Your Website Hacked but No Signs of Infection

How-Websites-Get-Hacked
Imagine for a moment, you have a suspicion that you have somehow had your website hacked. You see that something is off, but you feel as if you are missing something. This is the emotionally draining world that many live in, with a paranoia and concern that grips you once you see and recognize that something is not right. As humans we need closure, we need the ability to say… “Gotcha!” Often though, especially when it comes to hacks, we are left only with our imagination and that can be concerning for many.

In one of the many groups I participate in, I was reading an experience that spoke to this exact feeling. A user had noticed that a new administrator user had been added to their website, but barring a simple image file, they were unable to identify anything else out of place. To further complicate issues, the various security tools they were using kept reporting nothing was amiss. As a website owner, that’s perhaps the most frustrating feeling, when you can feel it in your bones something is wrong. Why aren’t the tools picking it up?
Read More

Introducing Free Global Website Performance Tool

We are happy to launch a new free tool (aka Global Website Performance Tester) that allows anyone to quickly check how fast a website is loading from across the globe.

We extract three key metrics that are critical to the performance of any website: connection time, time to first byte (TTFB) and total load time:

  • Connection time: It measures how long it takes for the TCP session to be established to your website. If you are a networking geek, it measures how long it takes for the 3-way handshake to be completed.
  • Time To First Byte (TTFB): This is one of the most important numbers to pay attention to, as it tells you how long it takes for the first byte to be received by the browser. This metric is important because as soon as the browser receives the first few bytes, it can start to load the page and display content to the end user.
  • Total Load Time: This shows how long it takes for the full page to be loaded.

To give us the visibility we need for these tests, we setup 13 globally distributed testing stations:

  • 4 in USA (New York, Atlanta, Dallas and Los Angeles)
  • 1 in Canada (Montreal)
  • 4 in Europe (Germany, UK, France and Netherlands)
  • 2 in Asia (Japan and Singapore)
  • 1 in South America (Brazil)
  • 1 in Australia

And we run all our tests from all of them. To get started, you can test your websites performance here: https://performance.sucuri.net
Read More

Website Security: How Do Websites Get Hacked?

How-Websites-Get-Hacked

In 2014 the total number of websites on the internet reached 1 billion, today it’s hovering somewhere in the neighborhood of 944 million due to websites going inactive and it is expected to normalize again at 1 billion sometime in 2015. Let’s take a minute to absorb that number for a moment. Another surprising statistic is that Google, one of the most popular search engines in the world, quarantines approximately 10,000 websites a day via its Safe Browsing technology. From our own research, of the millions of websites that push through our scanning technology, we often see 2 – 5% of the them have some Indicator of Compromise (IoC) that signifies a hack. Granted, this might be a bit high, as the websites being scanned are often suspected of having an issue, so to be conservative we would extrapolate that to suggest about 1% of the total websites online are hacked or infected. To put that into perspective, we are talking somewhere in the neighborhood of 9 million websites that are currently hacked or infected.

With this sort of impact, it’s only natural that people are curious how websites keep getting hacked. The challenge however, is that the answer has been the same for quite some time.
Read More

How Social Media Blacklisting Happens

Social Media Blacklists

In today’s world, we are all browsing websites online and sharing content on a multitude of social media platforms every day. Worldwide social media users exceeded 2 billion back in August 2014, with an adoption rate unlike anything we have seen in history. Social media continues to grow around the world, with active user accounts now equating to roughly 29% of the world’s population. Monthly active user (MAU) figures for the most active social network in each country add up to almost 2.08 billion – a 12% increase since January 2014.

What is Social Media Blacklisting?

Legitimate links on social media platforms are sometimes hijacked by criminals to direct visitors to a website where malware will be automatically downloaded. The more that people share and use social media, the more often these situations will occur. This is why social media platforms have specific security measures to protect their users from being victims of malicious shared content.

In the same way that websites can be blacklisted by Google for having malware hosted on their pages, social media blacklisting occurs when security triggers detect malicious activity, thus placing the infected links on their internal blacklist. Sometimes they can match the URL with the help of an external blacklist authority, such as McAfee, Google, Web of Trust, or Websense.
Read More

How To Create a Website Backup Strategy

wire-rope-59675_640

We’ve all heard it million times before – backups are important. Still, the reality is that even today, a website backup strategy remains one of the most overlooked and under-utilized precautions we can take to protect our vital data.

Why Are Backups So Important

Put simply, a good set of backups can save your website when absolutely everything else has gone wrong. If a malicious attacker decides they want to wipe all your site files, or if your web server has a catastrophic hard drive failure, all the damage can be easily undone by restoring from your backups. The idea is simple. In order to make sure our data is safe, you make a copy of it. If something happens to the original copy you can always use your backup copy.

Simple right? Unfortunately it isn’t that simple at all and there are a number of factors that determine whether your backups will be useful, practical and secure.

Read More

Why Website Reinfections Happen

why-does-your-website-keep-getting-reinfected

I joined Sucuri a little over a month ago. My job is actually the Social Media Specialist, but we have this process where regardless of your job you have to learn what website infections look like and more importantly, how to clean them. It’s this idea that no matter who you are, you must know the foundation that makes this company work. After a month of this training, I made some very interesting observations through my interactions with some of our clients and felt some might find it interesting, especially why website reinfections occur. This might be new to some, and not so new to others, but for me it was fascinating and worth a share.

I will note that I was like many of you a month ago, I operated my own website, and still do, and came to know of Sucuri because my own website had been hacked. Such is the circle of life that I now work at this fascinating place. Here are some of my observations from my last month here and I hope they help someone.

Read More

The Impacts of a Hacked Website

Today, with the proliferation of open-source technologies like WordPress, Joomla and other Content Management Systems (CMS) people around the world are able to quickly establish a virtual presence with little to no cost. In the process however, a lot is being lost in terms of what it means to own a website.

We are failing each other, we are not setting ourselves up for success. We are learning the hard way what large organizations already learned – being online is a responsibility and will eventually cost you something.

I recently shared a post talking to the motivations behind hacks. This post was important as it helped provide context and I encourage you to spend some time digesting the information. What it fails to do is what I want to focus on in this post.

What are the impacts of these hacks to your website? To your business?
Read More

Why Websites Get Hacked

I spend a good amount of time engaging with website owners across a broad spectrum of businesses. Interestingly enough, unless I’m talking large enterprise, there is a common question that often comes up:

Why would anyone ever hack my website?

Depending on who you are, the answer to this can vary. Nonetheless, it often revolves around a few very finite explanations.

Automation is Key

Understand that the attacks affecting a large number of website owners in the prosumer category (a term I’m using to describe website owners in micro, small, and medium-sized businesses leveraging platforms like WordPress, Joomla and others) are predominantly automated. I wrote an article on the subject back in 2012, it’s important to revisit the subject as it’s still very relevant today.

The benefits of these automated attacks have not changed, they still provide the attackers the following benefits:

Read More

The Dynamics of Passwords

history of passwords

How often do you think about the passwords you’re using? Not only for your website, but also for everything else you do on the internet on a daily basis? Are you re-using any of the same passwords to make it easier to remember them?

We see it all too often: weak passwords used to secure website login for FTP, database, cPanel, and the CMS dashboard. Everyone has their own password policy. It’s very personal and usually based on a set of assumptions about online security. Many users choose policies of efficiency over security. Even the paranoid among us have to confront the truth. Like any defensive measure, best practices in password management can only minimize the level of risk.

Password management is a choice, and a habit. By taking a good look at the risks, users can make informed decisions and put better passwords into practice.

History of the Password

Most password strength meters are too soft. The companies that use them know this, but they don’t want users to leave the registration process due to a restrictive password policy. Modern software can guess many so-called “strong” passwords in minutes, and the most common passwords in milliseconds. As password hacking grew in complexity over time, so did the requirements on passwords.


Read More

Creative Evasion Technique Against Website Firewalls

During one of our recent in-house Capture The Flag (CTF) events, I was playing with the idea of what could be done with Non-Breaking Spaces. I really wanted to win and surely there had to be a way through the existing evasion controls.

This post is going to be a bit code-heavy for most end-users, but if you choose to read you’re bound to find it very insightful.


Read More