[HN Gopher] Ask HN: Microsoft SmartScreen is destroying our busi...
___________________________________________________________________
Ask HN: Microsoft SmartScreen is destroying our business
About a month ago, Microsoft SmartScreen suddenly started flagging
the login page of our SaaS dashboard as 'unsafe', scaring away our
customers. We understand false flags can happen. So we took to the
official SmartScreen feedback site to report the false flag (as the
website owner). Received an email that stated it would take up to
24hrs to analyse: 'If the status of your site has not changed after
24 hours, please contact us with a reply to this message'. Sep 8 -
first ticket sent. Sep 9 (24h later) - nothing. So we replied to
the message as instructed. Sep 12 - still nothing. One more reply
sent. Asked some of our customers to report our site as safe. Sep
15 - crickets. Tried calling phone support, impossible to get
through; they just hang up on us. Reached out to MS support on
Twitter, said they would look into the case. Sep 22 - no changes -
MS twitter support has been unable to find the correct person
internally. We replied to the SmartScreen ticket once more. Opened
two new tickets. Asked more customers to report the site as safe.
Sep 30 (Today) - now the warning has started to spread from our
login page to our entire dashboard. Still no word from Microsoft.
We are totally baffed that MS allows a false flag to stay up this
long, totally ignoring us for almost a full month, meanwhile
destroying a business that did nothing wrong... We suspect one of
our competitors is responsible for falsely reported us. Is
'weaponized SmartScreen' a thing? Does anyone have a similar
experience? Any advince on resolving this matter is greatly
appreciated!
Author : captain_dfx
Score : 264 points
Date : 2022-09-30 16:07 UTC (6 hours ago)
| ROTMetro wrote:
| Would it be possible to hire a lawyer to send them a letter
| notifying them you intend to sue for defamation of character?
| gw99 wrote:
| I had problems with Windows Defender finding a false positive in
| the output of a product I was working on. This was an EV code
| signed MSI package with signed exe. This eventually inflamed
| SmartScreen and despite getting the thing sorted as a false
| positive by the AV guys it took 3 months for it to stop being
| flagged.
|
| After working on Microsoft dev for ~20 years, 2019 was the last
| thing I touched. I handed everything else over and moved on. I
| will NEVER deal with that company again. Nothing but fucking shit
| for that entire time. The grass /is/ greener on the other side.
| gypon wrote:
| What if it's a true flag? Your website might be compromised and
| serving malware.
|
| What sort of business is it? If it's something particularly
| scammy, it might be being screened for that reason.
| rsync wrote:
| Where can I go to test what "smartscreen" thinks of a particular
| URL ?
|
| I am neither a "smartscreen" nor even a Microsoft customer - is
| it possible for me to see what they think of a particular
| domain/adress/URL ?
| wahnfrieden wrote:
| Good luck getting them to care
| badrabbit wrote:
| Do you allow user generated content at all that is internet
| accessible? Have you looked up your domain and IPS in virustotal
| and other similar services? Can users host any type of file that
| can be accessed without authentication?
|
| Yes/no/yes to the above questions means that is where you should
| look.
| captain_dfx wrote:
| We're a web analytics product. We don't show any user generated
| content. All pages (except login/signup/etc..) are behind an
| authwall.
| badrabbit wrote:
| I recommend two things as a minimum then:
|
| 1) Check your DNS registrar and make sure there are no new
| subdomains. dnsdumpster can also help a bit.
|
| 2) Check for any new files in the directory tree of public
| facing sites.
|
| If you're sure all is good you just have to keep escalating
| with microsoft and creating new requests to remove your
| domain multiple times a day from different IPs and emails so
| you can land in the right queue eventually. Squeaky wheel and
| all (don't forget social media noise).
| dboreham wrote:
| I've noticed that the people running automated flagging systems
| seem to become inordinately smug to the point that they believe
| their false positive result over all forms of external evidence.
| So to them you _are_ a criminal and that 's that.
| counttheforks wrote:
| The government desperately needs to step in and regulate these
| automated "destroy your business" practices.
| gkoberger wrote:
| Totally. It should be illegal for Edge, Chrome and other
| browsers to take any measures, such as a little warning, in
| an attempt protect users from malware. I see no way that
| getting the government involved in this could go badly.
| protomyth wrote:
| I should have some way to resolve the issue outside of the
| automation. Barring that, I should be able to sue them
| libel.
| quantified wrote:
| </sarcasm>?
| raunak wrote:
| I wonder what the last sentence of his comment implies.
| quantified wrote:
| That he understands how competent and benign government
| is.
| ok123456 wrote:
| Another anti-trust suit perhaps.
| scarface74 wrote:
| Yes that worked out well last time. Microsoft was broken
| up and they were forced to unbundled their browser from
| Windows.
|
| Also, politicians never go after companies for biased
| reasons and we can count on the government with more
| power not to abuse it.
| quantified wrote:
| Who knew that the browser should have been separated
| fully anyway because it was a security issue?
|
| They weren't broken up but they were anti-competitive
| asswipes.
| cma wrote:
| Also I suppose companies never go after politicians for
| biased reasons, with legalized bribery of campaign
| contributions as the tool.
| scarface74 wrote:
| Yes, but no company has a "monopoly on violence" - the
| government does. Given a choice, a powerful government
| can do far more damage than Microsoft.
| ok123456 wrote:
| It made Microsoft sweat pretty good in the late-90s. They
| had to behave a little better, but not doing anything too
| anti-competitive, during a critical juncture of the
| internet's growth and adoption, while the anti-trust
| proceedings dragged on.
|
| Just because there was no AT&T style divestiture at the
| end, doesn't mean there were no positive externalities.
| scarface74 wrote:
| And because of that, a million flowers bloomed and now we
| have dozens of browsers engines and not one dominant
| player controlled by a large tech company...
| axxto wrote:
| No one implied that it should be illegal to warn anybody.
| However, it should be illegal to operate a large-scale
| service like this without offering some kind of proper
| communication and prompt action, which isn't unreasonable
| considering they're notorious for destroying someone's
| livelihood for no reason.
|
| Keep in mind that the reason this happens isn't because of
| "faulty AI automated systems": the reason this happens is
| because these companies choose to save pennies by not
| offering proper support channels and recourse. Those saved
| pennies make the difference between a 2-hour outage and
| literally bankrupting you for no reason at all.
| floren wrote:
| See: spam blacklists
| dboreham wrote:
| My own experience was with Wells Fargo, where I conduct quite
| a bit of business, but they still treated me like a criminal
| because their dumb AI thought that "I don't often initiate
| wire transfers online" and "my voice didn't sound like my
| age".
| SpaceManNabs wrote:
| I hate being demanded to set up voice verification. Even
| more annoying when the representative suggests that you
| active your voice despite you saying no. Voice verification
| is such a weak security system.
| myself248 wrote:
| > "my voice didn't sound like my age"
|
| Wow, hello marginalization! I wonder where their training
| data set came from.
| schappim wrote:
| If you can, take your business elsewhere...
| quantified wrote:
| Who does business with Wells Fargo anymore? [https://www.
| forbes.com/sites/eriksherman/2021/09/28/wells-fa...]
| WesolyKubeczek wrote:
| Stripe very much does.
| dboreham wrote:
| Would like to but not so easy.
| pmarreck wrote:
| I am currently in a 3 day Facebook ban because I posted an NIH
| (National Institute of Health, peak legitimacy right here) link
| which was meant to help someone understand something.
|
| Unfortunately, the medical procedure it covered thumbnailed
| down (in the generated preview) to a fairly graphic photo of a
| woman's private parts being operated on... and that resulted in
| an uncontestable instaban. No humans can be reached about it,
| of course.
|
| I hate automated flagging. Not only can I now not help that
| person on the platform in question, but I am now discouraged
| from even using that product further (probably not a bad thing
| in FB's case!)
| barneygale wrote:
| Facebook + Google hold similar levels of power as governments
| over our lives, and so should adopt similar structures. An
| _independent_ judiciary, review bodies, ombudsmen, aldermen,
| etc.
| chunk_waffle wrote:
| We already hold similar levels of power. We can just not
| use Facebook and Google. One needs neither of these
| services to live a normal life.
| pessimizer wrote:
| > We already hold similar levels of power. We can just
| not use Facebook and Google.
|
| Common argument. Not a great one, because some things are
| only available through Facebook, and not being there can
| complicate your in-person life significantly. But, since
| I'm not on Facebook, I have to admit that it's good
| enough for me.
|
| > One needs neither of these services to live a normal
| life.
|
| A step too far. Normal people have Facebook and use
| Google. One needs both of these services to live a normal
| life.
| hellojesus wrote:
| > A step too far. Normal people have Facebook and use
| Google. One needs both of these services to live a normal
| life.
|
| Is this because normal peoples' utility curves maximize
| convenience?
| scarface74 wrote:
| Yes, because the judicial system is free of politics and
| nothing can ever go wrong by giving the government more
| power to police what can be done on private platforms.
| arrosenberg wrote:
| No they shouldn't, they should be broken up so they don't
| have that power.
| scrollaway wrote:
| "Thus solving the problem, once and for all!"
| tacon wrote:
| After the post, there is a button to remove the preview. Is
| that available before posting? Or would immediately removing
| the preview avoid the ban? Just wondering...
| easrng wrote:
| On Discord you can wrap the link in <> to prevent a
| preview.
| twistslider wrote:
| I've seen someone with a similar experience to you (and also a
| SaaS) a few days ago:
| https://twitter.com/xhfloz/status/1574404009288425472
|
| Not sure if they solved it, but might be helpful asking them.
| captain_dfx wrote:
| Thanks, I'll contact them!
| gkoberger wrote:
| I know you probably don't want to dox yourself, but this post has
| a good amount of traction. It wouldn't hurt to include either
| contact information or the site in question, just in case someone
| who can do something sees this!
| swayvil wrote:
| Look at most of the replies here. "Nuh uh, it's you. You have
| failed to check the obvious..."
|
| It inspires paranoia I tell you.
| jbk wrote:
| And yet, when we submit crapware clones of VLC repackaged, while
| giving extensive details about the spyware, adware and services
| installed, MS refuses to block them...
|
| I love Smartscreen...
| codegeek wrote:
| This happens to some of our customers (they have custom domains
| on our SAAS). It is beyond ridiculous.
| nickhalfasleep wrote:
| I encountered this, I had a cloud service that I had spun up
| services on with some DNS records pointing to, and then
| abandoned. The IP address was then used by malware, but because
| my DNS pointed to it, my whole domain got blacklisted.
| jefftk wrote:
| This is risky for things other than malware blacklisting. For
| example, the attacker can get a certificate for your domain,
| and then they can access any HTTPONLY and/or SECURE cookies set
| at the registrable domain level and impersonate your users just
| by getting someone to visit their page.
| djbusby wrote:
| This is a good point, to properly "offline" your old hostnames
| and IPs. I've seen many of these cases where stale DNS started
| pointing to $BAD_THING
| rjc wrote:
| I'm so sick and tired of businesses abusing my trust and/or not
| publishing their security breaches that I'm using plus ('+')
| email addresses everywhere, i.e.:
|
| my_account+site_address@example.org
|
| for regular interactions, or:
|
| my_account+site_address-current_date@example.org
|
| for one-off interactions.
|
| Won't help with historical abuses/data breaches but it'll
| certainly be invaluable in the future.
| ok123456 wrote:
| About 10% of sites don't allow you to use a plus sign in your
| email address.
| aetherspawn wrote:
| I started doing the same years ago and nothing came out of it.
| Most spam I got subscribed to, seemed to get my details some
| other way (or sanitised my email).
| jotm wrote:
| You need to buy an EV certificate which is why many Devs complain
| SmartScreen made Windows Pay2Win.
|
| But you can pay for it by implementing malware in your newly
| whitelisted app :D
| shishy wrote:
| Do you have any scripts loading that might be malicious /
| triggering a flag? What's the website?
| freedomben wrote:
| As has already been said, there's a chance that you are
| compromised and don't know. Obviously keep trying to contact MS,
| but in the mean time I'd make as much sure as you can that they
| don't have a legitimate beef.
|
| If you're willing to share more details about your site such as
| your tech stack, we can probably give you more specific advice
| beyond "check your logs for weirdness and hire a consultancy firm
| that deals with breach detection," though that is good advice.
|
| For what it's worth I went through something similar to this not
| too long ago, so I know how maddening it is. My client never
| found any breach (though I did find some PHP library CVE's that
| _could_ have conceivably been chained together to wreak some
| havoc), but I ended up rebuilding their prod environment clean
| and the flag went away on it 's own after a couple days, probably
| because whatever malware was in there had disappeared.
| tootie wrote:
| I can absolutely confirm that Edge is blocking sites based on
| spurious signals. One of mine is still getting a similar
| warning. We were given an explicit reason, namely that a form
| action was pointing to a different URL that looked suspicious.
| The URL was an API service that we also operate. I followed up
| with their support who said they couldn't remove the warning
| unless I sent a link to a page on that URL they could look at.
| I replied that it's an API server and does not have any pages
| which got no reply. Besides the fact that that's a terrible
| test of authenticity. We could easily apply a DNS TXT record or
| something but it wasn't offered as an option. MS are definitely
| in the wrong in my case and the only solution is to change our
| implementation and cross our fingers.
| NohatCoder wrote:
| If MS have found a compromise they should share it. Making the
| allegation but not disclosing any reason is just slander.
| jefftk wrote:
| That's not actually slander/libel. Truth is an absolute
| defence, and that does not require you to disclose details up
| front. You'd only need to demonstrate truth to defend
| yourself if sued.
|
| In this case I also expect it's all very carefully worded
| ("Be careful! This site might be trying to harm your
| computer") to be legal even in cases when they accidentally
| (and inevitably) miscategorize a site.
| robocat wrote:
| > Truth is an absolute defence
|
| Depends on jurisdiction, although I am presuming OP is from
| the USA due to their spelling.
| freedomben wrote:
| Yeah maybe, but the reality is they won't. You can shake
| fists at MS all day long but it won't get your business up
| and running. Fixing the breach (if it's not a false positive
| of course) will. It's not right or fair, but it is reality,
| and you can only control your own actions.
| mkl95 wrote:
| The answer is in your logs. If there are no logs, Microsoft know
| your site better than you do.
| jcrawfordor wrote:
| Very important that you develop complete confidence that there
| isn't anything wrong with your product. It's not uncommon, in
| fact it's very common, for compromise kits for websites to take
| measures to avoid detection. A common one is only serving the
| malicious content when a specific referrer is present (I've seen
| this be Yahoo Search in the case of compromised Drupal
| installations multiple times, not really sure why). It might be
| wise to engage a security firm to conduct an investigation if you
| don't have in-house expertise in this area. You should definitely
| review logs carefully for any unusual inbound traffic. Sometimes
| looking up your own domain on services like virustotal can reveal
| the problem, as it might turn up samples of malware retrieved
| from your website.
|
| I say this because I have been involved in this exact situation
| multiple times: website flagged by some or other security
| service, website operator has no idea why and insists it is fine,
| website turns out to be serving the landing page of a major
| pharma scam campaign unnoticed by the website operator due to
| anti-detection measures.
| runjake wrote:
| This!
|
| I worked with a very well-known university that unknowingly had
| been compromised and was being flagged for malware by various
| protective services.
|
| They, assuming it was just a false positive, put up a banner at
| the top of their webpages that said they were falsely being
| flagged and that visitors should ignore any warnings and
| essentially shut off any protections for their website.
|
| Meanwhile their site _was_ compromised and attempting to dump
| payloads onto visitors.
|
| Have you ensured you are _not_ compromised?
| Jnr wrote:
| This is a good suggestion to check your system carefully.
|
| I have seen and investigated cases where malware runs for
| everyone except in certain locations or even excluding only the
| site operators.
|
| Look for weird scripts, includes, base64 decode and exec calls
| in your codebase/site.
| codegeek wrote:
| In this case, Microsoft "SmartScreen" is a big culprit. Just
| google "microsoft smartscreen false positive". Tons of support
| forums on this including even some product companies explaining
| to their users on how to unblock because of false positives. It
| happened to some of our customers as well and it is very
| difficult to explain why we cannot do much except them asking
| to whitelist somehow or turning off this stupid thing.
| natch wrote:
| Both can be true.
| golemiprague wrote:
| celestialcheese wrote:
| Hijacking for tangentially related question:
|
| > It might be wise to engage a security firm to conduct an
| investigation if you don't have in-house expertise in this
| area.
|
| Any good security firms you recommend for a small to midsize
| website?
| m3047 wrote:
| Do you practice know your customer (are you required to)? Is
| this shared hosting? Who runs the site? Who is responsible
| for security? What are your assets? Any other way(s) for them
| to be compromised? Where are your backups; did someone get
| ahold of those?
|
| What about all of the garbage that people pull in from the
| webs (and into their customer's browsers)? Do you know why
| fonts.google.com is controversial? Is some ad network
| participating in a watering hole attack? Got a chatbot on
| your payment page?
|
| Once you have a handle on that, you can start looking for
| answers. If that's too much to ask, then the time to start
| paring down your attack surface is before there are
| questions.
|
| Use hosting that provides such guarantees. Use an MxP. Don't
| keep customer information you don't need. What you quote is
| facile.
| lucb1e wrote:
| Should they then not just reply with "You're on the list
| because of the malware payload at <URL>"?
| badrabbit wrote:
| How does MS know they aren't hosting it on purpose? That
| might cause them to just change the malicious URL.
| m3047 wrote:
| I live in the USA. Victim blaming "they did something to
| deserve it" is at best unethical. In court theoretically I
| would have the right to demand to see evidence. "Hold my
| beer" is not likely to be sufficient except in egregious
| circumstances.
|
| With that said, there is an epidemic of muppet thinking
| right now. It's not just the intertubes. Suppose a credit
| card company pulls your credit report because they say you
| applied for credit with them. No funds are stolen. You
| demand they show proof. They say nope, because TTPs. So:
| how do I know it's a one-off, and not data theft by fraud
| at scale? Off goes a letter to the FTC...
|
| Do you think like a muppet? Here is satirical example
| (http://athena.m3047.net/temporizing.html):
| TEMPORIZING FOUND NOT TO BE A FORM OF LYING
| "Temporizing", which is speculating from what we know now
| as to the motives of actors in the past and
| presenting that as historical fact, has been found
| not to be a form of lying. "Social proof demonstrates
| that temporizing is not lying" said a social commentator.
| The news was greeted optimistically as a good day for
| humanists and levels the playing field because "now
| the standards of proof we need to meet for the
| existence of society are the same as for religion".
| "People must have known about this in the past because it
| seems like they should have" said a man in the
| street. "Everybody who believes in science trusts
| society" said another.
| badrabbit wrote:
| I have no idea what your post is about but from MS's
| perspective it isn't the site owners but MS's users
| around the world that are victims of thr threat actor
| that need protection. If it truly is a compromised site
| then the site owner is also a victim but as owners it is
| also their duty to secure and cleanup their site that is
| currently endangering the public.
| m3047 wrote:
| If it truly is a compromised site then the site owner
| needs to clean it up; but starting the sentence with
| "If.." doesn't make it so.
|
| Alex Pinto's classic research into the (lack of) overlap
| among threat indicator feeds should be a shot across the
| bow; I worked with threat indicators for a decade. To
| fend off muppet thinking I would like to remind everybody
| that they're selling threat indicator feeds; nobody that
| I know of sells not-a-threat feeds. A false positive
| means a site was falsely reported as a threat [sp]; a
| false negative does not mean that it is good, it simply
| means it is omitted from the list of threats.
|
| In my experience vendors are a lot more worred about
| false positives than dropping something which is a threat
| on the floor (false negatives in context). However, moral
| hazard pushes them to publish things which turn out to be
| false positives anyway, because at the end of the day
| they're selling FUD.
|
| My network, my rules. Something doesn't have to be a
| threat for it to be blocked from a private network in my
| opinion; there are lots of reasons for that, including
| minimizing potential threats. Something could be hosted
| on stinky infrastructure, but it's unknown or hasn't been
| demonstrated to be a threat. Profiles for operational
| security vary, and so does the appetite for proactively
| blocking (and whitelisting necessary resources): just
| because it's legal doesn't mean it doesn't put me at a
| competitive disadvantage if people know what I'm doing. I
| have no problem with people sharing and discussing such
| indicators, but there has to be attribution to the
| sharer: they have a reputation to be considered with
| equal concern as that of the indicators they publish.
|
| If you're going to do something public with such
| information, you can't point fingers at "AI" and
| indicators you found in a paper bag on the bus: you do
| that, then you own it. Saying the victim deserves it is
| something you'd better be prepared to defend in court.
| salawat wrote:
| Microsoft is _not_ the Guardian of the World. If they
| take it upon themselves to act as such without being a
| responsible Netizen (cooperating with other site
| operators to provide a higher quality Net) then they are
| more interested in cementing their own position rather
| than being a part of a civilized Net.
|
| Imagine if I just suddenly started spreading around
| rumors of your malfeasance and shadyness, and
| untrustworthyness.
|
| It's a big deal.
| badrabbit wrote:
| They are not guarding the world but their windows users
| that don't use chrome but edge and IE (MS browsers) in
| this case, google and firefox also do this by default.
|
| Leave it to HN to get me to defend even MS lol.
| bell-cot wrote:
| Actual bad guys, hosting $Evil on purpose, are extremely
| unlikely to need any "change the URL" hints.
| badrabbit wrote:
| They don't need one but having one maximizes campaign
| life.
| BoorishBears wrote:
| How on earth does it do that?
|
| If I put malware at xyz.com/mybadpage and MS starts
| flagging xyz.com, how on earth do I "maximize campaign
| life" by being told xyz.com/mybadpage has malware?
| krisoft wrote:
| Imagine that you have put malware in xyz.com/mybadpage1,
| xyz.com/mybadpage2, and xyz.com/mybadpage3 pages. MS
| flags you, and you query MS. They tell you they see
| malware on the first two urls. Now you gained information
| about their blindspots.
|
| You can capitalise on this multiple ways. You can remove
| the first two and hope they remove the flag. You can
| design your next attack better so it is more like
| mybadpage3. Etc
| bell-cot wrote:
| Disagree: $Evil_Site_Owner can easily test MS's blind
| spots by putting malware on numerous web sites, then
| seeing which of those sites are flagged. And if MS is not
| systematically scanning all the URLs...well, "MS failed
| to notice malware at $URL, which my web server logs say
| MS has not visited" is pretty useless information.
|
| (Not that I think MS should enumerate malicious URL's,
| unless $Site_Owner is paying for scanning service. A "we
| noticed malware at $URL" is generally 95% of the possible
| value of such disclosures.)
| BoorishBears wrote:
| Except if you're a malicious actor you can also do:
|
| msscanninghoneypot1.com
|
| msscanninghoneypot2.com
|
| msscanninghoneypot3.com
|
| You're pigeonholing a bad actor's actions into good actor
| behavior, it doesn't work like that...
|
| edit: missed that multiple replies cover this
| JamesBarney wrote:
| A bad actor can do the same thing by putting together
|
| Mybadpage1.com
|
| Mybadpage2.com
|
| Mybadpage3.com
| badrabbit wrote:
| You move it to xyz.com/anotherbadpage and tell MS it has
| been cleaned up. They do this all the time. Speaking from
| first hand experience. This is a very simple topic, why
| are there so many people not understanding this?!
| JamesBarney wrote:
| Bad actors know
|
| 1. It's detected (because Microsoft told everyone)
|
| 2. What was detected and where it was (because they put
| it there)
|
| Good Actors only know 1.
|
| So by telling someone 2 they are giving bad actors no new
| information, and good actors valuable information.
| badrabbit wrote:
| 1 is for domain only.
|
| 2, MS only knows some information that shows the site is
| malicious, it cannot tell if it is a compromise or just a
| malicious site unless it perhaps looks at reputation but
| even then the site owner should be able to tell new or
| malicious files on their webserver withour MS telling
| them, if they can't even do that they have bigger
| problems and threat actors do abuse anti-abuse systems
| like this all the time and they do deploy multiple things
| on your site as well as use it to attack other sites and
| monitor the reputation of their infrastructure.
| wolrah wrote:
| This assumes the bad actor only put one thing there. If
| they put multiple things there they don't know what was
| detected unless told.
| lucb1e wrote:
| I considered that but it didn't seem logical. If it's on
| purpose, it would be trivial to change the URL and then go
| "ok it's clean now please remove the flag"
|
| How does keeping secret (from the bad guys) where the
| malware is thwart the bad guys?
| badrabbit wrote:
| MS is already stopping the bad guys by blocking the
| domain. You are supposed to do proper IR and clean up
| after yourseld including finding out the cause of the
| compromise which MS can't help with. What happens in the
| real world is people delete the file or webshell and
| think the bad guys are gone and if MS unblocks them then
| the campaign continues.
|
| Or the bad guys themselves do that pretending to be the
| site owner. MS analysts can only inspect the normal site
| and the malicious URL that has now been removed in order
| to unblock it.
|
| This is how abuse and IR works, I am surprised at the
| naivette of the responses here.
| ascar wrote:
| What are you even talking about? What is IR?
|
| What happens is a website is blocked and the site
| operator has no idea why. The defense of "we can't share
| any information as to why you got punished as it might
| help bad actors avoid punishment" should not be an
| acceptable stance. It's the equivalent of being thrown to
| prison without due process and just ignoring false
| positives. It's a very "natural" way of acting, but that
| does not make it the right one.
| badrabbit wrote:
| IR is incident response, it means you find out everything
| the bad guys did and how it was compromised and fix it
| all. You should contact a security company or
| professional to help you if you don't know. I have used
| the webshells of compromised sites where the owner tries
| to cleanup but the webshell is still there hosting
| different campaigns.
|
| You should secure your site better and have someone who
| knows what they are doing (there are paid WAF and web
| security vendors) monitor and respond to security
| incidents. You are not being punished, MS is protecting
| its customers. You should blame the hacker not MS for the
| impact of the hack. It's like someone messed with your
| car tank and tires and the police stop you from driving
| it because it is unsafe to other drivers, they are not
| punishing you but protecting other people from being hurt
| by your property.
| noAnswer wrote:
| > It's like someone messed with your car tank and tires
| and the police stop you from driving it because it is
| unsafe to other drivers, they are not punishing you but
| protecting other people from being hurt by your property.
|
| The police says why they stopped you though! Which
| implies what you have to change in order to be able to
| drive again. They will not say "you have to figure it out
| on your own or the guys who messed with your car would
| have it more easy."
| badrabbit wrote:
| Yes, because the police serve you but MS serves its
| customers and even the police will not diagnose your car
| for you, they might say "we see gas leaking, stop
| driving" but they won't tell you if the fuel line, tank,
| injector,etc are responsible. MS's block is for MS
| customers not the public, MS also is not the only vendor
| that does this, there are dozens of vendors that provide
| domain reputation services like this to their customers.
| MS can block random sites and is their right, if you
| disagree stop using edge and use firefox maybe.
| iforgotpassword wrote:
| If you're hosting it on purpose, then you already know that
| it's the culprit and would've tried to change it anyways. I
| don't really see a scenario where telling the person who
| opened the ticket what the issue is would weaken the
| security measures or detection strategy.
| badrabbit wrote:
| That's not what is being said here, the domain is
| blacklistes and my comment was about MS not the bad guy
| telling the site owner the malicious URL. If you tell
| them the URL, they will change it and claim it was a
| compromise so they can increase campaign lifetime.
| abpavel wrote:
| Easy. Scenario: Malicious attacker looks for exactly what
| Microsoft detected, and fixes each specific detection
| while keep operating the undetected ones. The end result
| would be operational malicious site, without being
| detected.
| badrabbit wrote:
| That's exactly what I am saying...
| BoorishBears wrote:
| ... MS is telling _everyone_ that the root domain is on a
| black list. A malicious actor doesn 't need more than
| that, they already know the exact URL that malware
| resides at.
|
| A non-malicious actor doesn't know, so telling them the
| exact URL at least tells them where the compromised asset
| might be.
| badrabbit wrote:
| Yes a malicious actor needs more than that because
| compromised domains are valuable and keeping them alive
| longer means more money...
|
| A non-malicious actor who needs the URL isn't monitoring
| or responding to the incident properly. Threat actors do
| take advantage of this and simulate a fake cleanup.
| Actually they exclude certain ips and asns on phishing
| kits so that visiting the url gives you a 404 or a
| webhosts "cleanup" page.
| burnished wrote:
| Just a guess, but I think they don't want to serve as an
| oracle for the people whose malware they are trying to block.
|
| Not saying that isn't shit or frustrating.
| Dylan16807 wrote:
| Saying they detected malware already does that.
|
| Being slightly more specific shouldn't be a problem.
| dylan604 wrote:
| Sure, maybe not display it in the publicly visible
| warnings, but if the admins of a domain email you from
| the same domain as the flagged site, then maybe providing
| more detail at that point is an acceptable method of
| fixing the issue.
|
| Saying "we know you are compromised and know exactly
| where, but we're not going to tell" is very childish.
| Now, if they said for a nomial fee, we'd be happy to
| share the results of our work, would be another thing
| totally.
| dathinab wrote:
| "we know you are compromised and know exactly where, but
| we're not going to tell"
|
| The sad think is they didn't even tell that, they gave
| the admins no ways to be able to differentiate between:
|
| - we don't care if we destroy your company with a false
| positive and
|
| - we are sure we are right, if you didn't do it
| intentionally you are probably compromised
| justsomehnguy wrote:
| TXT DNS records are used by Google, Microsoft and LE
| exactly for this purpose.
| [deleted]
| ben174 wrote:
| Except that it could help attackers beefen up their
| tools. A certain amount of obscurity is good to keep the
| attackers from having too much information.
|
| I've been in the situation where a company kinda 'ghosts'
| me before. And found out I was indeed the bad player
| (unintentionally, of course).
| tomxor wrote:
| > don't want to serve as an oracle for the people whose
| malware they are trying to block
|
| Those people don't have a registered business; The people
| contacting Microsoft do.
|
| There are probably a bunch of excuses we can come up with
| that would make sense... but I think most people know the
| real reason, it's the same as with Google and Apple... they
| don't do customer support, and they don't take
| responsibility for any negative effects their services
| might have on others, at least not until someone big enough
| makes a fuss or lawyers get involved.
| inetknght wrote:
| > _Those people don 't have a registered business; The
| people contacting Microsoft do._
|
| I don't think you understand how sophisticated malware
| distribution can be.
|
| There's absolutely nothing stopping a "legitimate
| business" from distributing malware.
| IshKebab wrote:
| He's not saying there is. He's saying that it's pretty
| unlikely that the malware authors are going to phone
| Microsoft and ask why their site is flagged, so putting
| in some reasonable road blocks that a legitimate business
| would definitely jump over (e.g. talking to real people)
| would be plenty to remove the oracle issue.
| [deleted]
| jcrawfordor wrote:
| _should_? probably. But I also get, from a capitalist
| perspective, why they don 't: they probably get enough "we
| swear our website is actually fine" tickets each day that
| they would need a sizable dedicated team to offer that kind
| of assistance. I don't think any of the browser vendors,
| Google and Mozilla included, will go to any real effort to
| help the reporter. At least I haven't seen them do so. I
| think they take the view, and I don't totally blame them,
| that securing _your_ website is _your_ problem, and they aren
| 't going to offer security consulting for free.
| counttheforks wrote:
| lucb1e wrote:
| They're already checking where the malware is when
| reviewing a report or unlisting request. The email template
| would need exactly one value: the URL they found.
|
| Likely they already store this info somewhere so that the
| next time anyone reviews the domain, the reviewer cannot
| overlook it. In that case, the system could be completely
| automated, sending the info to the hostmaster or tech-c of
| the domain or something.
| 300bps wrote:
| In this case, that sure would be helpful. Now imagine that
| you're running a website that is intentionally trying to
| trick people into installing malware. You've successfully
| evaded tools like Smart Screen but now you've ended up on the
| list.
|
| You're not sure which one of your virus payloads set off
| their screen so you open a ticket. And Microsoft is supposed
| to tell you exactly how to get off their list again?
| izacus wrote:
| Yes, Microsoft should. Because hunting for shit people
| shouldn't be an excuse to hurt innocent people ever.
|
| Just like you shouldn't be beaten by the cops without
| knowing a reason for it.
| abpavel wrote:
| No, because they would cause the following scenario:
| Malicious attacker looks for exactly what Microsoft detected,
| and fixes each specific detection while keep operating the
| undetected ones. The end result would be operational
| malicious site, without being detected.
| [deleted]
| Dylan16807 wrote:
| In the specific scenario where they're running multiple
| kinds of malware on the same site, they won't know which
| one got detected.
|
| Is that really something to worry about so strongly that we
| screw over legitimate websites?
|
| A malicious actor can already know exactly what's detected
| if they run one malware at a time per site.
| salawat wrote:
| So what? Just leave legit users in the dark because
| assholes exist? This type of logic needs to die. Assholes
| continue to exist because we enable them to by not raising
| the bar high enough that compromise is impractical, and no
| longer easy money.
| from wrote:
| People underestimate the extent to which a bunch of
| opaque "anti-abuse" algorithms control things. Everyone
| is given a risk score and if you exceed an internal
| threshold they will never respond to your support
| requests until your complaint gets on the HN frontpage.
| Then as justification to continue their pointless cat and
| mouse game the abuse department types will come in and
| say "well if we told you why we arbitrarily decided to
| <steal your money/delete your 20 year old email
| account/prevent you from logging in with a weird error
| message> then the _real criminals_ would know how we
| detected them! "
| dtjb wrote:
| The fact that Microsoft detected malware is already known,
| publicly.
| lixtra wrote:
| Get a lawyer. Ask for an injunction by a court. Make smartscreen
| liable for the damage they do to you.
| neilv wrote:
| Yes, poster needs to talk with a lawyer. Ideally, a company
| would do this on Day One of the situation.
|
| And keep all the data you can (from Web, marketing, ads, etc.),
| to try to figure out and show how much this is costing you.
| "And here's where the hockey stick snapped in half."
| Animats wrote:
| Of course. As an outside party, you're not bound by
| Microsoft's EULA. You can go after them for defamation,
| tortuous interference with contract, etc. You're in a much
| better legal position than a customer.
|
| This is when you have a lawyer send a letter. That's cheap.
| That gets your lawyer talking to Microsoft's lawyers. Most
| commercial disputes are, in practice, resolved that way.
| progre wrote:
| You sound like a lawyer.
| t0bia_s wrote:
| Similar thing happen to me. My OneDrive links that I share with
| clients end in their email spam folder. It took mi few weeks
| before I realized that few clients was still waiting for my work,
| because they did not have it in inbox.
|
| I know that it is problem of email providers, but still I would
| like to leave OneDrive, but I cannot find alternative that is in
| similar price range as OneDrive (about 2 USD/month for 1TB).
| _hl_ wrote:
| If it's for clients, does it really matter whether you're
| spending $2 or $5 or $10 a month?
| Benanov wrote:
| Is your login page vulnerable to an Open Redirect?
|
| Run your page against OWASP top 10. You might find something
| nvr219 wrote:
| People talking about is it a false flag, real flag... Post your
| SaaS URL and you'll get a free security assessment from a dozen
| hners.
| freedomben wrote:
| That's undoubtedly true, but you'll also get a lot of assholes
| and script kiddies hoping to pwn your site for lulz, and they
| often don't care who gets hurt along the way. By posting you've
| just given them an easy legal defense. If it were me, I
| wouldn't do it. Not worth the risk.
|
| I would however, probably be willing to DM people individually
| after doing a small amount of due diligence on their comment
| history. I guess it depends on sensitivity of the site and how
| desperate they are.
| stickfigure wrote:
| That is such a weird take. You get assholes and script
| kiddies the moment your IP interface starts accepting
| packets. If you don't advertise to people who can help you
| (be it customers or potential advocates/partners) then what
| on earth are you doing?
|
| I put my company's website in my HN profile. Go ahead, make
| my day.
|
| (I'm not the OP and as far as I know don't have any security
| issues)
| MrStonedOne wrote:
| nvr219 wrote:
| > you'll also get a lot of assholes and script kiddies hoping
| to pwn your site for lulz, and they often don't care who gets
| hurt along the way.
|
| Yes... "Free security assessment" was a euphemism I'm afraid.
| yashg wrote:
| Oh yes! I have a desktop software and MS defender sometimes flags
| it as unsafe. Mostly happens after I release a new version. It
| scares away new users, even existing users get spooked. Have to
| file a report and have to send customers scan report from other
| scanners and convince them it's a false flag. Feel really
| hopeless in such a situation.
| TheLoafOfBread wrote:
| I sorted this out by buying a certificate and digitally signing
| the binaries. You can get it from GoDaddy, Sectigo, etc.
| Guid_NewGuid wrote:
| Same thing happened to us, after a week or so we just had to
| change subdomain of our login site. No answer was ever
| forthcoming on the previous domain and the new one remains
| unflagged months later.
| missedthecue wrote:
| When this happened to my software product I fixed it by
| purchasing a Comodo EV code signing certificate. It cost me $502,
| it was FedExed to me in a USB, and I signed my program. Tens of
| thousands of installs later, I have never had an issue with smart
| screen. Note that there are two types of code signing certs, you
| want the EV Code Signing Certificate. It will instantly give your
| program reputation that ends the smartscreen filter issue.
|
| Is it a corrupt system? Pay to play? Sure. But this is a
| guaranteed way to solve the problem. And way cheaper and 1000x
| faster and less of a headache than contacting an attorney (which
| a surprising number of people here are recommending!)
| [deleted]
| WesolyKubeczek wrote:
| Looks like protection racket.
| Eleison23 wrote:
| Well, when you're driving and you get pulled over, you show
| your driver's license to the police and they don't arrest you
| for driving without a license.
|
| It seems like asking to run code on other people's machines
| is a privilege, too. Unfortunately the World Wide Web has
| trained consumers to grant that privilege willy-nilly to
| every web page they visit. I am thankful that code signing
| and validation is ending the party in that way.
| WesolyKubeczek wrote:
| Yes, but quis custodiet ipsos custodes?
|
| With the driver's license, the police officer can usually
| easily see if you've been behaving like someone who found
| their license in a packet of chips or not.
|
| Does the certificate issuer perform any kind of due
| diligence to determine if the certificate should be given
| to this program?
|
| Racket protection's determining characteristic is that the
| outfit can't care less what you do as long as you pay your
| dues and don't cross them. And if you don't, it doesn't
| matter how upright a citizen you are or how paranoid about
| safety you are, your shop _will_ burn.
| Eleison23 wrote:
| The code-signing certificate says nothing about whether
| the program is worthy. The code-signing certificate
| authenticates the publisher. That's how it's supposed to
| be used. The due diligence for code security is up to the
| publisher, because they're staking their reputation by
| certifying it.
|
| The certificate authorities are separately run, by the
| way. I don't know how you could say Microsoft has a
| protection racket when they accept certificates from
| disparate authorities.
|
| Code-signing certificates enable users to discern
| reputation. A certificate confers a reputation and not
| holding a certificate means an unknown reputation.
|
| If I drive a car without a license, I can probably drive
| that car for years as long as I'm obeying laws and not
| causing trouble. A police officer who pulls me over may
| perhaps not ask for a license after all, but he doesn't
| know my reputation of obeying traffic laws; he's got to
| check my privilege. A driver's license in my jurisdiction
| carries reputation beyond just the driving privilege:
| infractions will rack up points.
| Sodman wrote:
| Sure, but "Pay $502 for the privilege of running code on
| other people's machines" doesn't seem like a big
| improvement?
|
| At least to get a driver's license you need to pass a
| driving test, and return periodically to update the photo
| and pass an eye exam.
| lixtra wrote:
| > It cost me $502, it was FedExed to me in a USB, and I signed
| my program.
|
| I'm surprised that it apparently had to be delivered
| physically. Did Comodo generate the private key for you?
| meltedcapacitor wrote:
| The point is the private key is on the USB gadget and stays
| there. It's not a dumb USB drive.
| chabad360 wrote:
| IIRC you are able to get the cert signed to an existing HSM
| USB (depends on the provider tho).
| midislack wrote:
| Are you in the same competitive space as MS? If so you shouldn't
| act surprised.
| bombcar wrote:
| Do you have a link to the domain? Perhaps it can be determined
| why it is triggering.
| fxtentacle wrote:
| Weaponized flagging is totally a thing on Amazon, so I wouldn't
| be surprised if with SmartScreen, too.
| vfclists wrote:
| d35007 wrote:
| > Too many Microsoft shills here.
|
| Can you quote one of the shills? I see people saying that OP
| should verify that it's a false flag. Are those the shills to
| whom you're referring?
| Dylan16807 wrote:
| Given the second sentence of 'Microsoft should be able to
| state exactly what is wrong.', then they probably mean these:
|
| https://news.ycombinator.com/item?id=33037323
|
| https://news.ycombinator.com/item?id=33037211
|
| And these ones showed up right after they posted:
|
| https://news.ycombinator.com/item?id=33037364
|
| https://news.ycombinator.com/item?id=33037349
|
| Edit: actually that first one was after they posted too? So
| their comment may not have been accurate the second they made
| it, but _three_ comments defending microsoft 's secrecy
| showed up in the next five minutes.
| phrz wrote:
| Have you considered that your service, unbeknownst to you, may
| have been compromised at some point in time, and the source of
| some phishing page or other malicious material?
|
| Besides that possibility, if your business is truly being
| "destroyed," have you contemplated retaining counsel to escalate
| things with Microsoft?
| m3047 wrote:
| This. Also: magecart for TTPs.
|
| OTOH it might not be. LinkedIn flagged a domain I own as
| malware and pointed fingers at Spamhaus. Spamhaus had it
| flagged, but removed the flag when I objected. Their management
| claimed sites which they flag did something to deserve it on
| LinkedIn, but never said what. (There is no malware. It's just
| cranky, especially to bots.) I doubt that Spamhaus' intent was
| that someone should publicly mark it as malware for other
| parties though.
| marcosdumay wrote:
| Does it hurt Microsoft in any way to answer those tickets with
| "no, your site is participating in a phishing campaign"? And
| maybe tell the OP how, so that he can clean the malicious
| material?
|
| And yes, that is a major defamation campaign led by Microsoft
| against the OP. And since MS even refuses to clarify their
| claim about the OP's wrongdoing, I imagine he would have an
| easy time in a court.
| Quarrelsome wrote:
| > Does it hurt Microsoft in any way to answer those tickets
| with "no, your site is participating in a phishing campaign"?
| And maybe tell the OP how, so that he can clean the malicious
| material?
|
| Ye, it tells bad actors how the detection system works.
| biorach wrote:
| No it doesn't. It simply tells that the detection system
| _has_ worked.
| Quarrelsome wrote:
| If they tell you the steps you have to take to get off
| the shit list then its not hard to reverse engineer how
| to avoid being on the shit list.
| iforgotpassword wrote:
| Yes, that's how it should work.
| ohbtvz wrote:
| Imagine that MS replies "we detected malware spreading
| from your site" without any other details. What is OP
| supposed to do then? Won't they be just as frustrated, if
| not more, than before?
| bell-cot wrote:
| Just "we detected malware spreading from your site" would
| sure narrow things down a lot. Time to inspect the web
| server access logs, 'diff' the site contents with a
| month-old backup, etc.
| mrguyorama wrote:
| They should be doing exactly that anyway.
| bell-cot wrote:
| Just as all Americans should be driving at no more than
| the speed limit...
| yamtaddle wrote:
| There is a 0% chance that a site could be spreading
| malware and there's not a single thing MS could point to
| to help out the owners find it that wouldn't leak Super
| Secret Advanced Mega-Genius Malware Detection Methods.
|
| They just don't want to because that costs more money
| than being a huge piece of shit does.
| dboreham wrote:
| The Catch-22 enabling "corporate responsibility shirking".
| marcosdumay wrote:
| Yeah, I don't buy this one. "Your site is participating in
| a phishing campaign, here is an example: $URL" doesn't tell
| a malicious party anything they didn't already know from
| the original MS warning.
|
| In fact, I'll go further. MS owns we an explanation why
| they are warning on any random site. Not only the site's
| owner.
| yamtaddle wrote:
| This is why well-regarded justice systems don't disclose
| anything about why they arrested someone and are jailing
| them indefinitely. It'd give criminals too much of an edge
| otherwise, and would surely be unworkable and lead to
| violent anarchy in short order.
| scarface74 wrote:
| Surely you don't consider the US to have a well regarded
| justice system do you?
| yamtaddle wrote:
| This is irrelevant to my post. Would removing _all_
| transparency from it help, or make it worse? Are there
| better-regarded ones that don 't reveal anything
| whatsoever to the accused and convicted, because that'd
| make it so hard to stop criminals that everything would
| fall apart?
|
| [EDIT] My point is simply that somehow we manage in
| basically every other space to let those accused of
| wrongdoing know what we think they did that looked like
| wrongdoing, but somehow when it's an Internet giant
| calling the shots that's just _impossible_ and _waaaaah
| too hard_ and the sky would fall if they ever treated
| anyone with any amount of humanity and respect. I think
| it 's grade-A bullshit and they've just figured out they
| can get away with being assholes at scale and no-one will
| make them stop.
| scarface74 wrote:
| There is no indication that the original poster did any
| type of security review to make sure that the block was
| justified. Let's start there.
|
| It's not just the internet. No company disclosed their
| fraud detection techniques.
| marcosdumay wrote:
| The OP sounds like somebody that would do a non-through,
| not very competent review, and not find anything.
|
| But it doesn't matter. MS is the one telling to the
| entire world that his software is not reliable. They
| don't get to tell it all over the world without bringing
| some evidence.
| yamtaddle wrote:
| MS isn't even giving them an idea of what _sort of thing_
| they think is going on. Completely ghosting someone is
| way beyond not disclosing fraud detection techniques.
|
| "We're using our enormous market power to wreck your
| company and won't even tell you _roughly the kind of
| thing_ we think is wrong " is so unacceptable it ought to
| draw an application of some kind of corporate death-
| penalty, if it's a pattern of behavior and not just a
| rare accident that goes against official policy.
| Certainly it's, all on its own, a strong argument that
| there shouldn't be companies this powerful in the first
| place.
| counttheforks wrote:
| ryandrake wrote:
| Yea, the first thing I would do is rigorously determine whether
| the problem is actually a false positive (note: not a "false
| flag" which is something entirely different). Seems a bit early
| to jump straight to "it must be a competitor."
| crumpled wrote:
| I'm having the same issue, but it's Xfinity blocking my site from
| their business customers. The official contact form seems to be a
| sinkhole. It's beyond frustrating. I feel maligned and defamed.
___________________________________________________________________
(page generated 2022-09-30 23:02 UTC)