We know 15k websites are infected. how do we tell them?

Report each domain to the major browser vendors so they can update their list of suspicious sites?

I believe the default configuration for suspected spam and phishing and other malicious sites is that the user gets a red warning page that they have to click through first. Website owner would either get notifications from users or notice the drop off in traffic?

Make a website, name it 15579infected.com and name everywebsite. Most of the website owners would soon wise up by word of mouth and visit your website and most probably contact you and you tell them what vulnerability each one has so they can rectify. You can charge them for your service.

Work to add them to Google Safe Browsing blocklist (Why are they not on the list anyway? Surely Google will be interested in their technique)

Google, Facebook, Bing, other large platforms will get those websites blocked. Their traffic falls almost to zero. Then:

either web admin notices and fixes website

or people stop visiting yhem

either way, no more infected people, win for everyone.

I think something has gone very wrong for you to be doubting the answer.

Responsible disclosure is to prevent harm. You think about your disclosure options and pick the one that is best overall weighing the impact and harm.

They're already infected - or so you claim.

I get that companies want to use responsible disclosure as a mechanism so it can save face and their reputation, and if both are possible at the same time then sure.

But if you think you're right, you have to pick one and live with the consequences; and its not that hard to pick the right choice.

In fact, if you don't make the right choice you need stop misusing the word “responsible disclosure”.

Publish the URLs that prove they're infected. Auto update it whenever one get's fixed.

Report the sites or post them in public. It's unethical not to do it. Imagine you go to completely automated store and clearly see there is credit card skimmer attached at every checkout. Do you post online about it and say "but would you think of the store owners" or do you report it?

Tangential but related: can anyone point me towards what tools are being used to identify this kind of malicious JS?

I host a modest pile of WordPress and other applications, and all traffic gets proxied by nginx. I've been occasionally sniffing around for something that I could use to monitor the JS of outbound traffic and give me a heads-up if it smells like one of the sites is delivering something it shouldn't be, but I haven't found a tool for this that I like yet.

Divide and conquer.

Group by country, and let them handle it.

https://www.edpb.europa.eu/contact/notify-a-data-breach_en

But I think you are asking the wrong question. The challenge is how to minimize damage.

I routinely register lapsed malware C2 domains and sinkhole them to collect information on what information they gather. I currently have about 30k infected hosts that phone home every minute or so asking for shell commands to execute. Most of these hosts are on popular providers like HostGator, BlueHost, etc. I've tried reaching out to them to tell them about it but didn't get anywhere.

Hey, OP here!

I've posted an update to address many of the comments here on HN and also across social media, you can find it here:

https://scotthelme.co.uk/we-know-15-579-websites-are-infecte...

Try abuse@[domain] or the admin contact listed in WHOIS.

Are you trying to get a bounty or something or just want to be responsible?

You can list them all out, with the specific pages/methods that are compromised and shouldn't get much backlash from the owners.

This is a different situation than a CVE

If you want to be paid for your efforts, I dunno :\

Hi @speckx I'm going to guess that there won't be 15K hosting providers behind all of those websites...so I suggest considering the following:

* If its feasible to do, try to programmatically discover the hosting providers behind the websites...This probably brings the total number of recipients to a much smaller list.

* Then very very politely inform the hosting providers of the situation. Basically, you'd be emailing the OVHs, Hetzners, digital Ocean, HostGators, etc. of the online world.

Typically a website owner will pay attention to messages from their hosting provider...and i will assume such providers get similar notifications a lot...maybe they even have automated processes to send/forward along messages o site owners.

Although i do stress be very polite, because you don't want the providers to slam hard closed the websites before disclosing to *their* customers (the website owners)...You want disclosure, not a sort of "uninformed take down via bureacracy" of their websites. If the above process works, then public shaming is avoided, the folks who control the infrastructure (hosting providers) are informed, and they handle management with the site owners, and other parties who would have received your email but may not know more efficient methods to handle this (like the local police) are not distracted from their other important work. I hope this helps!

As someone in the UK, I'd expect something along the lines of (1) reporting to the website owner by email and if they don't respond then just (2) reporting it to the police. It used to be common to go to the hosting provider but I'm not sure if people still do that anymore. At this scale it would be kind to do (1) but also just jumping to (2) seems like more than enough to have 'done the right thing'.

https://www.ncsc.gov.uk/section/about-this-website/report-sc...

abuse@, postmaster@, hostmaster@ mails were meant to be present for this, but nothing is enforcing s domain to serve email.

Is there no "have I been powned" for websites?

Replying to the updated FAQ in this post:

> Since GDPR back in 2018, I've found that data to be mostly useless. What you get is either nothing, a registrar web form, or a relay address

This is the way though. If there is no contact in the domain's whois, then contact the abuse handler for the IP address that it's hosted on

Domain registries (not the registrars) are usually very interested in dead contact methods, at least I've been repeatedly threatened with losing the domain if they find it's not functional. You usually get like two weeks to fix it if issues are found, but they do seem to care. Maybe not .ru (I have no experience with them), but in general I'd let them know and see if that triggers an update before moving to more drastic measures

Another way would be looking for an email address on the homepage or pages linked from the homepage (usually /contact or /impressum or such, but of course this varies)

Lastly, some people may be willing to help out and look for a contact method in a crowdsourced manner. Could also use an LLM but I expect people are more reliable and volunteers are cheaper too

> If the list is widely disseminated and absorbed into blocklists, trying to get your domain of those lists afterwards is close to impossible. For a small business, that could be devastating.

As someone who experienced this (thankfully just a hobby project and not a business), thanks for that consideration! However, I'd encourage this line of action for the ones that are uncontactable. If the site is abandoned, what else are you going to do?

Email them - many sites have a contact page with an email address. Tell them what the issue is up front. Be specific and give all the details they need to confirm the issue. Don't ask them to follow up or for payment. These are both red flags as there are so many spammers and scammers out there.

> We continue to reach out directly to those sites that we identify as particularly high impact and try to notify them, though this is happening on an admittedly small scale. The process of responsible disclosure consumes a lot of resources, use of security.txt is low, and the vast majority of our emails and messages go unanswered. It's simply not possible for us to scale this up.

...why?

Some of the sites collect credit card information. Wouldn't they have a 'contact us' or some other legal identity information required for collecting and charging cc's?

Other than looking at security.txt what else have they tried? did they try programmatically checking for a 'contact us'? or the old trick of emailing '[email protected]' or '[email protected]'? did I miss those details in the article?

Maybe things have changed in the past 10 years, but it was a MASSIVE deal if a website ended up on some site claiming it has malware. Like, contract-ending, people-getting-fired, 10s of thousands of dollars in lawyer fees kinda deal.

I don't think 'it's hard' is a good excuse to ignore responsible disclosure

This is BS. People want the list. End the gate-keeping.

Um. Isn't it exactly the reason why [email protected] needs to exist? I mean, sending 15k mails is not a big deal I suppose and had I receive such mail I'd read it.

But maybe that's not the way and someone will at least tell me why :)

Whois on domain and IP.

You could send an interview request to their technical staff with an assignment that injects the fix into their production environment.

I suspect that these problems exist everywhere at this moment in all major systems.

Perhaps a bot to attempt to make contact and alert the staff.

You wont report them or tell them... because it's not a bug it's a feature. The "moral and trustable" big names that hold the doors of the internet could stop you from going to any scam/infested site but they wont... chrome can and actually worked against things that can prevent you from getting there in first place like ublock origin. Things are working as intended... as long as someone is doing money you can basically steal, intercept, and gate what people do (looking at you postman).

I like to imagine a rogue good-samaritan will hack these websites to apply security fixes before logging out.

It's too bad that such a person would likely end up arrested if they don't mask their identity.

Just publish the URLs, duh. Are they trying to keep it secret so they can sell their threat intelligence product?

DIY - hack'em, patch'em, and gtfo.

How about you post a search and site owners can find themselves.

Predictable. When I was doing this work full time greater than 90% of the code came from outside the organization, such as NPM packages or framework plugins, and nobody reviewed the third party code. Nobody wanted to own the hard problems like security, accessibility, or performance. They just wanted to put text on the screen with JSX and call themselves experts.

Over the years I've found so many Fortune 500's with either massive bugs that broke the site for customers, or huge security holes, and spent hours trying to find a way to report it to them, to no avail. The people who make these websites just don't give a shit. So I now just look up WHOIS and email the domain's contacts and give up.

The old answer: communicate with major search engines and browser vendors. Dunno what to tell you now...

In my opinion, you can and should write them an email. Otherwise you should do nothing because it's not your business. The security of a website is the responsibility of the website owner.

> As these are sites we're crawling and identifying ourselves, we have no contact information like we would for a customer.

It does cost some money, but a possibile solution could be to spin up some cheap agents to search for contact details for each website individually. (For the subset of sites which don't have any findable contact details some other solution would be required.)

oh by all means email them all directly saying you found a vulnerability.

im sure for 15,579 websites there will only be about 2500 of them that send the cops after you for "hacking their site", manageable

Almost like we need a "haveibeenpwned" but for websites.

In the old days you'd just do a whois of the domain name and email the system administrator or tech contact. But GDPR made whois data illegal and destroyed that system so now there is no way to contact anyone unless you both happen to be on the same corporate walled garden (facebook, twitter, etc) they might list on their site.

[flagged]

[flagged]

[dead]

[dead]

[dead]

Heh.

My primitive websites are FREE of all javascript, the tool by which advertisers and corporation anger us with Paywalls, Nag screens and the like.

Hope all of them explode.