Report each domain to the major browser vendors so they can update their list of suspicious sites?
I believe the default configuration for suspected spam and phishing and other malicious sites is that the user gets a red warning page that they have to click through first. Website owner would either get notifications from users or notice the drop off in traffic?
I run a website where people can upload files. Not everyone uploads nice files. Every time someone downloads such a file from my site with their antivirus enabled, it's now my problem to discover which fifteen block lists the whole domain has newly been put on. People don't treat big tech this way; you don't think "oh, there's malware on Github, let me just report github.com as a suspicious website that nobody should be able to visit anymore"
The correct answer is probably the abuse contact shown in the WHOIS data. That's programmatically accessible and thus scales
Unpopular opinion, but I think that any website owner accepting uploads from strangers should bear responsibility for those uploads. You cannot just say "not mine, I just distributed it".
UPDATE: Unpopular because it means there's a lot of work for the owner to moderate the files. And large sites like facebook are notorious for very bad moderation. It's not like we mandate them to hire N moderators per M users.
Don't worry, once you're on one of the naughty lists, it's going to spread by itself. Your domain will never be off of all lists simultaneously, it goes around and you can keep chasing it if it's your domain but you'll never convince everyone before another has copied it again
Most vendors of such lists don't have a contact method, don't respond, or say they're only aggregating a set of secret sources and it's up to me to look for those. Only a handful will actually respond to requests to re-evaluate the allegation, and remove you if it was/is false
> Supply chain - a third-party script file that a site loads is infected with malware, and is then loaded on to the site, exposing all visitors.
I already know many will disagree, but this is far too vague for your answer to make much sense. The list of 15k websites isn't given.
Most websites have at least one analytics script. Some of the biggest vendor names in that space have known XSS issues via nonce reuse that they aren't going to fix because it threatens their entire business model.
You usually get the whole clown car as soon as you allow one 3rd-party script for relatively innocent use cases like wanting a heatmap of user interaction.
You should fully expect that such a blacklist would take out most, if not all, of the websites you use every day. The security model for 3rd party scripts tends to be "trust me bro, we're $bigname"
Are you replying to something else? I don't see the connection to a problem affecting a small number of websites or the suggestion of reporting them all to a browser maker to indirectly inform them.
If I’m about to enter my credit card information on a site that’s compromised, I don’t care if it’s because of infected first party code or infected third party code. I want my browser to say “bro this site is fishy, maybe don’t”.
Make a website,
name it 15579infected.com and name everywebsite.
Most of the website owners would soon wise up by word of mouth and visit your website and most probably contact you and you tell them what vulnerability each one has so they can rectify.
You can charge them for your service.
Charging them to detail the infection to them risks coming off as extortion to less savvy site owners. You might get a significant portion who would report you to the police rather than talk to you.
This is the right move. Contrary to what the other comment says, this is not "name and shame".
Instead, this is a database, useful to check for website owners to see if their site is listed inside.
This would be an idea very similar to haveibeenpwned.com, which is immensely helpful.
And? They won’t be less vulnerable by not being listed, nor easier to find for any moderately skilled attacker (especially these days) by being listed publicly.
He should just put up a txt file on his blog and call it a day.
I don't get why he brings "responsible disclosure" into this. That is appropriate when you find a door lock that is easily picked; that is not appropriate when you are watching from across the street while a house gets looted.
I think something has gone very wrong for you to be doubting the answer.
Responsible disclosure is to prevent harm. You think about your disclosure options and pick the one that is best overall weighing the impact and harm.
They're already infected - or so you claim.
I get that companies want to use responsible disclosure as a mechanism so it can save face and their reputation, and if both are possible at the same time then sure.
But if you think you're right, you have to pick one and live with the consequences; and its not that hard to pick the right choice.
In fact, if you don't make the right choice you need stop misusing the word “responsible disclosure”.
Publish the URLs that prove they're infected. Auto update it whenever one get's fixed.
This seems correct? If true, they are currently dangerous to others and they should be called out for it. Why will people be more proactive here if they can just hide their mistakes?
As someone in the UK, I'd expect something along the lines of (1) reporting to the website owner by email and if they don't respond then just (2) reporting it to the police. It used to be common to go to the hosting provider but I'm not sure if people still do that anymore. At this scale it would be kind to do (1) but also just jumping to (2) seems like more than enough to have 'done the right thing'.
It would have to be a fully automated / AI system that attempted to scrape sites for contact emails, look up domain ownership if possible, and even guess emails (info@<domain>, contact@<domain>, support@<domain>, etc.)
I guess this is exactly what WHOIS information is meant to provide, a way to contact the owner or administrator of a domain. Of course many sites today rely on WHOIS anonymization, but legit e-mails should still hopefully make it through to the owner.
Tangential but related: can anyone point me towards what tools are being used to identify this kind of malicious JS?
I host a modest pile of WordPress and other applications, and all traffic gets proxied by nginx. I've been occasionally sniffing around for something that I could use to monitor the JS of outbound traffic and give me a heads-up if it smells like one of the sites is delivering something it shouldn't be, but I haven't found a tool for this that I like yet.
Email them - many sites have a contact page with an email address. Tell them what the issue is up front. Be specific and give all the details they need to confirm the issue. Don't ask them to follow up or for payment. These are both red flags as there are so many spammers and scammers out there.
> We continue to reach out directly to those sites that we identify as particularly high impact and try to notify them, though this is happening on an admittedly small scale. The process of responsible disclosure consumes a lot of resources, use of security.txt is low, and the vast majority of our emails and messages go unanswered. It's simply not possible for us to scale this up.
...why?
Some of the sites collect credit card information. Wouldn't they have a 'contact us' or some other legal identity information required for collecting and charging cc's?
Other than looking at security.txt what else have they tried? did they try programmatically checking for a 'contact us'? or the old trick of emailing 'webmaster@domain.com' or 'admin@domain.com'? did I miss those details in the article?
Maybe things have changed in the past 10 years, but it was a MASSIVE deal if a website ended up on some site claiming it has malware. Like, contract-ending, people-getting-fired, 10s of thousands of dollars in lawyer fees kinda deal.
I don't think 'it's hard' is a good excuse to ignore responsible disclosure
In my opinion, you can and should write them an email. Otherwise you should do nothing because it's not your business. The security of a website is the responsibility of the website owner.
> As these are sites we're crawling and identifying ourselves, we have no contact information like we would for a customer.
It does cost some money, but a possibile solution could be to spin up some cheap agents to search for contact details for each website individually. (For the subset of sites which don't have any findable contact details some other solution would be required.)
Over the years I've found so many Fortune 500's with either massive bugs that broke the site for customers, or huge security holes, and spent hours trying to find a way to report it to them, to no avail. The people who make these websites just don't give a shit. So I now just look up WHOIS and email the domain's contacts and give up.
In the old days you'd just do a whois of the domain name and email the system administrator or tech contact. But GDPR made whois data illegal and destroyed that system so now there is no way to contact anyone unless you both happen to be on the same corporate walled garden (facebook, twitter, etc) they might list on their site.
It's still possible to use whois data. Most of the time it'll be an abuse@ email address from a provider and they can forward the message to the real admin, or they could directly block the website if you explain the issue.
The problem is not the GDPR, but the fact that this public contact data was abused. If some assholes had not decided to spam people, we would probably still have public contact info.
Report each domain to the major browser vendors so they can update their list of suspicious sites?
I believe the default configuration for suspected spam and phishing and other malicious sites is that the user gets a red warning page that they have to click through first. Website owner would either get notifications from users or notice the drop off in traffic?
I run a website where people can upload files. Not everyone uploads nice files. Every time someone downloads such a file from my site with their antivirus enabled, it's now my problem to discover which fifteen block lists the whole domain has newly been put on. People don't treat big tech this way; you don't think "oh, there's malware on Github, let me just report github.com as a suspicious website that nobody should be able to visit anymore"
The correct answer is probably the abuse contact shown in the WHOIS data. That's programmatically accessible and thus scales
Unpopular opinion, but I think that any website owner accepting uploads from strangers should bear responsibility for those uploads. You cannot just say "not mine, I just distributed it".
UPDATE: Unpopular because it means there's a lot of work for the owner to moderate the files. And large sites like facebook are notorious for very bad moderation. It's not like we mandate them to hire N moderators per M users.
"I run a website where people can upload files."
This is an incredibly brave thing to do in 2026.
Yeah, this is probably the right answer. Immediately protects users, and website owners would quickly find out as well. :-)
Primary obligation is to the users, not the owners of websites that got themselves infected.
Unfortunately, this is how I found out 10 years ago when someone hacked a 3rd party dependency I was using on my site.
> Unfortunately, this is how I found out 10 years ago when someone hacked a 3rd party dependency I was using on my site.
Better than a customer telling you they got a nasty bug from your site!
Bingo. Protect the users first. For example, you can report the websites to Google Safebrowsing: https://safebrowsing.google.com/safebrowsing/report_phish/
Exactly. And maybe publish the list as well.
Don't worry, once you're on one of the naughty lists, it's going to spread by itself. Your domain will never be off of all lists simultaneously, it goes around and you can keep chasing it if it's your domain but you'll never convince everyone before another has copied it again
Most vendors of such lists don't have a contact method, don't respond, or say they're only aggregating a set of secret sources and it's up to me to look for those. Only a handful will actually respond to requests to re-evaluate the allegation, and remove you if it was/is false
Quote from TFA:
> Supply chain - a third-party script file that a site loads is infected with malware, and is then loaded on to the site, exposing all visitors.
I already know many will disagree, but this is far too vague for your answer to make much sense. The list of 15k websites isn't given.
Most websites have at least one analytics script. Some of the biggest vendor names in that space have known XSS issues via nonce reuse that they aren't going to fix because it threatens their entire business model.
You usually get the whole clown car as soon as you allow one 3rd-party script for relatively innocent use cases like wanting a heatmap of user interaction.
You should fully expect that such a blacklist would take out most, if not all, of the websites you use every day. The security model for 3rd party scripts tends to be "trust me bro, we're $bigname"
If a site is using a third-party analytics site that brings in malware, they can stop bringing in that analytics script.
Are you replying to something else? I don't see the connection to a problem affecting a small number of websites or the suggestion of reporting them all to a browser maker to indirectly inform them.
No. This is a very old debate I'm bringing up. The criteria for being listed as an "infected site" is not clear enough.
Your example is how the site got infected. The types of infection is listed 2 or so paragraphs above that
If I’m about to enter my credit card information on a site that’s compromised, I don’t care if it’s because of infected first party code or infected third party code. I want my browser to say “bro this site is fishy, maybe don’t”.
They aren't saying "analytics script = infection"
I'm not sure what point you're trying to make here.
Make a website, name it 15579infected.com and name everywebsite. Most of the website owners would soon wise up by word of mouth and visit your website and most probably contact you and you tell them what vulnerability each one has so they can rectify. You can charge them for your service.
Charging them to detail the infection to them risks coming off as extortion to less savvy site owners. You might get a significant portion who would report you to the police rather than talk to you.
Just give them the deets.
This is the right move. Contrary to what the other comment says, this is not "name and shame". Instead, this is a database, useful to check for website owners to see if their site is listed inside.
This would be an idea very similar to haveibeenpwned.com, which is immensely helpful.
Don't do that dude.
Why not?
its a free for all of targets known to be vulernable to javascript injection via some route or other?
And? They won’t be less vulnerable by not being listed, nor easier to find for any moderately skilled attacker (especially these days) by being listed publicly.
Exactly. This is not rocket science. Name and shame. Sort by estimated traffic.
He should just put up a txt file on his blog and call it a day.
I don't get why he brings "responsible disclosure" into this. That is appropriate when you find a door lock that is easily picked; that is not appropriate when you are watching from across the street while a house gets looted.
I think something has gone very wrong for you to be doubting the answer.
Responsible disclosure is to prevent harm. You think about your disclosure options and pick the one that is best overall weighing the impact and harm.
They're already infected - or so you claim.
I get that companies want to use responsible disclosure as a mechanism so it can save face and their reputation, and if both are possible at the same time then sure.
But if you think you're right, you have to pick one and live with the consequences; and its not that hard to pick the right choice.
In fact, if you don't make the right choice you need stop misusing the word “responsible disclosure”.
Publish the URLs that prove they're infected. Auto update it whenever one get's fixed.
This seems correct? If true, they are currently dangerous to others and they should be called out for it. Why will people be more proactive here if they can just hide their mistakes?
How do you responsibly disclose to 15 thousand websites?
Work to add them to Google Safe Browsing blocklist (Why are they not on the list anyway? Surely Google will be interested in their technique)
Google, Facebook, Bing, other large platforms will get those websites blocked. Their traffic falls almost to zero. Then:
either web admin notices and fixes website
or people stop visiting yhem
either way, no more infected people, win for everyone.
abuse@, postmaster@, hostmaster@ mails were meant to be present for this, but nothing is enforcing s domain to serve email.
Are you trying to get a bounty or something or just want to be responsible?
You can list them all out, with the specific pages/methods that are compromised and shouldn't get much backlash from the owners.
This is a different situation than a CVE
If you want to be paid for your efforts, I dunno :\
Try abuse@[domain] or the admin contact listed in WHOIS.
On smaller websites I’d be surprised if 1 in 100 of those goes to a person who reads the email sent there.
And on the 1 who does, they get 40 similar-looking emails per day, all of which are scams, and have learned to ignore them.
NOBODY messages abuse@ I had mine on my domains for decades, never got one single email.
Also admin@… or even legal@… I usually check for a "contact us" web page, too.
To 15,000 email addresses? That's indistinguishable from a small-scale spam campaign.
Spread it through hours, days; use mailgun; use a throwaway google groups like spammers do.
Is there no "have I been powned" for websites?
As someone in the UK, I'd expect something along the lines of (1) reporting to the website owner by email and if they don't respond then just (2) reporting it to the police. It used to be common to go to the hosting provider but I'm not sure if people still do that anymore. At this scale it would be kind to do (1) but also just jumping to (2) seems like more than enough to have 'done the right thing'.
https://www.ncsc.gov.uk/section/about-this-website/report-sc...
Yes, but 15k emails...
It would have to be a fully automated / AI system that attempted to scrape sites for contact emails, look up domain ownership if possible, and even guess emails (info@<domain>, contact@<domain>, support@<domain>, etc.)
I guess this is exactly what WHOIS information is meant to provide, a way to contact the owner or administrator of a domain. Of course many sites today rely on WHOIS anonymization, but legit e-mails should still hopefully make it through to the owner.
Tangential but related: can anyone point me towards what tools are being used to identify this kind of malicious JS?
I host a modest pile of WordPress and other applications, and all traffic gets proxied by nginx. I've been occasionally sniffing around for something that I could use to monitor the JS of outbound traffic and give me a heads-up if it smells like one of the sites is delivering something it shouldn't be, but I haven't found a tool for this that I like yet.
Email them - many sites have a contact page with an email address. Tell them what the issue is up front. Be specific and give all the details they need to confirm the issue. Don't ask them to follow up or for payment. These are both red flags as there are so many spammers and scammers out there.
Try automating that for 15k sites and you have a whole new engineering problem in front of you!
It should be more or less possible though. Just not easy.
> We continue to reach out directly to those sites that we identify as particularly high impact and try to notify them, though this is happening on an admittedly small scale. The process of responsible disclosure consumes a lot of resources, use of security.txt is low, and the vast majority of our emails and messages go unanswered. It's simply not possible for us to scale this up.
...why?
Some of the sites collect credit card information. Wouldn't they have a 'contact us' or some other legal identity information required for collecting and charging cc's?
Other than looking at security.txt what else have they tried? did they try programmatically checking for a 'contact us'? or the old trick of emailing 'webmaster@domain.com' or 'admin@domain.com'? did I miss those details in the article?
Maybe things have changed in the past 10 years, but it was a MASSIVE deal if a website ended up on some site claiming it has malware. Like, contract-ending, people-getting-fired, 10s of thousands of dollars in lawyer fees kinda deal.
I don't think 'it's hard' is a good excuse to ignore responsible disclosure
The old answer: communicate with major search engines and browser vendors. Dunno what to tell you now...
Google already does that, and they warn users about malicious sites. The question is: are these sites already flagged by google?
In my opinion, you can and should write them an email. Otherwise you should do nothing because it's not your business. The security of a website is the responsibility of the website owner.
Whois on domain and IP.
You could send an interview request to their technical staff with an assignment that injects the fix into their production environment.
I suspect that these problems exist everywhere at this moment in all major systems.
Perhaps a bot to attempt to make contact and alert the staff.
Just publish the URLs, duh. Are they trying to keep it secret so they can sell their threat intelligence product?
How about you post a search and site owners can find themselves.
I like to imagine a rogue good-samaritan will hack these websites to apply security fixes before logging out.
It's too bad that such a person would likely end up arrested if they don't mask their identity.
> As these are sites we're crawling and identifying ourselves, we have no contact information like we would for a customer.
It does cost some money, but a possibile solution could be to spin up some cheap agents to search for contact details for each website individually. (For the subset of sites which don't have any findable contact details some other solution would be required.)
Over the years I've found so many Fortune 500's with either massive bugs that broke the site for customers, or huge security holes, and spent hours trying to find a way to report it to them, to no avail. The people who make these websites just don't give a shit. So I now just look up WHOIS and email the domain's contacts and give up.
Almost like we need a "haveibeenpwned" but for websites.
oh by all means email them all directly saying you found a vulnerability.
im sure for 15,579 websites there will only be about 2500 of them that send the cops after you for "hacking their site", manageable
In the old days you'd just do a whois of the domain name and email the system administrator or tech contact. But GDPR made whois data illegal and destroyed that system so now there is no way to contact anyone unless you both happen to be on the same corporate walled garden (facebook, twitter, etc) they might list on their site.
Whois still works. Try it:
Gandi.net will get the message through to the person who would have been registered as the admin contact.It's still possible to use whois data. Most of the time it'll be an abuse@ email address from a provider and they can forward the message to the real admin, or they could directly block the website if you explain the issue.
The problem is not the GDPR, but the fact that this public contact data was abused. If some assholes had not decided to spam people, we would probably still have public contact info.
whois was effectively dead well before GDPR -- most people used registration privacy services to hide their mailing address, phone number, etc.
Heh.
My primitive websites are FREE of all javascript, the tool by which advertisers and corporation anger us with Paywalls, Nag screens and the like.
Hope all of them explode.
A fair position to take, but not really relevant here. Removing that attack vector from your own offerings doesn't un-compromise anyone else.
Heck yes