Network Solutions Hack Highlights Hosting Risks

Website hosting vendor Network Solutions Inc. (NSI) has been forced to cleanse its customer Websites after a few "thousand" sites where attacked after an unspecified number of NSI's shared servers were infiltrated.While NSI is still evaluating the damage, according to this story in Dark Reading, the company believes it has found the root of the problem, but isn't saying much more:

NSI's [Shashi] Bellamkonda in a blog post on Sunday said the company had been getting reports of malware spreading on customers' Websites. "At this time since anything we say in public may help the perpetrators, we are unable to provide details. It may not be accurate to categorize this as a single issue such as 'file permissions,'" he blogged.

This is the second revelation in a week of a hack of NSI's servers. Hundreds of NSI-hosted WordPress blogs were hit with malicious iframes that would automatically infect visitors to the blogsites, and in some cases, spread fake antivirus software. The attackers pilfered blogger credentials which had been stored in plain text in the WordPress database.

What we do know is that the bulk of the attacks against NSI employed iFrames, an all-too-easy and common attack technique today. At the end of the Dark Reading story, Eddie Swartz, CSO at NetWitness asks great question about who is responsible: the ISP or the end customer:

"The hacks raise an issue increasingly being faced by Website owners: what's the responsibility of the ISP or service or cloud provider to provide more application-layer security, NetWitness' Schwartz says.

"If people are understanding that the adversaries are injecting iframes and JavaScript and other code and crimeware at the application layer, potentially on a massive scale, is there any responsibility on the part of the ISP or service provider?" he says. "You can't expect your customers to have the technical capability" to address this, he says.

"

He's right: one can't expect retail hosting customers to have the technical acumen to stop all of these types of attacks. And, while all of the details aren't out yet, if the attack is the result of NSI's shared servers being infiltrated: there's not much their customers could do to protect themselves anyway.

For my security and business observations throughout the day, find me on Twitter.