Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Microsoft SmartScreen is destroying our business

news.ycombinator.com

Post reply on HN
Print view View original

131–140 of 206 posts

Re: Ask HN: Microsoft SmartScreen is destroying our business

#131

Post by celestialcheese »

jcrawfordor wrote: post #9

Very important that you develop complete confidence that there isn't anything wrong with your product. It's not uncommon, in fact it's very common, for compromise kits for websites to take measures to avoid detection. A common one is only serving the malicious content when a specific referrer is present (I've seen this be Yahoo Search in the case of compromised Drupal installations multiple times, not really sure why…

Hijacking for tangentially related question:

> It might be wise to engage a security firm to conduct an investigation if you don't have in-house expertise in this area.

Any good security firms you recommend for a small to midsize website?

Re: Ask HN: Microsoft SmartScreen is destroying our business

#132

Post by Eleison23 »

WesolyKubeczek wrote: post #96
missedthecue wrote: post #86

When this happened to my software product I fixed it by purchasing a Comodo EV code signing certificate. It cost me $502, it was FedExed to me in a USB, and I signed my program. Tens of thousands of installs later, I have never had an issue with smart screen. Note that there are two types of code signing certs, you want the EV Code Signing Certificate. It will instantly give your program reputation that ends the smar…

Looks like protection racket.

Well, when you're driving and you get pulled over, you show your driver's license to the police and they don't arrest you for driving without a license.

It seems like asking to run code on other people's machines is a privilege, too. Unfortunately the World Wide Web has trained consumers to grant that privilege willy-nilly to every web page they visit. I am thankful that code signing and validation is ending the party in that way.

Re: Ask HN: Microsoft SmartScreen is destroying our business

#133

Post by gw99 »

I had problems with Windows Defender finding a false positive in the output of a product I was working on. This was an EV code signed MSI package with signed exe. This eventually inflamed SmartScreen and despite getting the thing sorted as a false positive by the AV guys it took 3 months for it to stop being flagged.

After working on Microsoft dev for ~20 years, 2019 was the last thing I touched. I handed everything else over and moved on. I will NEVER deal with that company again. Nothing but fucking shit for that entire time. The grass /is/ greener on the other side.

Re: Ask HN: Microsoft SmartScreen is destroying our business

#134

Post by _8j50 »

ascar wrote: post #93
_8j50 wrote: post #72

Earlier quoted context omitted.

MS is already stopping the bad guys by blocking the domain. You are supposed to do proper IR and clean up after yourseld including finding out the cause of the compromise which MS can't help with. What happens in the real world is people delete the file or webshell and think the bad guys are gone and if MS unblocks them then the campaign continues. Or the bad guys themselves do that pretending to be the site owner. M…

What are you even talking about? What is IR? What happens is a website is blocked and the site operator has no idea why. The defense of "we can't share any information as to why you got punished as it might help bad actors avoid punishment" should not be an acceptable stance. It's the equivalent of being thrown to prison without due process and just ignoring false positives. It's a very "natural" way of acting, but t…

IR is incident response, it means you find out everything the bad guys did and how it was compromised and fix it all. You should contact a security company or professional to help you if you don't know. I have used the webshells of compromised sites where the owner tries to cleanup but the webshell is still there hosting different campaigns.

You should secure your site better and have someone who knows what they are doing (there are paid WAF and web security vendors) monitor and respond to security incidents. You are not being punished, MS is protecting its customers. You should blame the hacker not MS for the impact of the hack. It's like someone messed with your car tank and tires and the police stop you from driving it because it is unsafe to other drivers, they are not punishing you but protecting other people from being hurt by your property.

Re: Ask HN: Microsoft SmartScreen is destroying our business

#135

Post by bell-cot »

krisoft wrote: post #109
BoorishBears wrote: post #88

Earlier quoted context omitted.

How on earth does it do that? If I put malware at xyz.com/mybadpage and MS starts flagging xyz.com, how on earth do I "maximize campaign life" by being told xyz.com/mybadpage has malware?

Imagine that you have put malware in xyz.com/mybadpage1, xyz.com/mybadpage2, and xyz.com/mybadpage3 pages. MS flags you, and you query MS. They tell you they see malware on the first two urls. Now you gained information about their blindspots. You can capitalise on this multiple ways. You can remove the first two and hope they remove the flag. You can design your next attack better so it is more like mybadpage3. Etc

Disagree: $Evil_Site_Owner can easily test MS's blind spots by putting malware on numerous web sites, then seeing which of those sites are flagged. And if MS is not systematically scanning all the URLs...well, "MS failed to notice malware at $URL, which my web server logs say MS has not visited" is pretty useless information.

(Not that I think MS should enumerate malicious URL's, unless $Site_Owner is paying for scanning service. A "we noticed malware at $URL" is generally 95% of the possible value of such disclosures.)

Re: Ask HN: Microsoft SmartScreen is destroying our business

#136

Post by stickfigure »

freedomben wrote: post #79
nvr219 wrote: post #76

People talking about is it a false flag, real flag... Post your SaaS URL and you'll get a free security assessment from a dozen hners.

That's undoubtedly true, but you'll also get a lot of assholes and script kiddies hoping to pwn your site for lulz, and they often don't care who gets hurt along the way. By posting you've just given them an easy legal defense. If it were me, I wouldn't do it. Not worth the risk. I would however, probably be willing to DM people individually after doing a small amount of due diligence on their comment history. I gues…

That is such a weird take. You get assholes and script kiddies the moment your IP interface starts accepting packets. If you don't advertise to people who can help you (be it customers or potential advocates/partners) then what on earth are you doing?

I put my company's website in my HN profile. Go ahead, make my day.

(I'm not the OP and as far as I know don't have any security issues)

Re: Ask HN: Microsoft SmartScreen is destroying our business

#137

Post by _8j50 »

salawat wrote: post #121
_8j50 wrote: post #73

Earlier quoted context omitted.

I have no idea what your post is about but from MS's perspective it isn't the site owners but MS's users around the world that are victims of thr threat actor that need protection. If it truly is a compromised site then the site owner is also a victim but as owners it is also their duty to secure and cleanup their site that is currently endangering the public.

Microsoft is not the Guardian of the World. If they take it upon themselves to act as such without being a responsible Netizen (cooperating with other site operators to provide a higher quality Net) then they are more interested in cementing their own position rather than being a part of a civilized Net. Imagine if I just suddenly started spreading around rumors of your malfeasance and shadyness, and untrustworthynes…

They are not guarding the world but their windows users that don't use chrome but edge and IE (MS browsers) in this case, google and firefox also do this by default.

Leave it to HN to get me to defend even MS lol.

Re: Ask HN: Microsoft SmartScreen is destroying our business

#138

Post by [deleted] »

missedthecue wrote: post #86

When this happened to my software product I fixed it by purchasing a Comodo EV code signing certificate. It cost me $502, it was FedExed to me in a USB, and I signed my program. Tens of thousands of installs later, I have never had an issue with smart screen. Note that there are two types of code signing certs, you want the EV Code Signing Certificate. It will instantly give your program reputation that ends the smar…

[deleted]

Re: Ask HN: Microsoft SmartScreen is destroying our business

#139

Post by bell-cot »

mrguyorama wrote: post #80
bell-cot wrote: post #37

Earlier quoted context omitted.

Just "we detected malware spreading from your site" would sure narrow things down a lot. Time to inspect the web server access logs, 'diff' the site contents with a month-old backup, etc.

They should be doing exactly that anyway.

Just as all Americans should be driving at no more than the speed limit...

Re: Ask HN: Microsoft SmartScreen is destroying our business

#140

Post by dathinab »

dylan604 wrote: post #81
Dylan16807 wrote: post #58

Earlier quoted context omitted.

Saying they detected malware already does that. Being slightly more specific shouldn't be a problem.

Sure, maybe not display it in the publicly visible warnings, but if the admins of a domain email you from the same domain as the flagged site, then maybe providing more detail at that point is an acceptable method of fixing the issue. Saying "we know you are compromised and know exactly where, but we're not going to tell" is very childish. Now, if they said for a nomial fee, we'd be happy to share the results of our…

"we know you are compromised and know exactly where, but we're not going to tell"

The sad think is they didn't even tell that, they gave the admins no ways to be able to differentiate between:

- we don't care if we destroy your company with a false positive and

- we are sure we are right, if you didn't do it intentionally you are probably compromised

Post reply on HN