{"id":3021,"date":"2016-11-10T16:19:55","date_gmt":"2016-11-10T23:19:55","guid":{"rendered":"http:\/\/www.whitefirdesign.com\/blog\/?p=3021"},"modified":"2016-11-10T16:19:55","modified_gmt":"2016-11-10T23:19:55","slug":"a-case-study-in-sitelock-leaving-a-website-insecure-while-labeling-it-as-being-secure","status":"publish","type":"post","link":"https:\/\/www.whitefirdesign.com\/blog\/2016\/11\/10\/a-case-study-in-sitelock-leaving-a-website-insecure-while-labeling-it-as-being-secure\/","title":{"rendered":"A Case Study in SiteLock Leaving a Website Insecure While Labeling It as Being Secure"},"content":{"rendered":"

When it comes to the security of websites we frequently see that while security basics<\/a> are often not being done, security companies are pushing more advanced security products and services. Sometimes those two things come together, last month we looked at one cyber security company that claims to have \u201cclients in the intelligence community,\u00a0DoD\u00a0and nearly every cabinet agency\u201d and isn\u2019t bothering to keep the software running the various parts of their website up to date while telling the public they need to take advanced measure to protect their websites<\/a>. As we mentioned in a post the other day<\/a>, by comparison the web security SiteLock does keep the software on their own websites up to date, while leaving the software out of date on their customers websites that they are supposed to be securing. We ran across another example of that while looking at one of their case studies that is supposed to show how great their services are.<\/p>\n

The case study<\/a>\u00a0is missing basics details that would be needed to understand what was actually going on and if SiteLock had done anything to actual secure the website. The post claims the website in the case study was targeted by cybercriminals, but they don’t even mention what type of attack there was:<\/p>\n

When cybercriminals began to target Airspeed-Wireless.com last year, he became alarmed.\u00a0Spiridigliozzi took an investigative approach and soon determined the attacks were coming from an IP address in Iran. His host-provided security options were limited so instead he\u00a0blocked the malicious IP, hoping it would solve the problem.\u00a0Unfortunately it did not\u00a0and the hacking attempts continued.<\/p><\/blockquote>\n

Most hacks are not targeted, so it is entirely possible that what was actually happening was that website was being hit as part of mass hacks that wasn’t even\u00a0trying to exploit vulnerabilities relevant to the website and there wasn’t a real threat.<\/p>\n

Blocking IP addresses is not an effective security measure because if there is a actually a vulnerability then a hacker could easily get around it by simply using another IP address. It is important to note that the\u00a0web host, the one that SiteLock says has limited security options, is Bluehost, which is not only a SiteLock partner, but it’s parent company, Endurance International Group, is run by the owners of SiteLock<\/a>. SiteLock’s partners get paid handsomely for pushing SiteLock services<\/a>, so providing a poor security options would likely be financial advantageous\u00a0for them (that might be a good reason to avoid web hosts that have partnered with SiteLock).<\/p>\n

The case study that then moves on to another website:<\/p>\n

During the process Spiridigliozzi was attacked again, this time on a website he was developing. The new attack came from an IP address in Morocco. The hacker injected malware into the newly developed site and taunted Spiridigliozzi by engaging him in online chat.<\/p><\/blockquote>\n

There is no explanation as to how the website was hacked, which would be important information for people to know to protect their own websites and to determine if SiteLock could have actually prevented it and whether there might a more effective way to do that.<\/p>\n

In the next section the tout their TrueShield Web Application Firewall:<\/p>\n

SiteLock also wanted to provide Spiridigliozzi with a preventative solution. They installed the SiteLock\u00ae TrueShield\u2122 Enterprise Web Application Firewall (WAF)<\/a> on Airspeed-Wireless.com. This top tier WAF blocks bad bots, the Open Web Application Security Project (OWASP) Top 10 threats, backdoor connections and meets PCI standards<\/a>.<\/p><\/blockquote>\n

First it is worth noting that contrary to how they promote the service, this isn’t actually their service, instead they just slap their branding on\u00a0Incapsula’s WAF<\/a>.<\/p>\n

Next, just\u00a0the other day we discussed\u00a0an instance where one of their customers using the WAF was hacked again and they were told that they don’t cover backdoor access\u00a0:<\/p>\n

Now, after we\u2019ve been hacked yet again, I find out that is not true. SiteLock assures me that everything is set up correctly, and that the hacker must have a back door access point.\u00a0 They don\u2019t cover that. Bluehost doesn\u2019t cover that. I\u2019m screwed.<\/p><\/blockquote>\n

That obviously doesn’t match up with their claim in the case study that WAF blocks backdoor connections.<\/p>\n

Then they claim that numerous threats were blocked:<\/p>\n

Since it was installed, TrueShield has blocked 9,478 malicious threats, five SQLi attempts, and 27 visitors from blacklisted IP addresses.<\/p><\/blockquote>\n

What stands out is the fact that most of threats that were supposed be blocked are vaguely “malicious threats”, but a few\u00a0SQL injections attempts are broken out even those would also be a malicious threat. That vagueness is important since the reality is that probably only a small fraction of one percent of hacking attempts have the possibility of being successful (many hacking attempts will involve trying to exploit vulnerabilities in software not being used on a website for example). A useful measure would how many of the blocked attempts would have actually lead to the website being exploited if not running through the WAF, SiteLock probably doesn’t have any clue as to that sort of things since they don’t actually provide that service.<\/p>\n

The next section points to SiteLock odd idea of how to protect a website:<\/p>\n

Spiridigliozzi is grateful for the upgraded security, \u201cThe SiteLock suite of security tools now allows me to be more proactive in preventing unwanted visitors and bots from accessing my website, the dashboard gives me an immediate indication of any problems and I also receive email alerts if there are any issues.\u201d<\/p><\/blockquote>\n

If there is a vulnerability on a website the best way to protect against it is to fix it, trying to stop people that might exploit it is going to be harder to do and SiteLock doesn’t provide evidence of its effectiveness.<\/p>\n

It turns out that the website is actually insecure now in an easy to check for way. It is running an outdated version of Magento with known security vulnerabilities:<\/p>\n

\"sitelock-case-study-outdated-magento-version\"<\/a><\/p>\n

Magento does provide patches for older versions, so an outdated version might be secure, but in this the website MageReport.com reports<\/a> that the security patch that provides the same fixes as Magento 1.9.3<\/a> is not installed (both the security patch and Magento 1.9.3 were released on October 11):<\/p>\n

\"sitelock-case-study-security-patch-8788-not-applied\"<\/a><\/p>\n

SiteLock seems to be unaware of this as they are currently labeling the website as secure:<\/p>\n

\"sitelock-case-study-insecure-website-labeled-secure\"<\/a><\/p>\n

The Previous\u00a0Case Study Is Running An Outdated Version of Joomla<\/h2>\n

In the\u00a0case study<\/a>\u00a0that proceeding the one we just discussed, SiteLock promoted its scanning service:<\/p>\n

The SiteLock 360-degree Security Scan was placed on bluedgebiz.com. As the name suggests, the scan provides a comprehensive scan of Wilson\u2019s entire site. This includes a complete malware, network, spam, SQL Injection, and Cross-Site Scripting scan. With this scan, Wilson is alerted immediately if suspicious code or vulnerabilities are found.<\/p><\/blockquote>\n

In the past we discussed that we couldn’t find evidence that SiteLock was actually able to find vulnerabilities<\/a> and a past commenter who had a gotten their scanning service ended up with their website hacked four months later<\/a>. Both of which don’t point to this service being that great, but the other issue with this is that even if you are alerted vulnerabilities you would need to take action.<\/p>\n

Clearly something hasn’t worked in the case of this website as the website is currently running an outdated version of Joomla 3.6.3:<\/p>\n

\"sitelock-case-study-outdated-joomla-version\"<\/a><\/p>\n

Version 3.6.4 was released on October\u00a025. That version fixed “three critical security vulnerabilities”<\/a>\u00a0and by critical, Joomla really meant it in this instance as websites still running older versions (the vulnerabilities existed back to version 3.4.4) were quickly being exploited (it should be noted that Joomla provided a heads up to everyone four days before that version was released<\/a>).<\/p>\n","protected":false},"excerpt":{"rendered":"

When it comes to the security of websites we frequently see that while security basics are often not being done, security companies are pushing more advanced security products and services. Sometimes those two things come together, last month we looked at one cyber security company that claims to have \u201cclients in the intelligence community,\u00a0DoD\u00a0and nearly … Continue reading “A Case Study in SiteLock Leaving a Website Insecure While Labeling It as Being Secure”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[25],"tags":[77,39],"class_list":["post-3021","post","type-post","status-publish","format-standard","hentry","category-bad-security","tag-bluehost","tag-sitelock"],"_links":{"self":[{"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/posts\/3021","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/comments?post=3021"}],"version-history":[{"count":5,"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/posts\/3021\/revisions"}],"predecessor-version":[{"id":3064,"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/posts\/3021\/revisions\/3064"}],"wp:attachment":[{"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/media?parent=3021"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/categories?post=3021"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/tags?post=3021"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}