Heh.

My primitive websites are FREE of all javascript, the tool by which advertisers and corporation anger us with Paywalls, Nag screens and the like.

Hope all of them explode.

Heck yes

A fair position to take, but not really relevant here. Removing that attack vector from your own offerings doesn't un-compromise anyone else.

low iq comment

Make a website, Called 15579infected.com and name everywebsite. Most of the website owners would soon wise up by word of mouth and visit your website and most probably contact you and you tell them what vulnerability each one has so they can rectify. You can charge them for your service.

Exactly. This is not rocket science. Name and shame. Sort by estimated traffic.

Don't do that dude.

Why not?

its a free for all of targets known to be vulernable to javascript injection via some route or other?

And? They won’t be less vulnerable by not being listed, nor easier to find for any moderately skilled attacker (especially these days) by being listed publicly.

>And? They won’t be less vulnerable by not being listed,

Incorrect, if you find a vulnerability and make that public, and point attackers towards them, you are making it more likely they are attacked, and thus making them more vulnerable.

What? Attackers already know, most of these are stuff like XSS and WP which I assure you even over 15 years ago were easy to find en masse. Still remember old school SemperVideo, was a monthly occurrence at the time.

This is akin to saying HIBP shouldn't tell you which addresses are affected by hacks/leaks cause that points attackers in the direction. They already know and not disseminating information doesn't prevent that.

Broad generalizations being made here

>https://cogecog.com/the-threat-onion/

See the onion model. You are raising awareness of a vulnerable target. I can argue that you are increasing risk, it's a reasonable argument regardless of whether you can defend it. You are introducing a liability to yourself of being civilly liable for damages and criminally responsible, all this for no gain except some possible altruistic desire to improve security. It's a categorical error.

I find the policy of not increasing awareness to a vulnerability is more consistent with my desire to improve my personal position, I do not get involved unless there's something that benefits me. Raising awareness benefits the consumers of these websites, while damaging the owner, which may be an ethically positive action under your paradigm, but it also damages your personal position.

This is the right move. Contrary to what the other comment says, this is not "name and shame". Instead, this is a database, useful to check for website owners to see if their site is listed inside.

This would be an idea very similar to haveibeenpwned.com, which is immensely helpful.

He should just put up a txt file on his blog and call it a day.

I don't get why he brings "responsible disclosure" into this. That is appropriate when you find a door lock that is easily picked; that is not appropriate when you are watching from across the street while a house gets looted.

Charging them to detail the infection to them risks coming off as extortion to less savvy site owners. You might get a significant portion who would report you to the police rather than talk to you.

Just give them the deets.

>Charging them to detail the infection to them risks coming off as extortion to less savvy site owners

Certainly a touchy subject, but in the end, the security researcher is better off "risking" being seen as an extorter, than simply having no revenue mechanism.

Your business idea is 100% a straight up scam.

You're trying to assert authority and make money off of what is super basic cybersecurity. I'm not sure why you think word of mouth would cause anyone to do anything but laugh at you at best, or get the law after you at worst.

The old answer: communicate with major search engines and browser vendors. Dunno what to tell you now...

Google already does that, and they warn users about malicious sites. The question is: are these sites already flagged by google?

Note that I would have suggested "communicating" with google: an antiquated notion

The old answer I've heard is to look up what their address and room number is in WHOIS and walk over or pick up the phone!

But to be fair, that small web situation was before my time as well. Afaik that's still the directory to look in though. Complaining to third parties behind these owners' backs is a bit of a dick move, though I can understand the reasoning since most people are not aware of the repercussions (see my other replies in this thread, e.g. https://news.ycombinator.com/item?id=50397828)

Report each domain to the major browser vendors so they can update their list of suspicious sites?

I believe the default configuration for suspected spam and phishing and other malicious sites is that the user gets a red warning page that they have to click through first. Website owner would either get notifications from users or notice the drop off in traffic?

Yeah, this is probably the right answer. Immediately protects users, and website owners would quickly find out as well...

Unfortunately, this is how I found out 10 years ago when someone hacked a 3rd party dependency I was using on my site.

> Unfortunately, this is how I found out 10 years ago when someone hacked a 3rd party dependency I was using on my site.

Better than a customer telling you they got a nasty bug from your site!

Worst one I had was about 12 years ago when I got a phone call from the local golf club I'd set-up a site/CMS for, not kept patched as well as I should've, and a club member reported they were served porn ads instead of the Saturday draw... That was a lesson learnt

> Supply chain - a third-party script file that a site loads is infected with malware, and is then loaded on to the site, exposing all visitors.

I already know many will disagree, but this is far too vague for your answer to make much sense.

Most websites have at least one analytics script. Some of the biggest vendor names in that space have known XSS issues via nonce reuse that they aren't going to fix because it threatens their entire business model.

Are you replying to something else? I don't see the connection to a problem affecting a small number of websites or the suggestion of reporting them all to a browser maker to indirectly inform them.

No. This is a very old debate I'm bringing up. The criteria for being listed as an "infected site" is not clear enough.

Your example is how the site got infected. The types of infection is listed 2 or so paragraphs above that

What makes you so sure that kind of malware isn't being distributed by otherwise trusted 3rd-party scripts?

That's the standard definition of a supply chain attack. If the website maintainer was acting maliciously or incompetently, it wouldn't be a supply chain attack anymore.

If I’m about to enter my credit card information on a site that’s compromised, I don’t care if it’s because of infected first party code or infected third party code. I want my browser to say “bro this site is fishy, maybe don’t”.

If a site is using a third-party analytics site that brings in malware, they can stop bringing in that analytics script.

Yes, exactly! I'm saying the surface area to audit is much bigger than any particular or group of websites. All websites have problems like this that are out of their hands.

The blame game isn't going to solve this. Blaming the website owners/maintainers is only treating the symptoms instead of the disease. Even from a legal perspective, this responsibility is shared in the licensing agreement.

It's not about blame. The idea here is to protect the visitors of the site. Do you think they shouldn't be warned?

Warning people sucks. We need to actually fix it.

[delayed]

If we're really being serious about getting it fixed and not just waving a magic wand and laying blame, the scripts should not be distributed via a platform that tells web maintainers to blindly paste a script tag and leave their web servers wide open for the whitelisted 3rd party domain(s) to send whatever they want to visitors. We need to end the security theater with nonces that is bypassing what most people expect from a content security policy that is almost never true in practice.

The scripts should be 100% static files hosted by the same origin and not be obfuscated. They should not make additional requests to inject even more scripts that cannot be known until run time and are specific to that user. These scripts should be released in the usual semver tradition with matching hashes that never change without the explicit action by the same domain that the user actually visited (making the nonce obsolete).

Like I said, this is a very old debate with a very simple solution whose only problem is that it breaks the business model of a multi-billion dollar idea.

All of that sounds great but also it's important to protect visitors.

Maybe if the site owners experience their sites going down due to this they'll look for some alternatives.

You're totally not getting what I'm saying and that's fine, but why do you post these replies then?

I'm not sure why you insist on playing whack-a-mole. You'll eventually just end up with a list of every domain. Do you not understand that this is the other way around? Do you not understand this is a supply chain attack?

This is a great list of things “someone” should do. Can the author of TFA do it?

Why haven’t you already done it?

You have not offered an actionable plan to "fix it". I think its quite reasonable that people hosting malware on their websites should be made aware of it, and then they should stop hosting it. Blocking websites that don't respond to emails sent to their abuse contact - or that can't responsibly host content on the internet is totally reasonable.

I think you're trying to muddy waters here (along with several of the other replies I've responded to). I've been very clear about implementation to mitigate against a specific opportunity for a supply chain attack that hardly anyone ever thinks about despite it being a gaping hole.

For all the whining I've ever heard about package managers like npm, this one is even uglier and likely being exploited right now and is very hard to pin down because of its dynamic behavior by design.

It's perfectly actionable to stop using 3rd party scripts the way I outlined in a reply to a sibling comment. I'm not sure what else you need me to say.

It's very simple. Don't open up your web server's content security policy to domains that you "trust" just because a big name company tells you to. The only rub is that it directly contradicts all the instructions every analytics/ad provider gives for their scripts.

That is very simple for anyone that reads the email sent to the WHOIS abuse contact and understands what it means and why they should care. Since virtually none of them will both understand and care, the next step after sending the email to the abuse contact is to blocklist their domain.

When their visitors begin seeing red warning notices they will learn why they should care.

I'll quote my own reply to your sibling.

> I'm not sure why you insist on playing whack-a-mole. You'll eventually just end up with a list of every domain the user visits on a regular basis. You're basically "shooting the messenger". Do you not understand that this is the other way around? Do you not understand this is a supply chain attack?

I still do not know what you think the relevance of that statement is. What is the specific action you are advocating the author of TFA take that does not require addressing it at each and every website operator?

If more than one sentence at a time is too much for your context window, you might need to pick another topic to discuss.

If it’s not asking to much from you, maybe you could link me to a comment from someone else who understands what you are getting at.

They aren't saying "analytics script = infection"

I'm not sure what point you're trying to make here.

How about "Using third party analytics scripts is a bad idea in general, because they can and frequently do have vulnerabilities and your trust in $BigCompany is misplaced"?

I would agree with that.

Exactly. This is what website operators need to learn. People generally don't learn lessons like this without experiencing some pain first, so in my mind skipping straight to the blocklist is the most efficient.

You need to look up what a supply chain attack actually is. This is not necessarily malicious behavior or incompetence.

> unless you consider putting ads on a website incompetence

Yes, I do.

Then it's confirmed. You are now going off-topic into politics instead of cybersecurity.

Enjoy your tiny corner of the web that nobody else participates with.

Bingo. Protect the users first. For example, you can report the websites to Google Safebrowsing: https://safebrowsing.google.com/safebrowsing/report_phish/

Exactly. And maybe publish the list as well.

Don't worry, once you're on one of the naughty lists, it's going to spread by itself. Your domain will never be off of all lists simultaneously, it goes around and you can keep chasing it if it's your domain but you'll never convince everyone before another has copied it again (most vendors of such lists don't have a contact method, don't respond, or say they're only aggregating a set of secret sources and I should go look for those)

Well, yes. That's fine.

Thanks, then I wish the same upon any creation of yours that other people can interact with and use for evil

I run a website where people can upload files. Not everyone uploads nice files. Every time someone downloads such a file from my site with their antivirus enabled, it's now my problem to discover which fifteen block lists the whole domain has newly been put on. People don't treat big tech this way; you don't think "oh, there's malware on Github, let me just report github.com as a suspicious website that nobody should be able to visit anymore"

The correct answer is probably the abuse contact shown in the WHOIS data. That's programmatically accessible and thus scales

"I run a website where people can upload files."

This is an incredibly brave thing to do in 2026.

I didn't newly start this in 2026; I just haven't stopped the existing system :). Fifteen years ago there weren't all these issues though. Attempts at taking it down whenever anything bad was spotted started probably somewhere around 2019-2020, and user reports are picking up as well since about a year. People suddenly care a lot more that when they guessed a url and found malware (something no legitimate user would stumble upon), it gets removed promptly. So far the number of reports is very very manageable, but it's interesting to observe the collective consciousness change over time from "don't run executables that you don't know are safe" to "untrustworthy files shouldn't exist online in the first place"

The risk of pedophile images is way to high to let anyone upload files to your website. It's one thing probably even the evilest country would agree to jail you for, without investigation.

Sorry mate, the era of forums is over.

Maybe, let's see. So far I haven't gotten CSAM reports yet. Very little porn in general, maybe one video per year or so? In my particular case it's also not very useful because the uploads are all self-destructing. After a few hours you'd have to upload it again, but from a new IP address because I'd block any (C)SAM uploaders and report all evidence I have to police in the appropriate country. Seems like a silly way to burn through a set of working proxies if someone wanted to try to keep abuse material available on that site

Theres no way you can say having an internet presence is over for the little guy and yet at the same time imply its ok if you have enough money/power. I think at that stage it ceases to be useful and we need an internet 2.0. maybe something hobbyists can run over radio or something.

It exists, but very limited, lookup MeshCore and Meshtastic

This is why developing darknet and obfuscating P2P network tech that make it impossible to properly assign legal liability to a node is so important. States are by far the worst monsters humans have invented and they do the stupidest things imagineable.

A State might be composed of humans but it is a machine, a generally unthinking machine, which projects force on and breaks individuals.

[delayed]

You can easily swap government for big corporation in your sentence. So maybe the issue is something else?

[delayed]

/shrug - I have an end-to-end encrypted file delivery service. It's a dumb service. If the box go compromised, it doesn't even matter. The files can't be read or stolen because they would have to actually crack the algorithm... which if they did then it's just over, the internet is plaintext again if people are able to defeat what's been recommended as best practices for SSL/TLS these days.

That’s not the risk, the risk is you’re helping spread horrific things.

Just because a system is end-to-end encrypted doesn't mean the users are anonymous. If someone reported to me a download link with decryption key for my file service, I can probably find the IP address of the person that uploaded it. Then pass it off to whatever govt entity that deals with that.

I’m about to work on doing this. Quick-sharing media files for personal use between devices, friends, LLMs (like a shelf rather than a Dropbox), So an intermediate upload host is needed.

My biggest worry was preventing CPAM, and the possibly huge cost and emotional scarring thereof. What surface(s) are your primary concern? I don’t know what I don’t know. Thanks!

Unpopular opinion, but I think that any website owner accepting uploads from strangers should bear responsibility for those uploads. You cannot just say "not mine, I just distributed it".

I'd be fine if that were the law. What really frustrates me is the double standard where I can't host something that Microsoft or Wetransfer can without repercussions

When running an actually competent LLM is as cheap as a $10/mo cloud server (for the moderation), I'll actually agree with this sentiment. Probably wont be unpopular long beyond that point in time.

There's a middle ground for this though. Platforms like Youtube, Facebook, etc, have no excuse anymore. They can literally scan with these models they have available and handle it. So write the legislation based on their capacity so you don't screw the one dude just trying to support some indie game devs in a small community or something.

[delayed]

Usually the file is already gone by the time they finished reporting it, but otherwise delete and ban the uploader if it's a valid report. Criminals don't seem to use my site for malware spreading, though, because all uploads expire after a number of hours. Much better to put it somewhere that's stable until the victim clicks on it, like Google Drive or whatnot. You'd say Google is also responsible for infecting innocent victims right?

So far as I can tell, the malware uploaded to my site is when people use it as a virtual usb stick; transferring files to a lab system or something else they already have access to. A multiplayer remote desktop site was popular for a while, loads of links to shared virtual machines and sometimes people would upload screen recordings of something that happened (usually social things like someone saying something edgy in a chat that runs alongside). Since it's a lab environment, the users enjoy letting loose all sorts of malware and they'd use my site to get it there, but they always already had access or you can't type in the URL and execute the file

There was one instance where someone did make a self-spreading piece of malware, custom for my site. It would try to occupy a lot of short links, so pretty much no matter what you guessed, you'd end up finding that Windows executable and, if you ran it, it would upload itself to create yet more valid download links. Didn't do anything malicious to infected machines, just a nuisance to the site until I banned IP addresses that continued to spam the site

Of course, that's just focusing on the malware. The vast majority of uploads are screenshots, legit software (matching sha2sum with a known good source), long links or commands someone would otherwise have to type over, stuff like that. On occasion there's waves where some community will decide to use it for something, like rich Koreans sharing chatroom links for about a year comes to mind. A few teachers use it for temporarily having a very short link that they can put on the chalkboard/whiteboard for students to download coursework from

> A multiplayer remote desktop site was popular for a while

Are you talking about CollabVM? :)

https://computernewb.com/collab-vm/

Yeah, that's the one! I recognise the name, thanks :)

> People don't treat big tech this way; you don't think "oh, there's malware on Github, let me just report github.com as a suspicious website that nobody should be able to visit anymore"

> The correct answer is probably the abuse contact shown in the WHOIS data. That's programmatically accessible and thus scales

... They don't treat Github that way either. You mean to report the domain as abusive to the registrar?

Let me offer the wisdom of the BBS Era, which had the same problem of people uploading bad files to small, oftentimes non-commercial, nodes: Scan files on upload.

Running anti-virus scanners immediately on uploaded files was a widespread practice in the BBS Era, adopted in response to the same kind of abuse. FTP sites did it, too. There was usually a delay for (run on a schedule) virus scanning between uploading to one of the shareware FTP sites and the file getting out of the upload directory and into the download areas.

The headlined article isn't really about hosting user-uploaded files, though. In no sensible system do user-uploaded files go straight into the site's own published JavaScript. The headlined situation is not analogous either to you or to BBSes, involving script hyperlinks to defunct third parties in one form of the problem, so what to do when it comes bad uploads from users is really going off on a tangent from Scott Helme's actual question.

I think this has become much more expensive these days. We do it, at a significant computational cost. Not with a small hobbyist machine, but a beefy hobbyist machine. Sometimes making the hubby a bit less worthy...

> Sometimes making the hubby a bit less worthy...

You may want to meet with a marriage counselor.

Thanks. I've considered scanning but besides that it gives a false sense of security (it's trivial to make something for which there's not already known signatures), github and other file hosting sites don't do this either. Some do, I think Google Drive does it after the fact, but it doesn't seem to be the deciding factor in whether vigilantes try to take your site down or instead report malicious content

Maybe scan every time it is accessed as well? So if and when a malicious file hits the lists maybe your antivirus can flag it? This is an amateur question for the discussion not advice.

They at least use different domains for user-uploaded data. e.g. googleusercontent.com and you could go even further by giving each user their own subdomain. That at least gives block lists the possibility of blocking a single user at a time.

I have zero practical experience with contacting abuse contacts. But my expectations would be very very low. For the hyperscalers you will get autmated responses and no way to make your point heard. For small ones there will typically be silence.

Can anybody tell me it's not that bad?

I've tried contacting various domains via their abuse and technical contact WHOIS info over the the years. Mostly small-to-midsize domains, including colleges. I've never gotten a reply, and I don't know if the emails ever went to a real person. Occasionally the issue I was reporting got fixed, but I have no idea if my email had anything to do with anything.

IIRC you give each user a subdomain and put the parent domain in the public suffix list.

That's actually an interesting idea! I remember looking at that list and I don't qualify but I also currently don't have subdomains, maybe it would work then. Not sure if the issue was needing a certain size, like 100k users or whatever (which you'll never reach if half the people can't use your site. I should look into this again with the subdomains option in mind

Why not try to warn the owners first? Taking the site off of those lists is a pain.

How do you do that if the website has no contact details and WHOIS contact form gets no reaction?

That's step two. Contacting the registered abuse contact that's supposed to handle this is step one. If that fails then, sure, go ahead and let the domain registry know that the contact method on their file is dead and then it makes sense to put the sites on a blocklist

This is it. Its hopeless now. I had a horrible realization a couple weeks ago with a small (single) person business. I showed them that their website was completely owned, crypto-miners ,malware, gambling pop-ups the works.

When I showed and asked who maintains her site, she said it regard to the malware, "All sites look like this"

That was when it hit me. They have won. The web is so full of garbage to the average person that they cannot even recognize it as it feeds on them.

The webadmin is some Chinese guy on upwork.

Last time I checked, all sites didn't look like this.

Guessing you run an ad blocker? I'm always shocked by how unusable the web is without one

So the site owner is never notified (because "this wouldn't scale"), has no chance to fix it and is just immediately blocked? And then we do some thoughts and prayers and hope some users might go through the trouble of looking up a contact address and notifying the owner despite the site being blocked?

What exactly would be "responsible" about that?

How is that better than just directly publishing the entire list?

In the old days you'd just do a whois of the domain name and email the system administrator. But GDPR made whois data illegal and destroyed that system so now there is no way to contact anyone unless you both happen to be on the same corporate walled garden (facebook, twitter, etc)

whois was effectively dead well before GDPR -- most people used registration privacy services to hide their mailing address, phone number, etc.

The problem is not the GDPR, but the fact that this public contact data was abused. If some assholes had not decided spam people, we would probably still have public contact info.

It's still possible to use whois data. Most of the time it'll be an abuse@ email address from a provider and they can forward the message to the real admin, or they could directly block the website if you explain the issue.

Whois still works. Try it:

    > whois ycombinator.com
    Domain Name: ycombinator.com
    [snip]
    Admin Name: REDACTED FOR PRIVACY
    [snip]
    Admin Email: [email protected]

Gandi.net will get the message through to the person who would have been registered as the admin contact.

As someone in the UK, I'd expect something along the lines of (1) reporting to the website owner by email and if they don't respond then just (2) reporting it to the police. It used to be common to go to the hosting provider but I'm not sure if people still do that anymore.

https://www.ncsc.gov.uk/section/about-this-website/report-sc...

Yes, but 15k emails...

It would have to be a fully automated / AI system that attempted to scrape sites for contact emails, look up domain ownership if possible, and even guess emails (info@<domain>, contact@<domain>, support@<domain>, etc.)

I guess this is exactly what WHOIS information is meant to provide, a way to contact the owner or administrator of a domain. Of course many sites today rely on WHOIS anonymization, but legit e-mails should still hopefully make it through to the owner.

[delayed]

> Then: \n\n either web admin notices and fixes website \n\n or people stop visiting them

Okay so let's say this is your site. You notice that Firefox gives a warning, you find the issue, remove the malicious dependency and roll out the new version. Now what? Who do you talk to to get unblocked?

I run a site that's on blocklists. There's no coming off of them once you're there. These mechanisms are useful for sites that are unmaintained, but I'd not wish it upon admins that immediately respond to vulnerability or abuse reports

I can understand that most people are not aware of this though, just a bit frustrating to see the call for nuking it altogether. It's not what you'd do if one of these 15000 sites was Onedrive: you'd realise the solution is talking to Microsoft. Only when they don't remove abusive content would it make sense to take their site offline

Most people use Chrome with default settings, maybe with some extra AV as well. These websites are going to get added to the list anyway.

Perhaps a coordinated attempt with CERTs or a basic attempt at email contact would be a good idea, but if emails are nowhere to be seen and there is no way to determine a relevant taskforce, reporting the domains seems like the obvious problem.

Getting blocklisted sucks, but so does identity theft, drive-by malware, and credit card fraud. Without things like SECURITY.txt or contact email addresses, there's not a lot more you can do to prevent these people from (unwittingly? intentionally?) spreading harm.

[delayed]

That's just virustotal; that doesn't even scratch the surface unfortunately. My domain got taken down by a report to the registrar and the registrar having a faulty email server (I found that in my mail server logs afterwards) couldn't reach me (could have tried calling but I don't fault them). The reporter was netcraft, apparently considered reputable (the information they reported was false though, like they claimed a timestamp and continued hosting of a file that was not the case anymore at the claimed timestamp). Basically the worst one I had to deal with, yet they're not mentioned in the blog post. I don't know all the other names off the top of my head but I don't recognise any as vendors I've already tried to deal with so it's not a complete list by any means

Not all-or-nothing. Getting off of some lists will get you unblocked for 90% of clients, as presumably is the case for the ones you look, but perhaps not for this one security vendor used by the company you work for and so you can't use your own fricking website half the time

I appreciate the pointers though!

oh by all means email them all directly saying you found a vulnerability.

im sure for 15,579 websites there will only be about 2500 of them that send the cops after you for hacking their site, manageable

You could send an interview request to their technical staff with an assignment that injects the fix into their production environment.

I suspect that these problems exist everywhere at this moment in all major systems.

Perhaps a bot to attempt to make contact and alert the staff.

[delayed]

If it ever happens it will be a bot that does it.

Tangential but related: can anyone point me towards what tools are being used to identify this kind of malicious JS?

I host a modest pile of WordPress and other applications, and all traffic gets proxied by nginx. I've been occasionally sniffing around for something that I could use to monitor the JS of outbound traffic and give me a heads-up if it smells like one of the sites is delivering something it shouldn't be, but I haven't found a tool for this that I like yet.

Whois on domain and IP.

Try abuse@[domain] or the admin contact listed in WHOIS.

On smaller websites I’d be surprised if 1 in 100 of those goes to a person who reads the email sent there.

And on the 1 who does, they get 40 similar-looking emails per day, all of which are scams, and have learned to ignore them.

NOBODY messages abuse@ I had mine on my domains for decades, never got one single email.

Also admin@… or even legal@… I usually check for a "contact us" web page, too.

To 15,000 email addresses? That's indistinguishable from a small-scale spam campaign.

Spread it through hours, days; use mailgun; use a throwaway google groups like spammers do.

At that point you're a spammer.

Are you trying to get a bounty or something or just want to be responsible?

You can list them all out, with the specific pages/methods that are compromised and shouldn't get much backlash from the owners.

This is a different situation than a CVE

If you want to be paid for your efforts, I dunno :\

They deserve money, they want money, but they don't know how to get paid.

> We continue to reach out directly to those sites that we identify as particularly high impact and try to notify them, though this is happening on an admittedly small scale. The process of responsible disclosure consumes a lot of resources, use of security.txt is low, and the vast majority of our emails and messages go unanswered. It's simply not possible for us to scale this up.

...why?

Some of the sites collect credit card information. Wouldn't they have a 'contact us' or some other legal identity information required for collecting and charging cc's?

Other than looking at security.txt what else have they tried? did they try programmatically checking for a 'contact us'? or the old trick of emailing '[email protected]' or '[email protected]'? did I miss those details in the article?

Maybe things have changed in the past 10 years, but it was a MASSIVE deal if a website ended up on some site claiming it has malware. Like, contract-ending, people-getting-fired, 10s of thousands of dollars in lawyer fees kinda deal.

I don't think 'it's hard' is a good excuse to ignore responsible disclosure

[delayed]

> As these are sites we're crawling and identifying ourselves, we have no contact information like we would for a customer.

It does cost some money, but a possibile solution could be to spin up some agents to search for contact details for each website individually. (For the subset of sites which don't have any findable contact details some other solution would be required.)

Is there no "have I been powned" for websites?

I think something has gone very wrong for you to be doubting the answer.

Responsible disclosure is to prevent harm. You think about your disclosure options and pick the one that is best overall weighing the impact and harm.

They're already infected - or so you claim.

I get that companies want to use responsible disclosure as a mechanism so it can save face and their reputation, and if both are possible at the same time then sure.

But if you think you're right, you have to pick one and live with the consequences; and its not that hard to pick the right choice.

In fact, if you don't make the right choice you need stop misusing the word “responsible disclosure”.

Publish the URLs that prove they're infected. Auto update it whenever one get's fixed.

How do you responsibly disclose to 15 thousand websites?

You don't (well not unless you want to run a mass email campaign that is indistinguishable from spam)

This seems correct? If true, they are currently dangerous to others and they should be called out for it. Why will people be more proactive here if they can just hide their mistakes?

> companies want to use responsible disclosure as a mechanism so it can save face and their reputation

That sounds like the opposite of the goal. The point is the disclosure: telling everyone about a weakness before it can be solved would harm users, but disclosure and resolution is the goal you're working towards. Saving face would be a gag agreement, which many companies indeed have tried, but that's the opposite of companies that publish their procedure for coordinated vulnerability disclosure (also/formerly called responsible disclosure) so that white-hats can report issues without fearing legal action

The rest of your comment is right though: for sites that are already infected, being quiet about it doesn't prevent a vulnerability from being exploited anymore

It’s not a notice of a vulnerability. For all they know it was an employee abusing access. You don’t leave a skimmer on a pump and politely keep sending emails to corporate waiting for a response. You call the cops and they should shut the pumps off until the skimmers are removed. With the amount of AI security report slop and AI extortion spam out there this is basically a service that only the web host can provide.

Yes? That's essentially what I'm saying

Email them - many sites have a contact page with an email address. Tell them what the issue is up front. Be specific and give all the details they need to confirm the issue. Don't ask them to follow up or for payment. These are both red flags as there are so many spammers and scammers out there.

Try automating that for 15k sites and you have a whole new engineering problem in front of you!

It should be more or less possible though. Just not easy.

[delayed]

Almost like we need a "haveibeenpwned" but for websites.

HIBP works fine when you check it every once in a while, but as a mechanism to reach site owners about urgent issues, they'd all have to subscribe to such a central reporting place. Not sure what the advantage is of subscribing to "has my site been pwned" as compared to just having a /security.txt, working WHOIS record, obvious contact page linked from the homepage... lots of ways already

How about you post a search and site owners can find themselves.

Just publish the URLs, duh. Are they trying to keep it secret so they can sell their threat intelligence product?

No, they don’t want to create a target list for attackers. “Duh.”

You must assume that attackers already know. The defenders do not. Better to just release it.

In my opinion, you can and should write them an email. Otherwise you should do nothing because it's not your business. The security of a website is the responsibility of the website owner.

abuse@, postmaster@, hostmaster@ mails were meant to be present for this, but nothing is enforcing s domain to serve email.

[delayed]

Very few people host email, and even fewer in the same VM as where their website is. I would be surprised if this is the case for even 1% of the sites, and attackers probably are exploiting sites by the hundreds, not babysitting and monitoring the email traffic of one of them to quickly delete any vulnerability reports coming in

This works a lot of the time though (include info@ as well). In whois data you can also always find an email contact for abuse notifications

(To be fair, I was a bit annoyed by a recent AI bro spamming about fifteen such prefixes on my domain with a false positive vulnerability report. The PoC did not work and the field they were injecting was already correctly escaped. But it is effective if you're facing a bulk problem like this I suppose)

Divide and conquer.

Group by ASN, and let them handle it.

[delayed]

This. abuse@ works.

Chiming in. abuse@hostingprovider will work.

And yes, it would mean shut the sites down in some cases - the ClickFix stuff for WordPress is near-impossible to clear while the site is online.

here is a mini scriptable command to get started

whois $(dig A +short $DOMAIN) | grep OrgAbuseEmail

[delayed]

no, this script gets the abuse contact for the IP block pointed to by the domain ,(IP block data as reported by the RIR). The whois command may be replaced by rdap although the grepping would need to be changed or replaced with json parsing altogether)

[delayed]

You wont report them or tell them... because it's not a bug it's a feature. The "moral and trustable" big names that hold the doors of the internet could stop you from going to any scam/infested site but they wont... chrome can and actually worked against things that can prevent you from getting there in first place like ublock origin. Things are working as intended... as long as someone is doing money you can basically steal, intercept, and gate what people do (looking at you postman).

I routinely register lapsed malware C2 domains and sinkhole them to collect information on what information they gather. I currently have about 30k infected hosts that phone home every minute or so asking for shell commands to execute. Most of these hosts are on popular providers like HostGator, BlueHost, etc. I've tried reaching out to them to tell them about it but didn't get anywhere.

Hey, OP here!

I've posted an update to address many of the comments here on HN and also across social media, you can find it here:

https://scotthelme.co.uk/we-know-15-579-websites-are-infecte...

You gave email addresses to contact you - for NCSC/CERT and for entities who want to incorporate your threat intelligence data into their protection models.

What's the email address for owners of 1 or 1000 sites to find out if they're listed in your stewpot?

They could just use the same email address if they read the post and want to know.

I appreciate that. A business I know found and cleaned a skimmer this week (Magecart iirc). They may want to know whether their site is listed.

Can't you do a .well-known or DNS handshake (like certbot) so people prove domain ownership, then hand then the report of what you found on their domain?

Predictable. When I was doing this work full time greater than 90% of the code came from outside the organization, such as NPM packages or framework plugins, and nobody reviewed the third party code. Nobody wanted to own the hard problems like security, accessibility, or performance. They just wanted to put text on the screen with JSX and call themselves experts.

DIY - hack'em, patch'em, and gtfo.

Replying to the updated FAQ in this post:

> Since GDPR back in 2018, I've found that data to be mostly useless. What you get is either nothing, a registrar web form, or a relay address

This is the way though. If there is no contact in the domain's whois, then contact the abuse handler for the IP address that it's hosted on

Domain registries (not the registrars) are usually very interested in dead contact methods, at least I've been repeatedly threatened with losing the domain if they find it's not functional. You usually get like two weeks to fix it if issues are found, but they do seem to care. Maybe not .ru (I have no experience with them), but in general I'd let them know and see if that triggers an update before moving to more drastic measures

Another way would be looking for an email address on the homepage or pages linked from the homepage (usually /contact or /impressum or such, but of course this varies)

Lastly, some people may be willing to help out and look for a contact method in a crowdsourced manner. Could also use an LLM but I expect people are more reliable and volunteers are cheaper too

> If the list is widely disseminated and absorbed into blocklists, trying to get your domain of those lists afterwards is close to impossible. For a small business, that could be devastating.

As someone who experienced this (thankfully just a hobby project and not a business), thanks for that consideration! However, I'd encourage this line of action for the ones that are uncontactable. If the site is abandoned, what else are you going to do?

Report the sites or post them in public. It's unethical not to do it. Imagine you go to completely automated store and clearly see there is credit card skimmer attached at every checkout. Do you post online about it and say "but would you think of the store owners" or do you report it?

This is BS. People want the list. End the gate-keeping.

OP Translation: Pay Me

Do it in the most humiliating manner possible. Inform them through email and give them a few days before posting it publicly. You will find that one cares.

I'm assuming a large portion are behind a CDN like cloudflare. Try contacting cloudlfare at https://abuse.cloudflare.com/phishing, you can submit 250 sites at a time. They will contact the site owner for you.

Use https://noscript.net/.

It is annoying for a while until you have whitelisted all the scripts you actually need for the websites you frequently use.

Visiting a new website will mean dealing with allowing scripts for 20sec.

It is also of course not a 100% solution, you still have to be careful. But it is amazing how much crap it filters out.

Maybe build a 'checker' site by which website URLs can be tested by users themselves to see if they are infected and then give them directed advice on how to fix it

And then advertise the 'checker' website.

Whatever happened to well-known mail addressed as defined by RFC 2142?? Every domain should have a webmaster mailbox.

It gets spammed to oblivion.

Contact large DNS providers with security blocks - they will enable warnings for the sites which will reach the owners sooner rather than later.

German websites are required to have an imprint published on their website that clearly identifies the person behind it as well as their email address.

Feed the domain list to an ai and tell it to collect contact addresses. Send them an email.

Or look at the CDNs websites are using, then contact the CDN.

Or, contact the biggest (top 10) hosting providers in each of the countries and speak to them about this issue. Give them access to the list and they should be easily able to check if a site is hosted by them.

You don't need to solve everything at the same time. Just look at the worst offenders and solve them.

Even easier, just subpoena the DNS registrar.

[delayed]

That's mostly up to the country's cybersecurity government division, it's not something a NGO can do. But practically speaking, very few websites on the public internet are truly untraceable. There are very few DNS registrars that accept cash/crypto.

This isn't completly true, not every german website needs this. Only commercial ones, political ones and a few others.

I think the grey area is a bit bigger than that.

The Digitale-Dienste-Gesetz (https://www.gesetze-im-internet.de/ddg/__5.html) in § 5 imposes this requirement on "geschäftsmäßige, in der Regel gegen Entgelt angebotene digitale Dienste", i.e. "services operated in a business-like manner, usually against payment". The key word here is "geschäftsmäßig" (literally translated "in the manner of a business", "business-like"), which within German law is held to be a weaker requirement than "gewerbsmäßig", that is "commercial".

"Geschäftsmäßig" can be anything you keep on doing regularly, independently of any profit motives – you can find a few discussions of that online, and amongst other things, the same term was also used in now-overturned legislation against commercial assisted-suicide, where it caused the same interpretation problems whether doctors or non-profit associations nonetheless might be construed to be acting "geschäftsmäßig" even if they didn't take any payments.

The "usually against payment" bit means that anything done for money can unambiguously by default be presumed to be business-like (and even worse, one possible additional interpretation is that anything other people usually do for money can be argued to be "geschäftsmäßig", too, even if you yourself offer it for free), but the reverse isn't necessarily true.

The other relevant law is the Medienstaatsvertrag (https://www.die-medienanstalten.de/fileadmin/user_upload/Rec...), where an exception from the imprint requirements in § 18 is made only if operated for "persönlichen oder familiären Zwecken", i.e. for "personal or family purposes". (And journalistic offerings, which can potentially cover some blogs or forums for example, are even subject to extended imprint requirements.)

The "family" bit is relatively clear, but "personal" purposes are once again more interpretable. A wide reading of "personal" would indeed cover all sorts of non-commercial hobby pages, though in that case you could ask yourself the question why a separate exception for family purposes would then still be required, too?

A narrower reading of "personal" on the other hand would only cover stuff that's literally only intended for you, like login pages to your personal webmail or Nextcloud instances, your private picture or file hosting and similar things. Some lawyers even go as far as including a private diary (that for some reason however you decide to publish online and even without password protection) within the category of "personal" things (though depending how much your diary refers to identifiable outside entities, it could also be construed to be a journalistic offering and therefore definitely subject to imprint requirements), but that's about the limit.

Hobby pages intended for the non-specific general public (outside of just family and friends) are therefore very much in a grey area as to when exactly the imprint requirements are starting to become applicable even if you don't do any ads at all.

Let's say you get the javascript submitted to virus total and it holds the hash as suspicious or malicious, then hopefully that gives organizations in the network or execution chain ability to block them from being fetched or exexuted by the browser, probably too far fetched.

would love to know, how you gonna handled this, currently tbh I don't know but if you found any solutuion, please let us know

And that's only for the websites they know of.

If we know what bad javascript malware is out there and how to recognise it, then browsers could have an antivirus, to block the offending code? As an opt-out feature, not opt-in, where known actively malicious JS would be scanned for and removed. Presumably, a number of compromised websites were compromised once and attackers aren't going around updating all their malware in all their compromised servers as soon as they get blocked?

Then again, the web is getting so bloated already, even suggesting that we make everything slower in order to filter out the known harmful bloat makes me shudder

The OP is sort of begging the question of why not immediately block the sites, without notifying them at all.

But to me both answers to "why not use WHOIS" data and "why not guess the email address" is unsatisfying. Yes, a lot of sites will not be reachable, but a lot might still be. Instead, they apparently didn't even try?

First, look for the /security.txt [0] file.

[0]: https://securitytxt.org/

so you can scrape these domains and see if they are infected, but you cant scrape to get an email?

Back in the day, when we followed the RFCs, we all had Abuse@domain emails that we checked.

Then spammers abused them, and big companies stopped checking them. Now, even I keep my domain registration contact data private because of the hundreds of idiots who apam me about building websites and apps.

I humbly suggest the solution is airstrikes to eliminate spammers, then we can go back to checking our abuse@domain emails.