White Fir Design Blog

Sucuri’s Comparison to Other Security Services Doesn’t Present Evidence They Provide Real Security

Earlier this week we looked at how the website security company SiteLock compared itself to competitors. What stood out in that is their idea of security isn’t focused on securing websites, but on instead leaving them vulnerable to being hacked and then trying to incompletely deal with the result of that. That is a good way for them to make money, but it is bad for everyone else. They are not alone in doing that though, as the comparison page for another company, Sucuri, shows.

The main portion of the page is a comparison chart, but before that is text that seems more important in terms of understanding what Sucuri is actually doing and not doing. It starts:

Our constant research keeps us ahead of competitors.

The unique insights shared by Sucuri Labs and the Sucuri Blog have earned us press and media mentions from top news outlets, industry blogs, and cybersecurity journalists.

The reality here is that their postings seems to be focused on getting press coverage instead of actually keeping ahead of competitors in terms of protecting websites. If you look at their blogs they are focused on the after effects of websites being hacked instead of on how they are getting hacked in the first place. That isn’t a good sign for their ability to protect websites, since what is important is how they got hacked, not what was done after that. Since not only do you need to know how they are hacked to effectively protect against those things, but if you are protecting them, the after effects of hack don’t matter since they won’t have happened.

When they have actually discussed how websites are hacked it actually shows they are way behind. In one recent instance of that they were notified of a vulnerability involving two WordPress plugins weeks after it had been discussed on the blog of our Plugin Vulnerabilities service and weeks after the free companion plugin for that service had started warning people about the vulnerable versions of the plugins. So Sucuri isn’t even able to stay ahead of people just following that service’s blog, much less competitors that actually do the research they claim to do.

Next up is this:

A safe internet is our mission, so we offer free tools.

We maintain a free website scanner and guides to help you fix or prevent website hacks. Sucuri is recommended by customers and web professionals in over 60 case studies.

As we have discussed in the past, their website scanner is to put it politely, incredibly crude. For example, as of year ago it was falsely claiming our website had been defaced on the basis of a page on it being named “Hacked Website Cleanup”. Where that gets much worse and seems to dispute their claim that the “a safe Internet is their mission”, is that instead of presenting the questionable results of that scanner in a neutral fashion they go in to full scare mode at detection of a possible issue. It seems their real mission is to take as much money from people without a concern if that involves falsely claiming that websites are hacked. Doing that goes against two of their four claimed values:

Helpful

When a website is hacked or under attack, a website owner is at their most vulnerable state. We will be the calm in the virtual storm, standing by to restore peace of mind.

Trust

The security space is filled with snake-oil and unnecessary FUD (fear, uncertainty, and doubt). We are committed to building services in the best interest of website owners.

In reality they are taking advantage of people when they are at their most vulnerable and spreading the FUD they claim they are against.

Looking at one of their guides it shows a good indication about their lack on focus on securing websites. In the guide for dealing with a hacked WordPress website, there are numerous ads for their service, but there is no mention of one of the three basic components of a proper hack cleanup. That being, trying to determine how the website was hacked. Websites don’t just get hacked, something has to go wrong, so if you don’t figure out what went wrong, you can’t be sure you have fixed that.

There seems to be a good reason for information on determining how websites are hacked being missing, from everything we have seen Sucuri usually doesn’t do that when cleaning up websites (and when we have seen them doing that, they didn’t seem to have a basic grasp of how it should be done). For a company that is supposed to be protecting websites from being hacked, that is fairly big issue since it would severely limit their ability to protect other websites from being hacked, which might explain how they market the service, which we will get to in a bit.

Getting to the main portion of the page, which is a chart that compares Sucuri to other services, just a quick glance shows that it contains false information. In the chart they claim they offer “Complete” hack and malware cleanups:

The reality is that they don’t do two of three basic components of a proper cleanup. Those being securing the website (which usually involves getting the software brought up to date) and the previously mentioned trying to determine how the website was hacked.

Right before the comparison chart is paragraph that begins:

We encourage you to research your options, read online reviews, chat with our team, and make an informed decision about who to trust with your website, reputation, and business.

What is completely missing from that page (or Sucuri’s website in general) is any evidence, much less from independent testing, that their service is actually effective at protecting websites. You can’t possibly make an informed decision on a security service when the most important piece of information is missing. There are two possible reasons why that is missing. The first being that they don’t actually have any idea is their service is effective, which based on everything else we have seen about them wouldn’t surprise us. The second is that they know it isn’t effective, but they realized they can get away with that.

(Reading online reviews is not a good way to make an informed decision since, for example, you can find reviews praising services despite the service failing to properly clean up hacks repeatedly.)

What makes that lack of evidence more striking is that on their homepage they provide several other measures of their service:

Touting how many websites they clean up seems like it could be a good indication that the service isn’t actually effective at protecting websites, since if they could do that that should be the thing they tout and they shouldn’t be doing many cleanups (other than for new customers).

The fact that on the homepage they twice tout that their services that are supposed to protect websites, includes “unlimited” cleanups also seem like a good indication of that:

If websites were actually being protected they wouldn’t be hacked and therefore need to be cleaned up repeatedly.

Everything we have seen and heard, including people frequently contacting us looking for a security service that works after using one that didn’t, indicates that security service like Sucuri provides do not do a good job of protecting website. If you actually want to do something that will protect your websites, doing security basics will actually protect your website from most hacks.

If your website has been hacked you want to make sure to get it properly cleaned up, which involves removing anything the hacker added to the website, securing the website (which usually involves upgrading the software on it), and trying to determine how the website was hacked and fixing that. Many companies, including Sucuri, cut corners. So simply going with a well known company doesn’t mean that you are going to get a good result, in fact what we have seen is that the biggest names are usually very bad at security (lying about things has been effective method to make security companies popular, but it doesn’t help to make them good at security).

SiteLock Makes Up List of Hackable Websites While Ignoring Real Issue They Don’t Deal With

We frequently have people contacting us looking for advice after they have been in contact with the web security company SiteLock. A lot of the claims made by SiteLock that are relayed to us are untrue, which isn’t surprising considering everything we have seen and heard about that company. One of these claims that was passed along to us recently seems like something worth making a note of because it deals with how SiteLock sells people on the need for their protection services, while actually leaving websites vulnerable.

The owner of a website was told that while the hack of their website didn’t have much impact, the website would now be on a list of hackable websites and the original hackers or “worse” would return to more damage than the simple defacement that was done. The SiteLock representative was suggesting purchasing a $50 a month protection plan to protect against those future hackers.

We have never heard of a list of hackable websites and it doesn’t really make sense that a hacker would do a visible hack, which is what a defacement hack involves, and then come back and do something worse in the future. This would be like a bank robber breaking in to a bank vault and spray painting that they broke in, but not taking any money, but planning to come back and do that at a later date. That analogy sounds more like something a villain in a comic, movie, or TV show might do.

The reality though is that for a website to be hacked something has to have gone wrong. If you don’t fix that vulnerability then the hacker or another hacker could exploit the vulnerability again in the future. The solution to that is to figure out what that was and fix it as part of a proper hack cleanup. As we were just mentioning the other day though, SiteLock touts that they don’t do that, instead simply using automated tools to try to remove malicious code on the website, leaving the website vulnerable to being hacked again and again.

It also follows that SiteLock protection service wouldn’t provide good protection since they don’t know how websites are being hacked. Not surprisingly SiteLock doesn’t present evidence, much less evidence from independent testing, that their services are actually effective at protecting websites.

What seems to be the explanation for this is that SiteLock’s business model is built around getting reoccurring fees from people without having to do much for it. Properly cleaning up hacked websites would require having skilled people, which would cost serious money, and would only bring in money once. While selling people security services that are not expected to work that well, since there isn’t an expectation that websites can actually be secure, doesn’t require competent people. If you can get people to believe that websites just get hacked, as opposed to something going wrong that can be prevented, then it makes it easier to sell them a nebulous protection service.

If your website has been hacked you want to make sure to get it properly cleaned up, which involves removing anything the hacker added to the website, securing the website (which usually involves upgrading the software on it), and trying to determine how the website was hacked and fixing that. Many companies, including SiteLock, cut corners. So simply going with a well known company doesn’t mean that you are going to get a good result, in fact what we have seen is that the biggest names are usually very bad at security (lying about things has been effective method to make security companies popular, but it doesn’t help to make them good at security).

SiteLock’s Idea of Website Security Doesn’t Seem Too Focused on Actually Securing Websites

Recently, while searching for some information about another security company an ad for SiteLock also showed up in the search results:

The page linked to in the ad seems worth discussing as to what it says about the SiteLock’s view of website security (which is line with plenty of other companies as well), but the ad itself had a number of claims that stood out to us as well.

For example, based on everything we have seen SiteLock charges incredibly high prices (and not all in line with level of service you are getting), so the idea you are getting the “lowest price” seems laughable.

It also claims that you can “Switch to SiteLock for Free.”, which seems meaningless, as unless some other service charges you an extra fee if you previously used another service, there wouldn’t be a fee for switching. If you click the ad the only thing listed as being free is getting a quote (would someone else charge for a quote?).

The claims about “Ditch the Weak Security” and “the only fully automated website security” touch on what is seen on the page you are taken to when clicking the ad:

In that SiteLock claims there is no comparison between them and others when it comes to website security:

When it comes to comprehensive, automated website security, there is no comparison.

But in looking at the things they are comparing it shows they are not really all that focused on actually securing websites:

COMPLETE WEBSITE MALWARE DETECTION
AUTOMATED MALWARE REMOVAL
DOESN’T SLOW WEBSITE PERFORMANCE

If a website is secured there wouldn’t be any malware to be detected or removed in the first place. As we were just discussing yesterday with a real world example involving another well known security company, automated attempts to do both of those things don’t look to work very well either.

The details of those things being compared are either missing any evidence for claims as to SiteLock’s superiority (which seems like a basic and important part of a comparison) or don’t make sense.

For the first item they claim to “find more vulnerabilities, malware infections and other security issues” than anyone else:

SiteLock checks websites from the inside out and the outside in to find more vulnerabilities, malware infections and other security issues.

But no evidence is provided to back that up.

When it comes to vulnerabilities, in the past we have written about how we couldn’t find evidence that they vulnerability scanner was actually detecting vulnerabilities, much less more of them than anyone else. We later found that their vulnerability scanning looks to be at least, maybe only, running a tool called Nessus over websites, which causes some serious problems.

Next up is the claim about their malware removals:

SiteLock offers the only website security solution that automatically removes most malware. In instances when our software can’t eliminate an infection, our security team is automatically alerted to manually remove the malware.

There are a couple of obvious issues with that. First, they are not the only ones with automated malware removal. Second, when cleaning up a hack you don’t want to just remove it, as that alone does nothing to fix the vulnerability that allowed it to happen in the first place. So they are promoting that they improperly clean up websites, while making it sound like a good thing.

The final one doesn’t really make sense. They claim this about their service:

SiteLock scans are cloud-based, which means we do not slow down the customer’s website when we check for malware, vulnerabilities and other website security issues.

They claim this about their competitors:

The competition’s scans run on their customer’s website servers, consuming valuable resources that slow website performance.

But prior to that they claimed this about their competitors:

The competition typically only checks websites from the outside in, thus missing many potential security issues.

It doesn’t make sense that the competitors are checking “websites from the outside in”, but that their “scans run on their customer’s website servers”. In any case SiteLock is clearly going to use some resources to scan the websites, since they have to access them somehow to do that checking.

12M+ Customers

The claim on the page that “12M+ customers trust SiteLock to protect their website” is something we should take up more in detail sometime, as it is great example of SiteLock’s ridiculous claims. But a quick example of why that is ridiculous is that 6 million of that customer count come from their purchase of a company named Patchman. That company provides a service for web hosts that would patch some security vulnerabilities in some software used on their customers websites. That company doesn’t have 6 million customers, instead that is a claimed count all of the customers of the web host they do business with had. So half of SiteLock’s customers count are not necessarily even aware of the service being provided, much less to trust it to protect them. It also would provide limited protection since it only deals with some security issues and in the case of WordPress, the developers of WordPress already release security updates for older versions, so the service duplicates protection already provided.

Securing Your Website

If your website hasn’t been hacked what you should focus on is making sure you are doing the basics of security since those will actually help protect your website. If you are looking for a security service in addition to that, we would recommend you only use one that provides evidence from independent testing that they are effective at doing that. We should note that we have yet to see a company that provides that (or even presents evidence from non-independent testing to that effect).

If your website has been hacked you want to make sure to get it properly cleaned up, which involves removing anything the hacker added to the website, securing the website (which usually involves upgrading the software on it), and trying to determine how the website was hacked and fixing that. Many companies, including SiteLock, cut corners, as can be seen SiteLock by touting that they don’t do things properly. So simply going with a well known company doesn’t mean that you are going to get a good result, in fact what we have seen is that the biggest names are usually very bad at security (lying about things has been effective method to make security companies popular, but it doesn’t help to make them good at security).

Is SiteLock Making Websites Less Secure?

Recently we have run across evidence that SiteLock and their owners might actually be making websites less secure. While cleaning up a hacked website last week we noticed that at of one of SiteLock’s hosting partners, the Endurance International Group (which does business through brands A Small Orange, Bluehost, FatCow, HostGator, iPage, IPOWER, JustHost and quite a few others), a hacker has at least been targeting websites hosted by them or more concerning, the hacker isn’t so much as targeting websites hosted by them, but taking advantage of security issue with Endurance to gain access to their customer’s websites. You would think a web host would be interested in looking into something like that, but instead when contacted about hacked websites they just push people to hire SiteLock to clean up the websites, which does nothing to deal with the source of the hackings. Part of the reason for them doing that is that the Endurance gets the majority of the revenue for SiteLock services sold through their partnership, so they have a financial interest not to make their hosting as secure as possible. Another reason for pushing SiteLock is that the majority owners of SiteLock also run Endurance.

The very real possibility that the owners of a security company are also run a web hosts that is the cause of their customers being hacked is on the one hand kind of stunning, on the other hand it is in line with what we have come to expect when it comes to the handling of the security of websites.

Hacker Behind Recent Hack of Numerous EIG Hosted Websites Claimed They Had Full Access to One of EIG’s Servers Last Year

Last Thursday we mentioned how we had come across a hacker that had recently hacked numerous websites hosted with various Endurance International Group (EIG) brands. EIG does business through brands A Small Orange, Bluehost, FatCow, HostGator, iPage, IPOWER, JustHost and quite a few others. That the hacker was only hitting websites hosted with those brands stood out, since, if say, a hacker was exploiting a vulnerability in a WordPress plugin to gain access to them you would expect to see numerous different web hosts being represented.

At the least, that seems to indicate that the hacker is targeting website hosted with EIG brands, which is possible explanation of that situation. What would seem more likely though is that the hacker is gaining access to some part of EIG’s systems allowing them access to all of the websites on a server. Considering the hacker was hitting numerous website sharing the same IP address, which would likely indicate they are on the same server, that seemed like a reasonable possibility.

Proving that EIG systems are being exploited would be difficult without information they only have access to. Our past experience is that web hosts are rarely even willing to consider that they have been breached, much less admit that it has happened. As we mentioned in the previous post, things are worse with EIG, since they are run by the majority owners of a security company SiteLock and EIG gets a cut of security services sold by SiteLock to their customers. That creates an incentive not to provide their customers the best possible security and what we have heard is when contacted about a hacked websites that they just try to push their customers to SiteLock instead of doing any checking into the situation (that includes someone that contacted us last week that has the been hit as part of this hack).

While doing some more searching around on the message left in one of the files we found on a website hit by the hacker (that is also on the other websites being hit), “Hacked By Isal Dot ID”, we found that a year ago the hacker was claiming to have full access to a server that a website had hacked was on.

At the time of the hack that website was hosted on the IP address 192.185.142.185. The listed ISP of that IP address is Websitewelcome.com, which is HostGator.

(The website is now hosted on the IP address 74.220.219.116. The listed ISP of that IP address is Unified Layer, which is Bluehost.)

While the claim of a hacker isn’t necessarily reliable, it does raise further suspicion that there may be a security issue on EIG’s end. This seems like something they should be addressing. If you have been hit by this hacker and have gotten a response related to that instead of just being pushed to hire SiteLock please get in touch with us or leave a comment on this post.

Cleaning Up After StudioPress Sites and Sucuri Didn’t Protect or Properly Clean a Website

Two weeks ago we wrote about how StudioPress Sites and Sucuri hadn’t properly dealt with a hacked website, leading it to being hacked again. Subsequent to that we were hired to re-clean the website, which allowed us to see more of what had and hadn’t happened. The results, which we will get to in a moment, are not just a reminder that a security company being well known, as Sucuri is, doesn’t mean that they have any business being involved with security, but also the limits of automated security solutions in general.

Probably the most striking thing that we found, is that based on evidence we ran across in an error log file, the hack had been going on for more than year.

We often find that when we are brought in to clean up hacked websites the hack goes back much further then the website’s owner was aware of. That could be a good reason to use a service that is designed to detect the presence of malicious code on website, if used in conjunction with doing security basics, as that could give you better assurance that the website is secure. The problem with that is we have yet to see evidence presented that solutions that attempt to do that are all that effective. The one time we ran across a security company claiming that independent testing had been done, the result was that their product was 100% effective. That sounded unbelievable to us. One of the important questions as to validity of that was how the samples tested were chosen. It turned out the security company had provided the malicious code that was used to test their service against. That meant it wasn’t independent testing and also made it meaningless that they detected 100% of it, since they could choose things they knew the service could detect.

One of the most worrisome indications of the quality of services to detect malicious code on websites is that we have seen companies providing them having marketed them as if they will protect website from being hacked in the first place, which obviously isn’t remotely possible since they only come in to play after the website is hacked. Either the developers don’t understand really basic elements of what they are providing or they are rather blatantly lying, neither of which seems like something that should be true about a company that has anything to do with security.

In the case of this website that type of detection was supposed to be happening:

Finally, we partner with Sucuri for continuous malware monitoring, scanning and remediation. If malware is found we take the responsibility of removing it so you don’t have to worry about it. Additionally, we also scan for advanced threats, including conditional malware and the latest cyber intrusions.

But it wasn’t, as neither StudioPress Site nor Sucuri were the ones that finally detected the issue, instead person managing the website noticed the issue.

As we mentioned in the previous post, how the StudioPress Sites service is promoted though made it strange that detection and cleanup would even be needed to be provide with the service, because it was claimed that service would protect websites from being hacked in the first place:

Our “always on” proprietary intrusion prevention technology works continuously to keep your WordPress install safe from vulnerabilities, intrusions, and exploits. Our years of experience, plus audit input from multiple third parties, allows us to create configurations and settings that keep the bad guys away without handcuffing your working style.

Clearly it didn’t.

While re-cleaning the website we saw a several issues with what looks to be an automated cleanup done by Sucuri.

The first was a much less serious issue, but it was rather annoying for us, as Sucuri had left numerous empty files all over the website. It looks like if they remove all the code in the file because it is all malicious they don’t then remove the file. That created a couple of issues. The first being that when we did file comparisons to identify any changes made by the hack we had all of these empty files coming up in addition to files that still contained malicious code. The second being that when we started reviewing the log files to see how the hacker was able to continue to access the website, it looked at first glance that they were successfully able to access quite a few files, that actually were empty, that increased the time it took to find the logging of successful requests to malicious files that still existed.

Along those same lines we found that in other instances while Sucuri looks to have removed malicious code they left other content that had been added by the hacker, including comments that had been before or after malicious code. Those all then needed to be checked over during file comparisons, slowing down getting to the serious issues.

Those things then tie in with the much more serious issue. We were able to easily find the files that were being missed by Sucuri’s automated tools, which were allowing additional malicious files to return that they were able to catch (and then remove again and again). Simply doing some file comparisons, some quick checking over the files in some directories, and looking at the logging, allowed us quickly find what Sucuri’s tools were missing. None of those things are by any means advance solutions (it isn’t the first time simply solutions used by us have caught things they missed).

Takeaways

First and foremost, this situation should be a reminder that claims made about security whether by security companies or other companies should be viewed with great skepticism. If there isn’t evidence backing a claim there is good chance that, at best, it is being made without any idea if it is true or not.

Second, relying on a service that will try to detect and remove the result of a hack instead of making sure you are doing the security basics, which will prevent many hacks, is not a good idea since you can run into a situation like this where the hack goes on and on.

Third, any company that is offering to do cleanups with just automatic tools is probably a company you don’t want having anything to do with cleaning them up since they either don’t understand what they are doing or they are providing a service that they know can’t get the job done.

Finally, if your website is hacked, you want to make sure you hire someone that will properly clean it up. The three components of that are cleaning up the malicious code and anything else the hacker added, securing the website (which usually means getting the software on it up to date), and trying to determine how the website was hacked (which not only helps to prevent it happening again, but as we have found repeatedly, helps to make sure that the hack is fully cleaned up). One simple way to insure you are hiring someone that does that is to hire us, since we have always done those things throughout the many years we have been dealing with hacked websites.

SiteLock’s Vague Emails About Vulnerabilities Being Detected Don’t Indicate That Websites Have Been Hacked

We are always happy to provide a free second opinion if the web security company SiteLock or their web host partners are claiming that a website contains malware or is otherwise hacked, as we don’t want people pushed in to purchasing unneeded security services on the basis of their all to frequent false claims. In addition to people contacting us in that situation, we have a lot of people contacting us looking for that second opinion on whether their website is hacked in situations where there hasn’t actually been a claim that the website has been hacked. One situation we have seen that has come up fairly regularly is with vague claims that websites contain a vulnerability. A recent example of a form email they are sending out for that is the following:

Because website security is important, your hosting provider has provided you with a complimentary scanner from SiteLock that proactively checks for malicious threats and vulnerabilities. This scan regularly reviews your website plugins, themes and content management system (CMS) for potential vulnerabilities.

During a recent scan, a vulnerability was detected on your website.

For details on the findings, including the location of the vulnerability and remediation options, please contact SiteLock today. We would be happy to walk you through your dashboard and talk to you about next steps. Our security consultants are available 24/7 to answer your questions.

Call 844-303-1509 or email support@sitelock.com

There is good reason to believe that has no basis, considering the lack of any details, as well as things like us last August running across someone that had received a similar email for a hosting account that hadn’t existed for months and in June of last year running across SiteLock continuing to falsely claim that websites using WordPress contained vulnerabilities that had been fixed in earlier versions of WordPress than were in use on the websites, despite SiteLock being aware they were spreading false information.

You could probably safely ignore these messages, but if you want extra assurance you could contact SiteLock and ask for evidence of their claim (though we have heard in the past that they wouldn’t provide that) or check to make sure you are doing the important things to keep your website secure, like keeping your software up to date. While we don’t recommend it, we also offer a security review to check over things like if software you are using is known to be insecure.

US Government Contractor Involved in Questionable HUD Hire Also Provides “Cyber Security” Service While Having Hacked Website

Yesterday the Guardian reported that an adviser to the US Housing and Urban Development (HUD) department “had resigned from his position with Hud after the Guardian asked him to explain multiple allegations of fraud as well as exaggerations in his biography”. How he got hired in the first place still seems to be a bit of an open question:

Raffi Williams, a Hud spokesman, said in an email that Jafry was hired through Accel Corporation, a contractor. When this was put to Stacye Loman, the owner of Accel Corporation, she said in an email: “That is an incorrect statement.” Loman then gave the names of two different companies that she said had hired Jafry. She did not answer when asked if these had been subcontracted by her company.

That leads to a security angle, as the Accel Corporation advertises providing “Cyber Security” and other security related services (emphasis ours):

ACCEL’s major business driver is serving and fulfilling our client’s requirements with speed and excellence. We delight our clients every day with high value, expert information technology and related professional services.
ACCEL Corporation has information technology experts who answer today’s demands for both stand-alone and web-enabled, secure applications to manage information in a timely, organized and integrated format.
ACCEL Corporation provides the following information technology services to our clients:

Cyber Security

IV&V

Network Security

Counterintelligence

Intelligence

Security Assessment

Risk Assessment

Security Program Review

Systems Design, Development and Support

Systems Integration and Testing

Software Engineering

Database Design, Development and Management

Information Assurance

Web Development and Maintenance

Help Desk and User Support

Software Testing

Technical Writing

They could use some security help themselves, as their website is currently hacked, which can be seen in the results of Google site search for accel-corporation.com:

Those results mentioning casino games are clearly due to a hack of the website. Google has also spotted that the website is hacked and a label that “This site may be hacked.” to the listing for the website’s Careers page. When clicking on the Careers page we got redirected to top-trustedcasinos.com:

When companies providing security services don’t appear to be able to handle their own security, is it any wonder that security in such bad shape.

Hacker Targeting Websites Hosted With SiteLock Partnered HostGator and Other Endurance International Group (EIG) Brands

Recently we have been thinking that a way to help people to better understand why security is in such bad shape despite the amount of money spent on it, is to say to think of the security industry not as that, but as the “insecurity industry”. As security companies are not focused on improving security, but instead of making people believe that insecurity is inevitable and that they can provide protection, but not to the extent that people actually expect those companies to keep them things secure. A prime example of a company that would fit that description is SiteLock, which is a company that comes up often on our blog when it comes to bad practices of the security industry. The other day we had someone forward several messages they had received recently from them and part of one of those stood out:

Malware is a real problem that affects a lot of websites. It’s as prevalent as the common cold and can do some real damage if you don’t catch and treat it early.

So how will you know if your website gets infected with malware?

To help protect your website, your hosting provider has partnered with SiteLock to provide your website with a complimentary malware scanner. Every day this nifty little tool checks the first five pages of your website for malware, and sends you an alert if any is found.

Their idea of protecting websites isn’t making sure that websites are actually secure, which would prevent them from being infected with malware or otherwise hacked, but instead trying to detect the website is infected after being hacked and then offering services that still don’t secure the website. That is great way for them to make money, but it isn’t great for everyone else since websites can continually be hacked.

As that email indicates they are not alone in that, web hosts have partnered with them. Why would a web host partner with a company that isn’t focused on making sure their customers’ websites are secure? Well when it comes to what seems to be SiteLock’s biggest hosting partner, the Endurance International Group (EIG), a partial explanation is that the majority owners of SiteLock also run EIG. EIG also disclosed to investors at one time that they receive 55% of the revenue of services sold through their partnership. That creates a strong incentive for EIG to not provide the best security possible as that would mean less money for them and less money being made by another company owned by the people running EIG. It might explain, for example, why in the past we found that EIG was distributing known insecure versions of web software to their customers through one of the companies they own, MOJO Marketplace.

Over the years EIG has brought together numerous web hosting brands including A Small Orange, Bluehost, FatCow, HostGator, iPage, IPOWER, JustHost and quite a few others. The situation with a website hosted with HostGator that we cleaned up a hack on yesterday seems to be an example of where those incentives might have created a situation that doesn’t serve their customers well.

The website was hacked in way that it would serve spam pages with Japanese text to Google’s search crawler.

While you wouldn’t know it from many companies that cut corners when doing hack cleanups, one of the three basic steps in properly cleaning up a hacked website is to try to determine how it was hacked. With this website the files involved in the hack didn’t really seem to shed any light on that. The main piece of this hack involved code added to the index.php file of a WordPress installation that caused the code in a file at wp-confing.php to run, which would cause that code to run whenever the frontend of the website is accessed. That filename is similar to a legitimate WordPress file in the same directory, wp-config.php, which could indicate that the hacker has some knowledge of WordPress, but considering how popular it is, it doesn’t seem to be a good indication that the hack was anything WordPress related (we also didn’t find anything that was known to be insecure in the WordPress installation).

The hacker had also added the website to a Google Search Console account with the email address “xueqilve@gmail.com” and submitted a sitemap to get the spam pages added to Google’s index.

It looked like the malicious code causing the issue had been added a few days ago (though another file might have been there since November), so there still should have been logging available from when that occurred that would shed more light on the source of that. Unfortunately HostGator hadn’t had log archiving enabled by default in the website’s cPanel control panel, so we only had access to logging for the current day. That fact alone probably should tell you that the company doesn’t have much concern about security and it would be strange to not have that on if they had a legitimate partnership with a security company since that would be an obvious thing to do because of its importance for dealing with hacked websites.

As we have found though, SiteLock usually doesn’t attempt to determine how a website was hacked, so they wouldn’t have a need for that logging. Considering that they don’t usually do that, it makes it not all that surprising that services they offer to protect website don’t work well, since they don’t know how websites are actually being hacked.

We did have one last lead to follow in trying to get some idea of how the website was hacked. In the root directory of the website there was a file named bray.php that contained the following message:

Hacked By Isal Dot ID

Through the website Zone-H, which catalogs defaced websites, we could see that same file had been placed on numerous websites recently. In looking over a number of those websites what stood out was that they all were hosted with HostGator or other EIG brands. Here are examples of websites hit at several nearly sequential IP address registered to HostGator:

If a hacker was hacking websites through a vulnerability in a WordPress plugin for example, that isn’t what you would expect to see, instead you should see websites hosted with numerous different web hosts.

At best you have a situation where a hacker looks to be specifically targeting numerous websites at EIG brands. There is also the possibility they are taking advantage of some security issue on EIG’s end to hack the websites.

Even if they are just targeting website hosted with EIG brands that seems like something that the hosting company would want to investigate and try to prevent as much as possible. That doesn’t seem to be the case here because later yesterday we were contacted by someone else with the exact same hack. They said HostGator has only been interested in pushing SiteLock. When you understand the incentives involved, it really isn’t surprising that is happening.

Update March 19, 2018: We have now come across a article from year ago in which the hacker behind this, claimed to have had full access to a server that contained another website they had hacked. That website was hosted with HostGator at the time (and Bluehost now). While the claim of a hacker isn’t necessarily reliable, it does raise further suspicion that there may be a security issue on EIG’s end

Wordfence Employee Ridiculously Claims You Can Make Sites “invincible against all the attack methods that are associated with WordPress sites”

While we have seen the bad side of the security industry for a long time, certain things continue to be surprising to us despite having seen them many times before. One of those is sheer amount of lying that goes on (that is on top of the amount of the massive amount false and misleading claims that are not clearly lies), despite trust being an important part of security. One area we frequently see that with is claims that products and services can provide a level protection that they can’t possibly provide.

When it comes to WordPress security plugins two are tied for the most popular in terms of active installations according to WordPress.org. One of them, Limit Login Attempts, is focused on a threat that isn’t of real concern and the current version contains a security we discovered and disclosed through our Plugin Vulnerabilities service last week (that security plugins frequently are found to have security vulnerabilities is a good indication of the poor state of the security industry). The other, Wordfence Security, owes at least some of its popularity and maybe a lot of it to marketing it with the unqualified claim that it “stops you from getting hacked”:

The WordPress security plugin provides the best protection available for your website. Powered by the constantly updated Threat Defense Feed, WordFence Firewall stops you from getting hacked.

That claim used to be the second sentence of description of the plugin on the page for it on the Plugin Directory and more recently has been found in the answer to the second FAQ question on that page.

The reality is that security plugins can’t possibly stop a lot of hacks, Wordfence intentionally leaves websites not using their service as well as the plugin vulnerable to being hacked, and in testing over at our Plugin Vulnerabilities service we found that the plugin provided no protection or the protection was easily bypassed when attempting to exploit real vulnerabilities in other plugins.

Once again in our monitoring of the WordPress.org Support Forum to keep track of information vulnerabilities in WordPress plugins for our Plugin Vulnerabilities service we ran across a Wordfence employee admitting that the plugin doesn’t do what they claim. This time it had the added element that even while admitting to that, they were still claiming a level of protection that is contradicted by what they were responding to.

The Wordfence employee wrote this:

Sorry we didn’t get back to you sooner! Unfortunately, there are many attack vectors associated with WordPress sites that lie outside of your WordPress installation like insecure servers, insecure passwords, encryption flaws, shared hosting, and many others; all these things combined make your site vulnerable to attacks. Wordfence helps protect and secure the WordPress installation side of your site and it does quite an excellent job at that. No security plugin can help protect your site against every vulnerability that lives there out in the wild, we can only help mitigate the risks associated with a vast majority of them. I recommend taking some time to go through these articles that will help you better understand WordPress security and how you can make your site invincible against all the attack methods that are associated with WordPress sites.

One of the problems with that is that the failure of Wordfence Security in this instance related to the WordPress installation:

I found this morning that someone from India logged into my WordPress admin panel on Jan. 11th using by login.
I am surprised that Wordfence did not stop this since it had been blocking the ip address range this login occurred from.

That seems like something it should have been able to protect against if it truly “does quite an excellent job at” security of the “WordPress installation side of your site”.

Something else that stood out in the Wordfence employee’s statement is this:

go through these articles that will help you better understand WordPress security and how you can make your site invincible against all the attack methods that are associated with WordPress sites

Below that were links to several pages on Wordfence’s website. Nobody that knows and or cares much about WordPress security would possibly make a claim of invincibility like that, but Wordfence seems to have no qualms about telling lies to public to promote themselves. That unfortunately comes at the expense of the security of websites since people are being mislead about the security Wordfence can provide versus other solutions like our Plugin Vulnerabilities service, which provides real protection that Wordfence doesn’t provide, and our service helps to actually make the WordPress ecosystem more secure even for those not using it.

StudioPress Sites And Sucuri Didn’t Properly Deal With a Hacked Website

Recently we have gotten quite a few questions related to web hosts that include a security service with their hosting service. Considering that web hosts seem to have problems handling the basics of their own security this type of offering seems like it might not be a great idea. Furthermore, most of what needs to be done to keep websites secure isn’t best handled by a security service.

Another issue is that we haven’t seen evidence presented that those types of services are effective at protecting websites and plenty that they are not. One of the pieces of evidence that we have seen that they are not effective is that companies that provide those services often don’t do an important part of properly cleaning up hacked websites. One of the basic components of a proper cleanup is trying to determine how the website has been hacked. If you don’t do that, it leaves open the possibility that the vulnerability is still on the website and can be exploited again. If you are a service that is supposed to protect websites and you don’t even know how they are hacked, you unlikely to do a good job of protecting them.

Security companies can often get away with all of that because the public doesn’t have a good understanding of security and when it comes to the lack of protection, people will often say that such services have been successfully protecting them because they assume that if the website hasn’t been hacked that means the service worked. In reality most websites don’t get hacked, so a service can get credit for providing protection when it does little to nothing to protect websites.

One prominent web security company that all of that would apply to is Sucuri. From what we have seen over the years they don’t seem to have even a basic understanding of security (amazingly one time they warned people to beware of companies that don’t have that). They fail to even handle even more basics elements of cleaning up hacked websites than determining how the website was hacked.

Those kinds of things haven’t stopped the web hosting service StudioPress Sites (previously known as Synthesis) from partnering with them, which they promote in this way:

Finally, we partner with Sucuri for continuous malware monitoring, scanning and remediation. If malware is found we take the responsibility of removing it so you don’t have to worry about it. Additionally, we also scan for advanced threats, including conditional malware and the latest cyber intrusions.

Right before that in their marketing they make this claim:

Our “always on” proprietary intrusion prevention technology works continuously to keep your WordPress install safe from vulnerabilities, intrusions, and exploits. Our years of experience, plus audit input from multiple third parties, allows us to create configurations and settings that keep the bad guys away without handcuffing your working style.

If they were actually able to keep the bad guys out, why would what Sucuri is supposed to be providing be needed? The reality is that when it comes to WordPress, while you see everybody and their brother making claims about their great security, our Plugin Vulnerabilities service seems to be out there alone in catching the kind of serious vulnerabilities in WordPress plugins that would be exploited before there is evidence that they have been exploited (we disclosed two of those just in the last few days). Considering those are a major source of WordPress based websites being hacked, it seems to be a good indications that others are not really do much when it comes to protecting WordPress sites.

We became aware of the partnership between those two companies when someone recently contacted us about a hacked website and mentioned that the website been hacked again after having using Sucuri’s service to clean it up by way of StudioPress Sites. In a situation like that, the first thing we always ask is if the previous company that did the cleanup determined how the website was hacked, since if the source hasn’t been determined and fixed it could explain why the website got hacked again. They responded that they got some generic security advice, but no information about how the website had been hacked or any indication there was an attempt to do that. So it really isn’t all that surprising that it got hacked again.

Out of line with how that hosting is promoted, neither the web host nor Sucuri had been the ones that spotted the hack in the first place. That really isn’t all that surprising since it seems that Sucuri’s scanner is to put it politely, incredibly simplistic, which we base in part on the terrible false positives we have seen it produce.

A Better Cleanup

When we do a hack cleanup of a WordPress website not only do we do it properly, but we also include a free lifetime subscription to Plugin Vulnerabilities service, which will warn you if any of the plugins you use have disclosed vulnerabilities. We will also review all of your installed plugins for serious vulnerabilities using the same technique that we have used to catch numerous serious vulnerabilities in other plugins.