanners had verified that he was now indeed clean, and reincluded him in the indexes.  Luckily, since we caught it quick enough, this did not affect his PR rankings and his SEO work he’d invested so much into was saved.

Now, the browser alerts were another problem.  Firefox released their warnings within a few hours of Google.  Microsoft IE shortly thereafter.  Safari and a few other smaller footprint browsers took a few days.

All in all, this attack cost him well over $10,000 in immediate losses due to his PPC campaign and offline media buy losses.  Of course, now he had a perception problem with his customers (yes you are safe, no I’m not a hacker, etc.), and on top of that, one very long, long weekend on the phone with customers.

How to protect from these effects?  Well, since nothing is 100%, regular scanning is your best defense, since you’ll know before the hackers do that there is a problem with your site.  Even more important, since we now test each and every URL on your site with over 120,000 attack patterns (yes, that many!), you are getting great coverage and risk mitigation from the standpoint that you know more, on a daily basis, about what the outside knows about your site.

This, all told, allows him to sleep better at night