Ask HN: I can't tell why my site is showing malware warning. • Hacker News Board

Re: Ask HN: I can't tell why my site is showing malware warning.

#11

Post by gcp » Wed, Oct 05, 2011, 1:37 PM UTC

relix wrote: post #4

Chrome uses a bloom filter[1] to check a URL against a list of known malware sites. It's possible your URL, by coincidence, has become a false positive. However the article also mentions that once found in the bloom hashes, Chrome checks in with HQ if the URL is malware or not, probably to avoid false positives. Maybe these servers are down, and Chrome by default marks all (false) positives as malware without checkin…

Firefox uses a filter that doesn't give false positives [1]. If your site is blocked (even intermittently) there, it is in Google's malware list.

[1] Actually, the odds are 1 in 2^128 if Google's servers are up, and 2^32 if Google's servers are down.

Re: Ask HN: I can't tell why my site is showing malware warning.

#12

Post by balsamiq » Wed, Oct 05, 2011, 1:49 PM UTC

nodata wrote: post #3

The only part that is relevant to you is the last part: "In some cases, third parties can add malicious code to legitimate sites, which would cause us to show the warning message." So maybe you sourced some external javascript or advertising that contained something bad. Edit: what does that obfuscated code at the top of the html do? http://pastebin.com/u3T3wJcG Edit2: I think it's a bit irresponsible to post a page…

We are asking WPEngine to turn off our server immediately.

Re: Ask HN: I can't tell why my site is showing malware warning.

#13

Post by kevinburke » Wed, Oct 05, 2011, 1:49 PM UTC

I used to see this type of problem at Google.

Your site may have been hacked. Check the site:balsamiq.com search for injected hacked pages. Check also for injected text being hidden by CSS, and try if you can to view your site through a proxy like HideMyAss, to see if they are showing you one version of the page and showing users a different one.

Also, if Google knows your site's hacked, there should be a message inside the Webmaster Tools account for balsamiq.com - check there for more information.

Re: Ask HN: I can't tell why my site is showing malware warning.

#14

Post by balsamiq » Wed, Oct 05, 2011, 1:51 PM UTC

kevinburke wrote: post #13

I used to see this type of problem at Google. Your site may have been hacked. Check the site:balsamiq.com search for injected hacked pages. Check also for injected text being hidden by CSS, and try if you can to view your site through a proxy like HideMyAss, to see if they are showing you one version of the page and showing users a different one. Also, if Google knows your site's hacked, there should be a message ins…

That's the thing, Google Webmaster tools says we're all OK! Maybe it just takes a while to notice internally?

Re: Ask HN: I can't tell why my site is showing malware warning.

#15

Post by balsamiq » Wed, Oct 05, 2011, 1:55 PM UTC

fduran wrote: post #6

Run this just in case (free) http://www.qualys.com/forms/trials/stopmalware/

Ran without finding anything.

Re: Ask HN: I can't tell why my site is showing malware warning.

#16

Post by balsamiq » Wed, Oct 05, 2011, 1:58 PM UTC

balsamiq wrote: post #14

kevinburke wrote: post #13

I used to see this type of problem at Google. Your site may have been hacked. Check the site:balsamiq.com search for injected hacked pages. Check also for injected text being hidden by CSS, and try if you can to view your site through a proxy like HideMyAss, to see if they are showing you one version of the page and showing users a different one. Also, if Google knows your site's hacked, there should be a message ins…

That's the thing, Google Webmaster tools says we're all OK! Maybe it just takes a while to notice internally?

Update: Webmaster tools finally woke up and is reporting malware. I guess I should have just waited 30 minutes???? How can their outside systems be updated but not the admin pages they send me to in order to fix the issue? Grrr...

Re: Ask HN: I can't tell why my site is showing malware warning.

#17

Post by bphogan » Wed, Oct 05, 2011, 2:04 PM UTC

balsamiq wrote: post #9

danielh wrote: post #7

FWIW, I just visited your site and it contained some compressed JavaScript at the top and a broken link to http: // gsdgsd.freewww.biz/showthread.php?t=72881717 (slightly obfuscated to avoid accidential clicks). It was gone after a reload, so I can't give you any more information.

wow this is definitely a hint. The WPEngine guys are looking into it now.

Happened to seven WP sites I maintain. It's a script and someone got into an account. The script finds all .php and .htm files and adds stuff to the top. If you only have wordpress files, it's an easy fix - reset the password and get a different template.

Re: Ask HN: I can't tell why my site is showing malware warning.

#18

Post by pierrefar » Wed, Oct 05, 2011, 2:05 PM UTC

Hi

I work at Google helping webmasters. Hopefully there won't be a next time, but for reference, your best bet is to post in our forum specifically about this type of issue: http://www.google.com/support/forum/p/Webmasters/label?lid=2...

For your specific case, unfortunately it can be anything. Start at the HTML and JS and see if it's different in ways you don't expect. Check for obfuscation techniques like base64 encoded PHP code, or JS code in libraries that is not in the original distribution. It really can be anything. Also check your .htaccess, any CMS and its plugins, etc. Really check everything.

That should identify the issue. Once you do, fix it, and try to understand why it happened. Was your FTP password compromised? Was it a known vulnerability in your CMS? Was it a rogue plugin you installed by mistake? Identifying the attack vector is very important as you will need to close it too. Otherwise all your hard work fixing the site will be undone in no time.

Also be sure to check any other parts of your site: the attacker might have entered through one CMS (say a forum) and compromised another (say a blog).

That's basically a summary of what you need to be doing. We have a very detailed guide about dealing with hacked sites: http://www.google.com/support/webmasters/bin/answer.py?answe... . It recommends quarantining the site and returning HTTP 503. That's a very good first step.

And if you need more help, seriously, the forum I linked to above has a great community that knows a lot about identifying and fixing these issues.

Hope this helps, Pierre

Re: Ask HN: I can't tell why my site is showing malware warning.

#19

Post by suhastech » Wed, Oct 05, 2011, 2:05 PM UTC

balsamiq wrote: post #5

knes wrote: post #2

Do you run a Wordpress Blog? Is it up to date? There was a big "Hack" going around last month on the wordpress platform.

Yes it's Wordpress, managed by WPEngine and updated (we're on 3.2.1 right now). The guys at WPEngine are looking into it, waiting for info from them as well (I'll report back here).

Might be the timthumb vulnerability?

Re: Ask HN: I can't tell why my site is showing malware warning.

#20

Post by DanielStraight » Wed, Oct 05, 2011, 2:07 PM UTC

bphogan wrote: post #17

balsamiq wrote: post #9

Earlier quoted context omitted.

wow this is definitely a hint. The WPEngine guys are looking into it now.

Happened to seven WP sites I maintain. It's a script and someone got into an account. The script finds all .php and .htm files and adds stuff to the top. If you only have wordpress files, it's an easy fix - reset the password and get a different template.

What does the attack do for those who visited the site trying to figure out what was going on?