Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: I can't tell why my site is showing malware warning.

news.ycombinator.com

Post reply on HN
Print view View original

1–10 of 44 posts

Ask HN: I can't tell why my site is showing malware warning.

#1

Post by balsamiq »

UPDATE: we took down our site for now. Thanks all.

UPDATE: STAY AWAY FROM OUR SITE, it seems like it's compromised for real (even though all the official signs point to the opposite). I have asked WPEngine to turn it off immediately.

----

Hello HN, I hope there's some googler here who can help me.

My website http://balsamiq.com has started showing a malware warning in Chrome (and intermittently in Firefox as well) about 20 minutes ago.

The interesting thing is that the Google Diagnostics page here: http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=http%3A%2F%2Fbalsamiq.com%2F&client=googlechrome&hl=en-US says we're clean.

Also, Google Webmaster tools says we're clean as well, so there's no way to request a review for them.

Also, http://www.stopbadware.org/home/reportsearch doesn't show anything for balsamiq.com.

OK so if my site is clean, which I think/hope it is, why it showing the warning and what can I do about it?

Sorry if this is not really "news" but I hope there's someone here who has had this issue before...

Re: Ask HN: I can't tell why my site is showing malware warning.

#3

Post by nodata »

The only part that is relevant to you is the last part:

"In some cases, third parties can add malicious code to legitimate sites, which would cause us to show the warning message."

So maybe you sourced some external javascript or advertising that contained something bad.

Edit: what does that obfuscated code at the top of the html do? http://pastebin.com/u3T3wJcG

Edit2: I think it's a bit irresponsible to post a page that has been marked as containing malware to a highly trafficked website. You could have at least run it through some alternative scanners first.

Re: Ask HN: I can't tell why my site is showing malware warning.

#4

Post by relix »

Chrome uses a bloom filter[1] to check a URL against a list of known malware sites. It's possible your URL, by coincidence, has become a false positive.

However the article also mentions that once found in the bloom hashes, Chrome checks in with HQ if the URL is malware or not, probably to avoid false positives. Maybe these servers are down, and Chrome by default marks all (false) positives as malware without checking with HQ.

Keep in mind that this is the web security's equivalent of saying "my program doesn't work because there's a bug a in the compiler", it should be pretty low on the probability list.

[1]: http://blog.alexyakunin.com/2010/03/nice-bloom-filter-applic...

Re: Ask HN: I can't tell why my site is showing malware warning.

#5

Post by balsamiq »

knes wrote: post #2

Do you run a Wordpress Blog? Is it up to date? There was a big "Hack" going around last month on the wordpress platform.

Yes it's Wordpress, managed by WPEngine and updated (we're on 3.2.1 right now). The guys at WPEngine are looking into it, waiting for info from them as well (I'll report back here).

Re: Ask HN: I can't tell why my site is showing malware warning.

#7

Post by danielh »

FWIW, I just visited your site and it contained some compressed JavaScript at the top and a broken link to http: // gsdgsd.freewww.biz/showthread.php?t=72881717 (slightly obfuscated to avoid accidential clicks). It was gone after a reload, so I can't give you any more information.

Re: Ask HN: I can't tell why my site is showing malware warning.

#8

Post by DuqE »

balsamiq wrote: post #5
knes wrote: post #2

Do you run a Wordpress Blog? Is it up to date? There was a big "Hack" going around last month on the wordpress platform.

Yes it's Wordpress, managed by WPEngine and updated (we're on 3.2.1 right now). The guys at WPEngine are looking into it, waiting for info from them as well (I'll report back here).

Like nodata said, you might want to take a look at third-party plugins / add-ons. My friend had an issue with using a third-party advertising company to run adverts on his site and firefox / chrome flagged the JS it embedded as malicious.

Re: Ask HN: I can't tell why my site is showing malware warning.

#9

Post by balsamiq »

danielh wrote: post #7

FWIW, I just visited your site and it contained some compressed JavaScript at the top and a broken link to http: // gsdgsd.freewww.biz/showthread.php?t=72881717 (slightly obfuscated to avoid accidential clicks). It was gone after a reload, so I can't give you any more information.

wow this is definitely a hint. The WPEngine guys are looking into it now.
Post reply on HN