Report each domain to the major browser vendors so they can update their list of suspicious sites?
I believe the default configuration for suspected spam and phishing and other malicious sites is that the user gets a red warning page that they have to click through first. Website owner would either get notifications from users or notice the drop off in traffic?
phyzome 15 minutes ago [-]
Yeah, this is probably the right answer. Immediately protects users, and website owners would quickly find out as well. :-)
Primary obligation is to the users, not the owners of websites that got themselves infected.
sublinear 5 minutes ago [-]
> Supply chain - a third-party script file that a site loads is infected with malware, and is then loaded on to the site, exposing all visitors.
I already know many will disagree, but this is far too vague for your answer to make much sense.
Most websites have at least one analytics script. Some of the biggest vendor names in that space have known XSS issues via nonce reuse that they aren't going to fix because it threatens their entire business model.
You usually get the whole clown car as soon as you allow one 3rd-party script for relatively innocent use cases like wanting a heatmap of user interaction.
thaumaturgy 7 minutes ago [-]
Tangential but related: can anyone point me towards what tools are being used to identify this kind of malicious JS?
I host a modest pile of WordPress and other applications, and all traffic gets proxied by nginx. I've been occasionally sniffing around for something that I could use to monitor the JS of outbound traffic and give me a heads-up if it smells like one of the sites is delivering something it shouldn't be, but I haven't found a tool for this that I like yet.
Guestmodinfo 29 minutes ago [-]
Make a website,
name it 15579infected.com and name everywebsite.
Most of the website owners would soon wise up by word of mouth and visit your website and most probably contact you and you tell them what vulnerability each one has so they can rectify.
You can charge them for your service.
henearkr 2 minutes ago [-]
This is the right move. Contrary to what the other comment says, this is not "name and shame".
Instead, this is a database, useful to check for website owners to see if their site is listed inside.
This would be an idea very similar to haveibeenpwned.com, which is immensely helpful.
sampaio96 22 minutes ago [-]
Don't do that dude.
ryandrake 24 minutes ago [-]
Exactly. This is not rocket science. Name and shame. Sort by estimated traffic.
wlkr 18 minutes ago [-]
As someone in the UK, I'd expect something along the lines of (1) reporting to the website owner by email and if they don't respond then just (2) reporting it to the police. It used to be common to go to the hosting provider but I'm not sure if people still do that anymore. At this scale it would be kind to do (1) but also just jumping to (2) seems like more than enough to have 'done the right thing'.
Work to add them to Google Safe Browsing blocklist (Why are they not on the list anyway? Surely Google will be interested in their technique)
Google, Facebook, Bing, other large platforms will get those websites blocked. Their traffic falls almost to zero. Then:
either web admin notices and fixes website
or people stop visiting yhem
either way, no more infected people, win for everyone.
boothby 22 minutes ago [-]
The old answer: communicate with major search engines and browser vendors. Dunno what to tell you now...
superkuh 19 minutes ago [-]
In the old days you'd just do a whois of the domain name and email the system administrator or tech contact. But GDPR made whois data illegal and destroyed that system so now there is no way to contact anyone unless you both happen to be on the same corporate walled garden (facebook, twitter, etc) they might list on their site.
iagiagiag 9 minutes ago [-]
It's still possible to use whois data. Most of the time it'll be an abuse@ email address from a provider and they can forward the message to the real admin, or they could directly block the website if you explain the issue.
vaylian 16 minutes ago [-]
The problem is not the GDPR, but the fact that this public contact data was abused. If some assholes had not decided to spam people, we would probably still have public contact info.
phyzome 17 minutes ago [-]
whois was effectively dead well before GDPR -- most people used registration privacy services to hide their mailing address, phone number, etc.
pizzafeelsright 14 minutes ago [-]
You could send an interview request to their technical staff with an assignment that injects the fix into their production environment.
I suspect that these problems exist everywhere at this moment in all major systems.
Perhaps a bot to attempt to make contact and alert the staff.
brink 10 minutes ago [-]
I like to imagine a rogue good-samaritan will go around "hacking" these websites to apply security fixes before logging out.
It's too bad that such a person would likely end up arrested if they don't mask their identity.
zzzeek 15 minutes ago [-]
oh by all means email them all directly saying you found a vulnerability.
im sure for 15,579 websites there will only be about 2500 of them that send the cops after you for "hacking their site", manageable
haukebri 4 minutes ago [-]
[flagged]
Kenji 27 minutes ago [-]
[dead]
DivingForGold 32 minutes ago [-]
Heh.
My primitive websites are FREE of all javascript, the tool by which advertisers and corporation anger us with Paywalls, Nag screens and the like.
Hope all of them explode.
analog8374 20 minutes ago [-]
Heck yes
31 minutes ago [-]
Rendered at 19:09:00 GMT+0000 (Coordinated Universal Time) with Vercel.
I believe the default configuration for suspected spam and phishing and other malicious sites is that the user gets a red warning page that they have to click through first. Website owner would either get notifications from users or notice the drop off in traffic?
Primary obligation is to the users, not the owners of websites that got themselves infected.
I already know many will disagree, but this is far too vague for your answer to make much sense.
Most websites have at least one analytics script. Some of the biggest vendor names in that space have known XSS issues via nonce reuse that they aren't going to fix because it threatens their entire business model.
You usually get the whole clown car as soon as you allow one 3rd-party script for relatively innocent use cases like wanting a heatmap of user interaction.
I host a modest pile of WordPress and other applications, and all traffic gets proxied by nginx. I've been occasionally sniffing around for something that I could use to monitor the JS of outbound traffic and give me a heads-up if it smells like one of the sites is delivering something it shouldn't be, but I haven't found a tool for this that I like yet.
This would be an idea very similar to haveibeenpwned.com, which is immensely helpful.
https://www.ncsc.gov.uk/section/about-this-website/report-sc...
Google, Facebook, Bing, other large platforms will get those websites blocked. Their traffic falls almost to zero. Then:
either web admin notices and fixes website
or people stop visiting yhem
either way, no more infected people, win for everyone.
I suspect that these problems exist everywhere at this moment in all major systems.
Perhaps a bot to attempt to make contact and alert the staff.
It's too bad that such a person would likely end up arrested if they don't mask their identity.
im sure for 15,579 websites there will only be about 2500 of them that send the cops after you for "hacking their site", manageable
My primitive websites are FREE of all javascript, the tool by which advertisers and corporation anger us with Paywalls, Nag screens and the like.
Hope all of them explode.