Report each domain to the major browser vendors so they can update their list of suspicious sites?
I believe the default configuration for suspected spam and phishing and other malicious sites is that the user gets a red warning page that they have to click through first. Website owner would either get notifications from users or notice the drop off in traffic?
I run a website where people can upload files. Not everyone uploads nice files. Every time someone downloads such a file from my site with their antivirus enabled, it's now my problem to discover which fifteen block lists the whole domain has newly been put on. People don't treat big tech this way; you don't think "oh, there's malware on Github, let me just report github.com as a suspicious website that nobody should be able to visit anymore"
The correct answer is probably the abuse contact shown in the WHOIS data. That's programmatically accessible and thus scales
Unpopular opinion, but I think that any website owner accepting uploads from strangers should bear responsibility for those uploads. You cannot just say "not mine, I just distributed it".
UPDATE: Unpopular because it means there's a lot of work for the owner to moderate the files. And large sites like facebook are notorious for very bad moderation. It's not like we mandate them to hire N moderators per M users.
I'd be fine if that were the law. What really frustrates me is the double standard where I can't host something that Microsoft or Wetransfer can without repercussions
When running an actually competent LLM is as cheap as a $10/mo cloud server (for the moderation), I'll actually agree with this sentiment. Probably wont be unpopular long beyond that point in time.
There's a middle ground for this though. Platforms like Youtube, Facebook, etc, have no excuse anymore. They can literally scan with these models they have available and handle it. So write the legislation based on their capacity so you don't screw the one dude just trying to support some indie game devs in a small community or something.
Usually the file is already gone by the time they finished reporting it, but otherwise delete and ban the uploader if it's a valid report. Criminals don't seem to use my site for malware spreading, though, because all uploads expire after a number of hours. Much better to put it somewhere that's stable until the victim clicks on it, like Google Drive or whatnot. You'd say Google is also responsible for infecting innocent victims right?
So far as I can tell, the malware uploaded to my site is when people use it as a virtual usb stick; transferring files to a lab system or something else they already have access to. A multiplayer remote desktop site was popular for a while, loads of links to shared virtual machines and sometimes people would upload screen recordings of something that happened (usually social things like someone saying something edgy in a chat that runs alongside). Since it's a lab environment, the users enjoy letting loose all sorts of malware and they'd use my site to get it there, but they always already had access or you can't type in the URL and execute the file
There was one instance where someone did make a self-spreading piece of malware, custom for my site. It would try to occupy a lot of short links, so pretty much no matter what you guessed, you'd end up finding that Windows executable and, if you ran it, it would upload itself to create yet more valid download links. Didn't do anything malicious to infected machines, just a nuisance to the site until I banned IP addresses that continued to spam the site
Of course, that's just focusing on the malware. The vast majority of uploads are screenshots, legit software (matching sha2sum with a known good source), long links or commands someone would otherwise have to type over, stuff like that. On occasion there's waves where some community will decide to use it for something, like rich Koreans sharing chatroom links for about a year comes to mind. A few teachers use it for very short temporary links that they can write on the chalkboard/whiteboard for students to download coursework from. It was down for 2h last week due to a power outage and one of my old teachers opened a github ticket about it, that was nice to see :)
I didn't newly start this in 2026; I just haven't stopped the existing system :). Fifteen years ago there weren't all these issues though. Attempts at taking it down whenever anything bad was spotted started probably somewhere around 2019-2020, and user reports are picking up as well since about a year. People suddenly care a lot more that when they guessed a url and found malware (something no legitimate user would stumble upon), it gets removed promptly. So far the number of reports is very very manageable, but it's interesting to observe the collective consciousness change over time from "don't run executables that you don't know are safe" to "untrustworthy files shouldn't exist online in the first place"
The risk of pedophile images is way to high to let anyone upload files to your website. It's one thing probably even the evilest country would agree to jail you for, without investigation.
Maybe, let's see. I have the same amount of faith in humanity and the legal system as I did in the forum era. No CSAM reports so far. Very little porn in general, maybe one video per year or so? In my particular case it's also not very useful because the uploads are all self-destructing. After a few hours you'd have to upload it again, but from a new IP address because I'd block any (C)SAM uploaders and report all evidence I have to police in the appropriate country. Seems like a silly way to burn through a set of working proxies if someone wanted to try to keep abuse material available on that site
Theres no way you can say having an internet presence is over for the little guy and yet at the same time imply its ok if you have enough money/power. I think at that stage it ceases to be useful and we need an internet 2.0. maybe something hobbyists can run over radio or something.
This is why developing darknet and obfuscating P2P network tech that make it impossible to properly assign legal liability to a node is so important. States are by far the worst monsters humans have invented and they do the stupidest things imagineable.
A State might be composed of humans but it is a machine, a generally unthinking machine, which projects force on and breaks individuals.
/shrug - I have an end-to-end encrypted file delivery service. It's a dumb service. If the box got compromised, it doesn't even matter. The files can't be read or stolen because they would have to actually crack the algorithm... which if they did then it's just over, the internet is plaintext again if people are able to defeat what's been recommended as best practices for SSL/TLS these days.
Worst one I had was about 12 years ago when I got a phone call from the local golf club I'd set-up a site/CMS for, not kept patched as well as I should've, and a club member reported they were served porn ads instead of the Saturday draw... That was a lesson learnt
Contacting the registered abuse contact (per the WHOIS data) is just step one. If that fails then, sure, go ahead and let the domain registry know that the contact method on their file is dead and then it makes sense to put the sites on a blocklist
This is it. Its hopeless now. I had a horrible realization a couple weeks ago with a small (single) person business. I showed them that their website was completely owned, crypto-miners ,malware, gambling pop-ups the works.
When I showed and asked who maintains her site, she said it regard to the malware, "All sites look like this"
That was when it hit me. They have won. The web is so full of garbage to the average person that they cannot even recognize it as it feeds on them.
Don't worry, once you're on one of the naughty lists, it's going to spread by itself. Your domain will never be off of all lists simultaneously, it goes around and you can keep chasing it if it's your domain but you'll never convince everyone before another has copied it again
Most vendors of such lists don't have a contact method, don't respond, or say they're only aggregating a set of secret sources and it's up to me to look for those. Only a handful will actually respond to requests to re-evaluate the allegation, and remove you if it was/is false
> Supply chain - a third-party script file that a site loads is infected with malware, and is then loaded on to the site, exposing all visitors.
I already know many will disagree, but this is far too vague for your answer to make much sense. The list of 15k websites isn't given.
Most websites have at least one analytics script. Some of the biggest vendor names in that space have known XSS issues via nonce reuse that they aren't going to fix because it threatens their entire business model.
You usually get the whole clown car as soon as you allow one 3rd-party script for relatively innocent use cases like wanting a heatmap of user interaction.
You should fully expect that such a blacklist would take out most, if not all, of the websites you use every day. The security model for 3rd party scripts tends to be "trust me bro, we're $bigname"
Yes, exactly! I'm saying the surface area to audit is much bigger than any particular or group of websites. All websites have problems like this that are out of their hands. What if all 3rd-party script vendors are like this (spoiler: they are)?
The blame game isn't going to solve this. Blaming it entirely on the website owners/maintainers is only treating the symptoms instead of the disease.
Visitors getting a big red warning page is the most effective way to get it fixed though. There's no way for site admins to sweep the issue under the rug
If we're really being serious about getting it fixed and not just waving a magic wand and laying blame, the scripts should not be distributed via a platform that tells web maintainers to blindly paste a script tag and leave their web servers wide open for the whitelisted 3rd party domain(s) to send whatever they want to visitors. We need to end the security theater with nonces that is bypassing what most people expect from a content security policy that is almost never true in practice.
The scripts should be 100% static files hosted by the same origin and not be obfuscated. These scripts should not make additional requests to inject even more scripts that cannot be known until run time and are specific to that targeted visitor. These scripts should be released in the usual semver tradition with matching hashes that never change without the explicit action by the same domain that the user actually visited (making the nonce obsolete).
Like I said, this is a very old debate with a very simple solution whose only problem is that it breaks the business model of a multi-billion dollar idea. Not only would this tighten up security, but your favorite websites wouldn't lag so hard anymore either. The vast majority of complaints about the web being slow are from the dozens of HTTP requests constantly being made behind your back. This is exactly why so many users feel forced to use an adblocker even though that doesn't always work.
Are you replying to something else? I don't see the connection to a problem affecting a small number of websites or the suggestion of reporting them all to a browser maker to indirectly inform them.
What makes you so sure that kind of malware isn't being distributed by otherwise trusted 3rd-party scripts?
That's the standard definition of a supply chain attack. If the website maintainer was acting maliciously or incompetently, it wouldn't be a supply chain attack anymore.
If I’m about to enter my credit card information on a site that’s compromised, I don’t care if it’s because of infected first party code or infected third party code. I want my browser to say “bro this site is fishy, maybe don’t”.
Make a website,
name it 15579infected.com and name everywebsite.
Most of the website owners would soon wise up by word of mouth and visit your website and most probably contact you and you tell them what vulnerability each one has so they can rectify.
You can charge them for your service.
Charging them to detail the infection to them risks coming off as extortion to less savvy site owners. You might get a significant portion who would report you to the police rather than talk to you.
This is the right move. Contrary to what the other comment says, this is not "name and shame".
Instead, this is a database, useful to check for website owners to see if their site is listed inside.
This would be an idea very similar to haveibeenpwned.com, which is immensely helpful.
And? They won’t be less vulnerable by not being listed, nor easier to find for any moderately skilled attacker (especially these days) by being listed publicly.
He should just put up a txt file on his blog and call it a day.
I don't get why he brings "responsible disclosure" into this. That is appropriate when you find a door lock that is easily picked; that is not appropriate when you are watching from across the street while a house gets looted.
> Then: \n\n either web admin notices and fixes website \n\n or people stop visiting them
Okay so let's say this is your site. You notice that Firefox gives a warning, you find the issue, remove the malicious dependency and roll out the new version. Now what? Who do you talk to to get unblocked?
I run a site that's on blocklists. There's no coming off of them once you're there (described elsewhere in this thread: https://news.ycombinator.com/item?id=50398014). These mechanisms are useful for sites that are unmaintained, but I'd not wish it upon admins that immediately respond to vulnerability or abuse reports
I can understand that most people are not aware of this though, just a bit frustrating to see the call for nuking it altogether. It's not what you'd do if one of these 15000 sites was Onedrive: you'd realise the solution is talking to Microsoft. Only when they don't fix their infection would it make sense to take their site offline
Most people use Chrome with default settings, maybe with some extra AV as well. These websites are going to get added to the list anyway.
Perhaps a coordinated attempt with CERTs or a basic attempt at email contact would be a good idea, but if emails are nowhere to be seen and there is no way to determine a relevant taskforce, reporting the domains seems like the obvious problem.
Getting blocklisted sucks, but so does identity theft, drive-by malware, and credit card fraud. Without things like SECURITY.txt or contact email addresses, there's not a lot more you can do to prevent these people from (unwittingly? intentionally?) spreading harm.
I think something has gone very wrong for you to be doubting the answer.
Responsible disclosure is to prevent harm. You think about your disclosure options and pick the one that is best overall weighing the impact and harm.
They're already infected - or so you claim.
I get that companies want to use responsible disclosure as a mechanism so it can save face and their reputation, and if both are possible at the same time then sure.
But if you think you're right, you have to pick one and live with the consequences; and its not that hard to pick the right choice.
In fact, if you don't make the right choice you need stop misusing the word “responsible disclosure”.
Publish the URLs that prove they're infected. Auto update it whenever one get's fixed.
> companies want to use responsible disclosure as a mechanism so it can save face and their reputation
That sounds like the opposite of the goal of that procedure, since the point is the disclosure. Telling everyone about a weakness before it can be solved would harm users, that's why you coordinate with the vendor, but disclosure and resolution is the goal you're working towards. Saving face would be a gag order or agreement, which many companies indeed have tried, but that's the opposite of companies that publish their procedure for coordinated vulnerability disclosure (also/formerly called responsible disclosure) so that white-hats can report issues without fearing legal action. That also means that these companies have to own up to it once the issue is resolved, or at least the hacker is free to talk about it
The rest of your comment is right though: for sites that are already infected, being quiet about it doesn't prevent a vulnerability from being exploited anymore
It’s not a notice of a vulnerability. For all they know it was an employee abusing access. You don’t leave a skimmer on a pump and politely keep sending emails to corporate waiting for a response. You call the cops and they should shut the pumps off until the skimmers are removed. With the amount of AI security report slop and AI extortion spam out there this is basically a service that only the web host can provide.
This seems correct? If true, they are currently dangerous to others and they should be called out for it. Why will people be more proactive here if they can just hide their mistakes?
Report the sites or post them in public. It's unethical not to do it. Imagine you go to completely automated store and clearly see there is credit card skimmer attached at every checkout. Do you post online about it and say "but would you think of the store owners" or do you report it?
I routinely register lapsed malware C2 domains and sinkhole them to collect information on what information they gather. I currently have about 30k infected hosts that phone home every minute or so asking for shell commands to execute. Most of these hosts are on popular providers like HostGator, BlueHost, etc. I've tried reaching out to them to tell them about it but didn't get anywhere.
Tangential but related: can anyone point me towards what tools are being used to identify this kind of malicious JS?
I host a modest pile of WordPress and other applications, and all traffic gets proxied by nginx. I've been occasionally sniffing around for something that I could use to monitor the JS of outbound traffic and give me a heads-up if it smells like one of the sites is delivering something it shouldn't be, but I haven't found a tool for this that I like yet.
Can't you do a .well-known or DNS handshake (like certbot) so people prove domain ownership, then hand then the report of what you found on their domain?
You gave email addresses to contact you - for NCSC/CERT and for entities who want to incorporate your threat intelligence data into their protection models.
What's the email address for owners of 1 or 1000 sites to find out if they're listed in your stewpot?
Hi @speckx I'm going to guess that there won't be 15K hosting providers behind all of those websites...so I suggest considering the following:
* If its feasible to do, try to programmatically discover the hosting providers behind the websites...This probably brings the total number of recipients to a much smaller list.
* Then very very politely inform the hosting providers of the situation. Basically, you'd be emailing the OVHs, Hetzners, digital Ocean, HostGators, etc. of the online world.
Typically a website owner will pay attention to messages from their hosting provider...and i will assume such providers get similar notifications a lot...maybe they even have automated processes to send/forward along messages o site owners.
Although i do stress be very polite, because you don't want the providers to slam hard closed the websites before disclosing to *their* customers (the website owners)...You want disclosure, not a sort of "uninformed take down via bureacracy" of their websites. If the above process works, then public shaming is avoided, the folks who control the infrastructure (hosting providers) are informed, and they handle management with the site owners, and other parties who would have received your email but may not know more efficient methods to handle this (like the local police) are not distracted from their other important work. I hope this helps!
As someone in the UK, I'd expect something along the lines of (1) reporting to the website owner by email and if they don't respond then just (2) reporting it to the police. It used to be common to go to the hosting provider but I'm not sure if people still do that anymore. At this scale it would be kind to do (1) but also just jumping to (2) seems like more than enough to have 'done the right thing'.
It would have to be a fully automated / AI system that attempted to scrape sites for contact emails, look up domain ownership if possible, and even guess emails (info@<domain>, contact@<domain>, support@<domain>, etc.)
I guess this is exactly what WHOIS information is meant to provide, a way to contact the owner or administrator of a domain. Of course many sites today rely on WHOIS anonymization, but legit e-mails should still hopefully make it through to the owner.
Not enforced no, but this works a lot of the time though (include info@ as well). In whois data you can also always find an email contact for abuse notifications
(To be fair, I was a bit annoyed by a recent AI bro spamming about fifteen such prefixes on my domain with a false positive vulnerability report. The PoC did not work and the field they were injecting was already correctly escaped. But it is an effective contact method if you're facing a bulk problem like this I suppose. Maybe try just one prefix at a time until an email is accepted)
Very few people host email, and even fewer in the same VM as where their website is. I would be surprised if this is the case for even 1% of the sites, and attackers probably are exploiting sites by the hundreds, not babysitting and monitoring the email traffic of one of them to quickly delete any vulnerability reports coming in
Email them - many sites have a contact page with an email address. Tell them what the issue is up front. Be specific and give all the details they need to confirm the issue. Don't ask them to follow up or for payment. These are both red flags as there are so many spammers and scammers out there.
Just send a bunch of emails a day for days, for weeks, for months. It's perfectly fine if those compromised websites aren't ALL notified on the exact same day.
> Since GDPR back in 2018, I've found that data to be mostly useless. What you get is either nothing, a registrar web form, or a relay address
This is the way though. If there is no contact in the domain's whois, then contact the abuse handler for the IP address that it's hosted on
Domain registries (not the registrars) are usually very interested in dead contact methods, at least I've been repeatedly threatened with losing the domain if they find it's not functional. You usually get like two weeks to fix it if issues are found, but they do seem to care. Maybe not .ru (I have no experience with them), but in general I'd let them know and see if that triggers an update before moving to more drastic measures
Another way would be looking for an email address on the homepage or pages linked from the homepage (usually /contact or /impressum or such, but of course this varies)
Lastly, some people may be willing to help out and look for a contact method in a crowdsourced manner. Could also use an LLM but I expect people are more reliable and volunteers are cheaper too
> If the list is widely disseminated and absorbed into blocklists, trying to get your domain of those lists afterwards is close to impossible. For a small business, that could be devastating.
As someone who experienced this (thankfully just a hobby project and not a business), thanks for that consideration! However, I'd encourage this line of action for the ones that are uncontactable. If the site is abandoned, what else are you going to do?
> We continue to reach out directly to those sites that we identify as particularly high impact and try to notify them, though this is happening on an admittedly small scale. The process of responsible disclosure consumes a lot of resources, use of security.txt is low, and the vast majority of our emails and messages go unanswered. It's simply not possible for us to scale this up.
...why?
Some of the sites collect credit card information. Wouldn't they have a 'contact us' or some other legal identity information required for collecting and charging cc's?
Other than looking at security.txt what else have they tried? did they try programmatically checking for a 'contact us'? or the old trick of emailing 'webmaster@domain.com' or 'admin@domain.com'? did I miss those details in the article?
Maybe things have changed in the past 10 years, but it was a MASSIVE deal if a website ended up on some site claiming it has malware. Like, contract-ending, people-getting-fired, 10s of thousands of dollars in lawyer fees kinda deal.
I don't think 'it's hard' is a good excuse to ignore responsible disclosure
Um. Isn't it exactly the reason why abuse@some-domain.com needs to exist? I mean, sending 15k mails is not a big deal I suppose and had I receive such mail I'd read it.
But maybe that's not the way and someone will at least tell me why :)
You wont report them or tell them... because it's not a bug it's a feature.
The "moral and trustable" big names that hold the doors of the internet could stop you from going to any scam/infested site but they wont... chrome can and actually worked against things that can prevent you from getting there in first place like ublock origin.
Things are working as intended... as long as someone is doing money you can basically steal, intercept, and gate what people do (looking at you postman).
Do it in the most humiliating manner possible. Inform them through email and give them a few days before posting it publicly. You will find that one cares.
Predictable. When I was doing this work full time greater than 90% of the code came from outside the organization, such as NPM packages or framework plugins, and nobody reviewed the third party code. Nobody wanted to own the hard problems like security, accessibility, or performance. They just wanted to put text on the screen with JSX and call themselves experts.
Over the years I've found so many Fortune 500's with either massive bugs that broke the site for customers, or huge security holes, and spent hours trying to find a way to report it to them, to no avail. The people who make these websites just don't give a shit. So I now just look up WHOIS and email the domain's contacts and give up.
The old answer I've heard is to look up what their address and room number is in WHOIS and walk over or pick up the phone!
But to be fair, that small web situation was before my time as well. Afaik that's still the directory to look in though. Complaining to third parties behind these owners' backs is a bit of a dick move, though I can understand the reasoning since most people are not aware of the repercussions (see my other replies in this thread, e.g. https://news.ycombinator.com/item?id=50397828)
In my opinion, you can and should write them an email. Otherwise you should do nothing because it's not your business. The security of a website is the responsibility of the website owner.
> As these are sites we're crawling and identifying ourselves, we have no contact information like we would for a customer.
It does cost some money, but a possibile solution could be to spin up some cheap agents to search for contact details for each website individually. (For the subset of sites which don't have any findable contact details some other solution would be required.)
HIBP works fine when you check it every once in a while, but as a mechanism to reach site owners about urgent issues, they'd all have to subscribe to such a central reporting place. Not sure what the advantage is of subscribing to "has my site been pwned" as compared to just having a /security.txt, working WHOIS record, obvious contact page linked from the homepage... lots of ways already
Edit: I could see the benefit if they do vetting of the message though. Like if one person vets the message and then it makes it into 15000 inboxes is better than having to deal with 15000 antispam mechanisms. Maybe there's something to this after all. Or if email providers would act upon spam better and we block the ones that don't, maybe we could just not have spam in the first place. Idk why this is so hard in the first place
In the old days you'd just do a whois of the domain name and email the system administrator or tech contact. But GDPR made whois data illegal and destroyed that system so now there is no way to contact anyone unless you both happen to be on the same corporate walled garden (facebook, twitter, etc) they might list on their site.
It's still possible to use whois data. Most of the time it'll be an abuse@ email address from a provider and they can forward the message to the real admin, or they could directly block the website if you explain the issue.
The problem is not the GDPR, but the fact that this public contact data was abused. If some assholes had not decided to spam people, we would probably still have public contact info.
I believe the default configuration for suspected spam and phishing and other malicious sites is that the user gets a red warning page that they have to click through first. Website owner would either get notifications from users or notice the drop off in traffic?
The correct answer is probably the abuse contact shown in the WHOIS data. That's programmatically accessible and thus scales
UPDATE: Unpopular because it means there's a lot of work for the owner to moderate the files. And large sites like facebook are notorious for very bad moderation. It's not like we mandate them to hire N moderators per M users.
There's a middle ground for this though. Platforms like Youtube, Facebook, etc, have no excuse anymore. They can literally scan with these models they have available and handle it. So write the legislation based on their capacity so you don't screw the one dude just trying to support some indie game devs in a small community or something.
You've unwittingly helped to spread malware to an innocent person, so yes, it is your problem.
When somebody reports that you are spreading malware, what do you do with that information?
So far as I can tell, the malware uploaded to my site is when people use it as a virtual usb stick; transferring files to a lab system or something else they already have access to. A multiplayer remote desktop site was popular for a while, loads of links to shared virtual machines and sometimes people would upload screen recordings of something that happened (usually social things like someone saying something edgy in a chat that runs alongside). Since it's a lab environment, the users enjoy letting loose all sorts of malware and they'd use my site to get it there, but they always already had access or you can't type in the URL and execute the file
There was one instance where someone did make a self-spreading piece of malware, custom for my site. It would try to occupy a lot of short links, so pretty much no matter what you guessed, you'd end up finding that Windows executable and, if you ran it, it would upload itself to create yet more valid download links. Didn't do anything malicious to infected machines, just a nuisance to the site until I banned IP addresses that continued to spam the site
Of course, that's just focusing on the malware. The vast majority of uploads are screenshots, legit software (matching sha2sum with a known good source), long links or commands someone would otherwise have to type over, stuff like that. On occasion there's waves where some community will decide to use it for something, like rich Koreans sharing chatroom links for about a year comes to mind. A few teachers use it for very short temporary links that they can write on the chalkboard/whiteboard for students to download coursework from. It was down for 2h last week due to a power outage and one of my old teachers opened a github ticket about it, that was nice to see :)
This is an incredibly brave thing to do in 2026.
Sorry mate, the era of forums is over.
A State might be composed of humans but it is a machine, a generally unthinking machine, which projects force on and breaks individuals.
Primary obligation is to the users, not the owners of websites that got themselves infected.
Better than a customer telling you they got a nasty bug from your site!
When I showed and asked who maintains her site, she said it regard to the malware, "All sites look like this"
That was when it hit me. They have won. The web is so full of garbage to the average person that they cannot even recognize it as it feeds on them.
The webadmin is some Chinese guy on upwork.
Most vendors of such lists don't have a contact method, don't respond, or say they're only aggregating a set of secret sources and it's up to me to look for those. Only a handful will actually respond to requests to re-evaluate the allegation, and remove you if it was/is false
> Supply chain - a third-party script file that a site loads is infected with malware, and is then loaded on to the site, exposing all visitors.
I already know many will disagree, but this is far too vague for your answer to make much sense. The list of 15k websites isn't given.
Most websites have at least one analytics script. Some of the biggest vendor names in that space have known XSS issues via nonce reuse that they aren't going to fix because it threatens their entire business model.
You usually get the whole clown car as soon as you allow one 3rd-party script for relatively innocent use cases like wanting a heatmap of user interaction.
You should fully expect that such a blacklist would take out most, if not all, of the websites you use every day. The security model for 3rd party scripts tends to be "trust me bro, we're $bigname"
The blame game isn't going to solve this. Blaming it entirely on the website owners/maintainers is only treating the symptoms instead of the disease.
The scripts should be 100% static files hosted by the same origin and not be obfuscated. These scripts should not make additional requests to inject even more scripts that cannot be known until run time and are specific to that targeted visitor. These scripts should be released in the usual semver tradition with matching hashes that never change without the explicit action by the same domain that the user actually visited (making the nonce obsolete).
Like I said, this is a very old debate with a very simple solution whose only problem is that it breaks the business model of a multi-billion dollar idea. Not only would this tighten up security, but your favorite websites wouldn't lag so hard anymore either. The vast majority of complaints about the web being slow are from the dozens of HTTP requests constantly being made behind your back. This is exactly why so many users feel forced to use an adblocker even though that doesn't always work.
That's the standard definition of a supply chain attack. If the website maintainer was acting maliciously or incompetently, it wouldn't be a supply chain attack anymore.
I'm not sure what point you're trying to make here.
Just give them the deets.
This would be an idea very similar to haveibeenpwned.com, which is immensely helpful.
I don't get why he brings "responsible disclosure" into this. That is appropriate when you find a door lock that is easily picked; that is not appropriate when you are watching from across the street while a house gets looted.
Google, Facebook, Bing, other large platforms will get those websites blocked. Their traffic falls almost to zero. Then:
either web admin notices and fixes website
or people stop visiting yhem
either way, no more infected people, win for everyone.
Okay so let's say this is your site. You notice that Firefox gives a warning, you find the issue, remove the malicious dependency and roll out the new version. Now what? Who do you talk to to get unblocked?
I run a site that's on blocklists. There's no coming off of them once you're there (described elsewhere in this thread: https://news.ycombinator.com/item?id=50398014). These mechanisms are useful for sites that are unmaintained, but I'd not wish it upon admins that immediately respond to vulnerability or abuse reports
I can understand that most people are not aware of this though, just a bit frustrating to see the call for nuking it altogether. It's not what you'd do if one of these 15000 sites was Onedrive: you'd realise the solution is talking to Microsoft. Only when they don't fix their infection would it make sense to take their site offline
Perhaps a coordinated attempt with CERTs or a basic attempt at email contact would be a good idea, but if emails are nowhere to be seen and there is no way to determine a relevant taskforce, reporting the domains seems like the obvious problem.
Getting blocklisted sucks, but so does identity theft, drive-by malware, and credit card fraud. Without things like SECURITY.txt or contact email addresses, there's not a lot more you can do to prevent these people from (unwittingly? intentionally?) spreading harm.
Responsible disclosure is to prevent harm. You think about your disclosure options and pick the one that is best overall weighing the impact and harm.
They're already infected - or so you claim.
I get that companies want to use responsible disclosure as a mechanism so it can save face and their reputation, and if both are possible at the same time then sure.
But if you think you're right, you have to pick one and live with the consequences; and its not that hard to pick the right choice.
In fact, if you don't make the right choice you need stop misusing the word “responsible disclosure”.
Publish the URLs that prove they're infected. Auto update it whenever one get's fixed.
That sounds like the opposite of the goal of that procedure, since the point is the disclosure. Telling everyone about a weakness before it can be solved would harm users, that's why you coordinate with the vendor, but disclosure and resolution is the goal you're working towards. Saving face would be a gag order or agreement, which many companies indeed have tried, but that's the opposite of companies that publish their procedure for coordinated vulnerability disclosure (also/formerly called responsible disclosure) so that white-hats can report issues without fearing legal action. That also means that these companies have to own up to it once the issue is resolved, or at least the hacker is free to talk about it
The rest of your comment is right though: for sites that are already infected, being quiet about it doesn't prevent a vulnerability from being exploited anymore
I host a modest pile of WordPress and other applications, and all traffic gets proxied by nginx. I've been occasionally sniffing around for something that I could use to monitor the JS of outbound traffic and give me a heads-up if it smells like one of the sites is delivering something it shouldn't be, but I haven't found a tool for this that I like yet.
Group by country, and let them handle it.
https://www.edpb.europa.eu/contact/notify-a-data-breach_en
But I think you are asking the wrong question. The challenge is how to minimize damage.
You can list them all out, with the specific pages/methods that are compromised and shouldn't get much backlash from the owners.
This is a different situation than a CVE
If you want to be paid for your efforts, I dunno :\
I've posted an update to address many of the comments here on HN and also across social media, you can find it here:
https://scotthelme.co.uk/we-know-15-579-websites-are-infecte...
What's the email address for owners of 1 or 1000 sites to find out if they're listed in your stewpot?
* If its feasible to do, try to programmatically discover the hosting providers behind the websites...This probably brings the total number of recipients to a much smaller list.
* Then very very politely inform the hosting providers of the situation. Basically, you'd be emailing the OVHs, Hetzners, digital Ocean, HostGators, etc. of the online world.
Typically a website owner will pay attention to messages from their hosting provider...and i will assume such providers get similar notifications a lot...maybe they even have automated processes to send/forward along messages o site owners.
Although i do stress be very polite, because you don't want the providers to slam hard closed the websites before disclosing to *their* customers (the website owners)...You want disclosure, not a sort of "uninformed take down via bureacracy" of their websites. If the above process works, then public shaming is avoided, the folks who control the infrastructure (hosting providers) are informed, and they handle management with the site owners, and other parties who would have received your email but may not know more efficient methods to handle this (like the local police) are not distracted from their other important work. I hope this helps!
https://www.ncsc.gov.uk/section/about-this-website/report-sc...
It would have to be a fully automated / AI system that attempted to scrape sites for contact emails, look up domain ownership if possible, and even guess emails (info@<domain>, contact@<domain>, support@<domain>, etc.)
(To be fair, I was a bit annoyed by a recent AI bro spamming about fifteen such prefixes on my domain with a false positive vulnerability report. The PoC did not work and the field they were injecting was already correctly escaped. But it is an effective contact method if you're facing a bulk problem like this I suppose. Maybe try just one prefix at a time until an email is accepted)
It should be more or less possible though. Just not easy.
> Since GDPR back in 2018, I've found that data to be mostly useless. What you get is either nothing, a registrar web form, or a relay address
This is the way though. If there is no contact in the domain's whois, then contact the abuse handler for the IP address that it's hosted on
Domain registries (not the registrars) are usually very interested in dead contact methods, at least I've been repeatedly threatened with losing the domain if they find it's not functional. You usually get like two weeks to fix it if issues are found, but they do seem to care. Maybe not .ru (I have no experience with them), but in general I'd let them know and see if that triggers an update before moving to more drastic measures
Another way would be looking for an email address on the homepage or pages linked from the homepage (usually /contact or /impressum or such, but of course this varies)
Lastly, some people may be willing to help out and look for a contact method in a crowdsourced manner. Could also use an LLM but I expect people are more reliable and volunteers are cheaper too
> If the list is widely disseminated and absorbed into blocklists, trying to get your domain of those lists afterwards is close to impossible. For a small business, that could be devastating.
As someone who experienced this (thankfully just a hobby project and not a business), thanks for that consideration! However, I'd encourage this line of action for the ones that are uncontactable. If the site is abandoned, what else are you going to do?
...why?
Some of the sites collect credit card information. Wouldn't they have a 'contact us' or some other legal identity information required for collecting and charging cc's?
Other than looking at security.txt what else have they tried? did they try programmatically checking for a 'contact us'? or the old trick of emailing 'webmaster@domain.com' or 'admin@domain.com'? did I miss those details in the article?
Maybe things have changed in the past 10 years, but it was a MASSIVE deal if a website ended up on some site claiming it has malware. Like, contract-ending, people-getting-fired, 10s of thousands of dollars in lawyer fees kinda deal.
I don't think 'it's hard' is a good excuse to ignore responsible disclosure
But maybe that's not the way and someone will at least tell me why :)
I suspect that these problems exist everywhere at this moment in all major systems.
Perhaps a bot to attempt to make contact and alert the staff.
It's too bad that such a person would likely end up arrested if they don't mask their identity.
But to be fair, that small web situation was before my time as well. Afaik that's still the directory to look in though. Complaining to third parties behind these owners' backs is a bit of a dick move, though I can understand the reasoning since most people are not aware of the repercussions (see my other replies in this thread, e.g. https://news.ycombinator.com/item?id=50397828)
It does cost some money, but a possibile solution could be to spin up some cheap agents to search for contact details for each website individually. (For the subset of sites which don't have any findable contact details some other solution would be required.)
im sure for 15,579 websites there will only be about 2500 of them that send the cops after you for "hacking their site", manageable
Edit: I could see the benefit if they do vetting of the message though. Like if one person vets the message and then it makes it into 15000 inboxes is better than having to deal with 15000 antispam mechanisms. Maybe there's something to this after all. Or if email providers would act upon spam better and we block the ones that don't, maybe we could just not have spam in the first place. Idk why this is so hard in the first place
My primitive websites are FREE of all javascript, the tool by which advertisers and corporation anger us with Paywalls, Nag screens and the like.
Hope all of them explode.