NSI's [Shashi] Bellamkonda in a blog post on Sunday said the company had been getting reports of malware spreading on customers' Websites. "At this time since anything we say in public may help the perpetrators, we are unable to provide details. It may not be accurate to categorize this as a single issue such as 'file permissions,'" he blogged.
This is the second revelation in a week of a hack of NSI's servers. Hundreds of NSI-hosted WordPress blogs were hit with malicious iframes that would automatically infect visitors to the blogsites, and in some cases, spread fake antivirus software. The attackers pilfered blogger credentials which had been stored in plain text in the WordPress database.
What we do know is that the bulk of the attacks against NSI employed iFrames, an all-too-easy and common attack technique today. At the end of the Dark Reading story, Eddie Swartz, CSO at NetWitness asks great question about who is responsible: the ISP or the end customer:
The hacks raise an issue increasingly being faced by Website owners: what's the responsibility of the ISP or service or cloud provider to provide more application-layer security, NetWitness' Schwartz says."If people are understanding that the adversaries are injecting iframes and JavaScript and other code and crimeware at the application layer, potentially on a massive scale, is there any responsibility on the part of the ISP or service provider?" he says. "You can't expect your customers to have the technical capability" to address this, he says.
He's right: one can't expect retail hosting customers to have the technical acumen to stop all of these types of attacks. And, while all of the details aren't out yet, if the attack is the result of NSI's shared servers being infiltrated: there's not much their customers could do to protect themselves anyway.
For my security and business observations throughout the day, find me on Twitter.