Clean-MX
I received an e-mail this morning from my hosting company, MediaLayer. They were passing on to me a complaint they had received from clean-mx.de, a spam filtering outfit in Germany. It seems that Clean-MX had been scouring the web and came across a file that it didn't like on my domain, and so they decided to take action.
They didn't contact me directly, though. Even though there's a handy Contact link on the main menu bar of every page on this site and a valid e-mail address in the domain's WhoIs record, so there's no excuse for not contacting me (also, all the standard contact addresses like abuse@ and postmaster@ work just fine.) Rather, they assumed that not only was the file in question malicious but also that I could not be trusted to remove it; they defaulted to the opinion that they were right and that I was intentionally hosting malware. Wrong on both counts, Clean-MX. And to add irony, the file in question is actually a malware removal aide.
Their system classified the file as Backdoor/Win32.Hupigon.gen, a specific diagnosis shared by only one malware scanner I've found: Antiy-AVL. I've never used Antiy-AVL (or known anyone who has) but relying on only one malware scanner's opinion when conducting an operation like this is just laziness, if not outright incompetence.
Medialayer, for their part, set the permissions of the file to 000 and then contacted me. This, I think, is an appropriate and balanced response. I was able to verify the checksum of the file, to make sure it hadn't been changed without my knowledge, and then change its permissions back myself. In all, the file was inaccessible for perhaps an hour while the rest of my site was left alone. Medialayer, once again, makes me glad I'm their customer (if you're reading this, Gurpreet's boss, give him a raise and a week's vacation because he's a great CSR/Tech.)
In the past, and even quite recently, I myself have discovered what appear to be malicious files on otherwise legitimate websites. Do you know what I do in those situations? I contact the webmaster/owner of the website using either their contact form, the WhoIs contact address, or the generic abuse@ address. I give them a link to the page and explain what I think is going on and, if applicable, a link to a VirusTotal scan of the file(s). For example, just this past week someone attempted to break into one of my servers and download some cracking tools from an FTP server. I looked up the server being used and found that it was an otherwise perfectly normal site for a NPO. I e-mailed the contact in WhoIs with the facts and they fixed the hole.
But Clean-MX? They e-mail my host and state matter-of-factly that I am hosting malware and ask my host to shut down my website. Excuse me?
Dear abuse team,
please help to close these offending viruses sites(1) so far.
Now, I understand that if you're plumbing the depths of the internet for malware, you'll never have the manpower necessary to manually verify each and every hit your automated scanners turn up. That's fine! I understand! But if you don't verify these things, you don't ask the domain's web host to take an entire website offline and accuse the site's administrator of a felony. To me, that's just common sense. To do otherwise is certainly unethical, and probably actionable.
But then I got to thinking. Why would a spam filtering company be scanning websites in search of malware? Could it be that they scan for supposed malware so that they can send an e-mail to web hosting companies, one of their target customer groups? Hmmm.
Clean-MX.de should either revamp its practices in this area, or shut the fuck up. The internet has enough assholes, thanks. And kudos to MediaLayer who acted quickly but not rashly, and with common sense in the face of bullshit alarmism.
June 17, 2011
Write a comment
Posts: 3
Reply #2 on : Sun November 20, 2011, 04:15:22
Posts: 3
Reply #1 on : Fri November 18, 2011, 08:22:28
Posts: 3
Reply #3 on : Wed February 15, 2012, 02:48:28