Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We tested popular web hosting companies and all were easily hacked

websiteplanet.com

Post reply on HN
Print view View original

11–20 of 52 posts

Re: We tested popular web hosting companies and all were easily hacked

#11

Post by Spooky23 »

EricE wrote: post #3

I always assumed cheap hosts were terrible, but this is mind boggling incompetence beyond what I would have imagined.

Don't assume cheap is bad.

Always assume that service providers are:

- Blithering idiots until proven otherwise.

- Not performing a task that isn't explicitly committed to in the service description or contract. If something is left unsaid, that it isn't happening.

- Not performing a task that they aren't solely accountable for. If you "share" a responsibility, it is your responsibility.

Re: We tested popular web hosting companies and all were easily hacked

#12

Post by perlgeek »

EricE wrote: post #3

I always assumed cheap hosts were terrible, but this is mind boggling incompetence beyond what I would have imagined.

> but this is mind boggling incompetence

I disagree. It's very easy to make such mistakes, often even to miss them in code review. You also cannot simply cover all potential errors in integration tests, because there are infinitely many potential errors you can make.

You need continuous or regular red-teaming or comparable security controls to reliably avoid such things, and you typically only have those at the really big and high-tech companies, or in highly attacked or regulated environments.

Re: We tested popular web hosting companies and all were easily hacked

#14

Post by at-fates-hands »

perlgeek wrote: post #12
EricE wrote: post #3

I always assumed cheap hosts were terrible, but this is mind boggling incompetence beyond what I would have imagined.

> but this is mind boggling incompetence I disagree. It's very easy to make such mistakes, often even to miss them in code review. You also cannot simply cover all potential errors in integration tests, because there are infinitely many potential errors you can make. You need continuous or regular red-teaming or comparable security controls to reliably avoid such things, and you typically only have those at the reall…

The other huge point is it's easy to get some regular Red Team penetration testing, it's quite another thing to get what the Red Team found in their analysis mitigated properly in a timely fashion.

I have several friends who are on Red Teams working for pretty visible info sec companies. The one thing they always harp on is going back to test a companies network or physical infrastructure and finding most, if not all of the necessary fixes have not been corrected from their last visit.

You're right, big companies do have regular testing, but you'd be surprised how slowly those holes and issues actually get fixed.

Re: We tested popular web hosting companies and all were easily hacked

#15

Post by omarhaneef »

I wish they had kept going till they found a web hosting firm that didn't have these issues. Can anyone -- not affiliated with such a firm -- recommend one?

If you are affiliated with such a firm, and you respond anyway, please explain what you do differently.

Re: We tested popular web hosting companies and all were easily hacked

#16

Post by joshdance »

joshdance wrote: post #4

Has anyone asked for a comment from any of these companies? Seems like a big security problem.

I emailed Bluehost, this is the response I got.

Hello Joshua,

Thank you for reaching out to Bluehost via our press@ email address; as a brief introduction, I am writing you from Endurance International Group, parent company to Bluehost and several other web hosting services. In regards to your questions for how to best protect your website, one of the best things you can do to invest in your business is to acquire web security, something like Sitelock, to protect you from malware. Below you will find the following: i.) article from Sucuri.net explaining more about website security, and ii.) information to speak to Bluehost representatives more in depth about our partnership with Sitelock and help you set up that addon service, if this is what you wish.

i.) https://sucuri.net/guides/website-security/ ii.) 888-401-4678 | https://helpchat.bluehost.com/

Kind regards,

Jacob Endurance International Group

Re: We tested popular web hosting companies and all were easily hacked

#17

Post by judge2020 »

omarhaneef wrote: post #15

I wish they had kept going till they found a web hosting firm that didn't have these issues. Can anyone -- not affiliated with such a firm -- recommend one? If you are affiliated with such a firm, and you respond anyway, please explain what you do differently.

Wordpress.com / Automattic I suppose, they look like they know what they're doing (no affiliation)

Re: We tested popular web hosting companies and all were easily hacked

#18

Post by bhhaskin »

omarhaneef wrote: post #15

I wish they had kept going till they found a web hosting firm that didn't have these issues. Can anyone -- not affiliated with such a firm -- recommend one? If you are affiliated with such a firm, and you respond anyway, please explain what you do differently.

https://pantheon.io/

Not affiliated, but worked with some high profile sites on there.

Re: We tested popular web hosting companies and all were easily hacked

#19

Post by jszymborski »

joshdance wrote: post #16
joshdance wrote: post #4

Has anyone asked for a comment from any of these companies? Seems like a big security problem.

I emailed Bluehost, this is the response I got. Hello Joshua, Thank you for reaching out to Bluehost via our press@ email address; as a brief introduction, I am writing you from Endurance International Group, parent company to Bluehost and several other web hosting services. In regards to your questions for how to best protect your website, one of the best things you can do to invest in your business is to acquire we…

"You got hacked because you didn't give us enough money"... these guys should get into the Ransomware business.

Re: We tested popular web hosting companies and all were easily hacked

#20

Post by cyborgx7 »

joshdance wrote: post #16
joshdance wrote: post #4

Has anyone asked for a comment from any of these companies? Seems like a big security problem.

I emailed Bluehost, this is the response I got. Hello Joshua, Thank you for reaching out to Bluehost via our press@ email address; as a brief introduction, I am writing you from Endurance International Group, parent company to Bluehost and several other web hosting services. In regards to your questions for how to best protect your website, one of the best things you can do to invest in your business is to acquire we…

pathetic
Post reply on HN