Announcements
An Update to the Virus Situation
A couple of days ago we began receiving notifications that some of you were getting warnings that the site was infected with malware or other viruses. As many of you know, this is not the first time we have been infected. At first, our own inspections didn't reveal any issues and after some initial testing with some of you who contacted us we believed that it was just a cache issue, where virus software like Avast was producing false positive reports by looking at cached versions of the site.
After posting about this issue on the site yesterday, we learned that the issue was potentially more widespread that we initially thought so we decided to take the site offline this morning to complete additional analysis - one internally and the other by a third party security specialist.
What we found is that the site had in fact been compromised again. Obviously, this disappoints us greatly. We do not want the site to be responsible for inflicting harm on the computers of those who visit it; and we are also mindful that this second breach suggests the site is not as secure as it should be and that you might rightfully question our ability to provide a safe, virus-free browsing experience.
The situation is not acceptable. It's not acceptable by us and we know it's not something that any of you should accept.
We apologize for this security breach and even though we believe the site is now clean we know that words of contrition and explanation are not enough. Obviously our future actions - both in responding quickly to any warnings AND in avoiding any subsequent security breaches are what's most important here.
Unfortunately we don't have much more information to share beyond what was discussed the previous time but I'll try my best to answer any question in the comments below.
Discussion
48 Comments
Sort By Oldest First / Newest First
Subscribe
http://www.communities.hp.com/securitysoftware/blogs/rafal/archive/2010/02/25/a-big-case-of-oops.aspx
You not only need to scrutinize your production code itself to make sure it is virus-free, you need to scrutinize it for SQL injection vulnerabilities, and you need to scrutinize your database contents - every comment ever written, every article ever written, every thing in your site databases - to make sure that none of the data has been infected, as described in that link.
This stuff sound be very elementary to most programmers, but clearly you guys aren't getting it because you're being infected over and over again. Luckily I'm on a Mac so this doesn't directly affect me, but it's beyond unacceptable that you can't seem to figure out basic systems administration, and even worse seem to feel that it's acceptable to continue to run a compromised server that is presumably continuing to infect your readers' systems.
Again, I hate to jump to these kind of conclusions without the whole story, but you guys aren't leaving me any other choice.
This kind of defensiveness, while natural - I'm sure it's tough to not take these comments personally - isn't going to help you get back on track.
I think the point your readers are trying to make is that taking something OUT of the discussion is not helpful. Leaving up the old post, closing comments and then redirecting users to THIS conversation allows for continuity without the perceived "sneakiness".
More comments about this on my site as well:
http://www.angiemckaig.com/archives/2010/02/26/followups_crisis_management/
http://www.mcafeesecure.com/us/
You subscribe, and every night it penetrate-tests your site, giving you specific advice on how to lock things down. It should point to cures for your SQL-injection problem and cross-site scripting vulnerabilities.
I do not work for McAfee--I am just a satisfied customer.
Threat Report
Total threats found: 4
Small-whitebg-red Drive-By Downloads (what's this?)
Threats found: 4
Here is a complete list:
Threat Name: MSIE ADODB.Stream Object File Installation Weakness
Location: http://www.blogto.com/arts
Threat Name: MSIE ADODB.Stream Object File Installation Weakness
Location: http://www.blogto.com/fashion/publicbutter
Threat Name: Direct link to MSIE ADODB.Stream Object File Installation Weakness
Location: http://www.blogto.com/arts/2008/10/war_and_peace_conquers_the_canadian_opera_company/
Direct link to: http://www.blogto.com/fashion/preloved
Location: http://www.blogto.com/toronto/the_best_vintage_clothing_stores_in_toronto/
It seemed to me it could've helped ID any patterns. It's too bad I never got a chance to follow up on those posts..
Those are the words of blogTO the last time this happened. Well, apparently hindsight is less 20/20 and more akin to sticking one`s head in the sand, as it took a couple of days for the proper reaction *again* on round two. I got less than lucky and my machine`s infected. Thanks, guys.
Not coming back to this site again -- and aggressively educating friends, etc. about the consistent security issues.
Luckily I haven't had to reformat but all these virus warnings I'm getting from this site is causing me to lose sleep.
My virus scans tell me I'm clean but how can I be so sure. Maybe some guy in Russia has all my personal info and stealing my identity. I don't even do online banking anymore in case I have some hidden keylogger or some shit.
I hope I don't end up dead from all of this.
You can make The Situation happy with a new mac..HA! lol j/k :P
Also, the 'Update to the Virus Situation' box at the side of the site should be larger and a different colour than the rest of the boxes beneath the update.
http://googlewebmastercentral.blogspot.com/2008/04/my-sites-been-hacked-now-what.html
My computer got totally &^$*(#$% up from your site (my fault, I didn't beleive the warnings). I love the site, but am scared to visit.
What would be a huge help, and also a way of stemming some backlash against blogto, would be to COMPLETELY DISCLOSE what infections/malware/spyware you were serving up while infected. That would allow people to more effectively scan/search their computers, and stop people from blaming you for infections that were not caused by blogto.
Moreover, rhonda, thank you for posting your infection notification results, but unfortunately, we need something official from blogto in regards to what infections were being served by the site.
Also, blogto should move to a linux/unix platform, something like centos that supports selinux would be a good choice. Moreover, make sure the 'security specialist' you hire does a full vulnerability assessment and then follows it up with a pen test.
Moreover, move to a new physical server, with new HDs for your setup, start from scratch and do it right from the ground up. Use one of your backups to import the new content and make sure every single file is scanned and checked before being moved to the new server.
I am assuming the reason you are hesitant to do this is that your content is perhaps locked into some kind of propriety setup as other had indicated (wordpress etc..)... what can I say, that sucks, time to hire some data entry clerks?
1. We continue to monitor the site for infections and it appears to have been clean since we made the fix on Friday.
2. We are speaking with a security speciality about engaging them on an ongoing basis. First, to do a complete audit and make recommendations. And, then, to monitor the site for any instances of infections on an ongoing basis. Note: Prior to the weekend we already have had the site audited by three external security experts and we've already acted on previous recommendations from them.
3. We are examining options for a new server environment. We are looking for a managed dedicated server. We are open to recommendations if anyone has any.
4. We are evaluating other internal policies/practices to help ensure the site is as secure as we can make it.
That you don't list the what and the how suggests that you still don't know -- or that you know that you're still vulnerable.
I have had trojan after trojan. For the less IT savvy, we are probably not able to give you precise details but 3 weeks ago after seeing the warning... and then not realizing how serious the risk was...
I love the site but I too wonder what can be done. I am about to wipe my computer due to these malware issues that have plagued me for few weeks .... I have never encountered this problem...
it's not a mouse issues. It's trojan and redirecting problems that continue dispite cccleaner, AVG and loss of personal time and resources.
"I appreciate the suggestions. I can assure you that updating readers who visit the site with more prominent messages of this nature is a top priority. In fact, if all goes according to plan, we will be unveiling some design changes next week that help facilitate this."
By this, do you mean you will be deleting the notice at the top of your main page that everyone complained was too small for its purpose only DAYS after it was posted? Or are you waiting for Friday at 8PM to mention to thousands of readers your site may have infected them with a virus?
I am greatly disappointed in the reactions of BlogTO staff in regards to this matter. They seem more concerned with sweeping this under the rug than addressing the fact that there are likely thousands of infected computers out there due to their lack of action.
Tim, if you want to be 'open' with people, why take the announcement link off the main page? I had absolutely no idea the site was infected again because I happened to miss the 3 hour window when this article was on the main page (mostly because I have been avoiding the site due to being scared about being reinfected from other machines).
If you want to ensure the site is 'secure', then why dismiss the initial comments where people stated that there was still virus warnings coming from the site as a user-end problem (inadequate cache clearing)?
You already admitted you were wrong in not telling people sooner the first time around, so why delay the second time?
And why were multiple emails ignored where I tried to get more information about the virus so I could have better luck trying to target it and improve chances of its removal? My work PC now has to be wiped due to all those things mentioned above. Time and most importantly Data has been lost. Should I be encouraging management to calculate financial losses as a result and have them send you the bill?
Suffice to say, my trust in BlogTO has been lost and unlikely to return.
"Hindsight is 20/20 as they say and if we knew then what we know now we certainly would have handled things differently."
So by handled differently, you mean do things exactly the same as before?
What's going on, BlogTO?
Thanks for your help.
<i>Jesus.</i> And here I was thinking that the new-look site was, if not as pretty, at least secure. My reluctance to send people links to BlogTO is vindicated, I guess.