Half of malware-distributing websites have been hacked

Security vendor Websense has released a report showing that half of the malware-distributing websites it examined in the second part of 2007 were otherwise legitimate sites that had been hacked. The report points to unpatched software vulnerabilities and problems on shared hosting servers as key infection points for hacked sites.

For the many owners of hacked websites StopBadware has worked with over the past year, the fact that so many other sites are in the same predicament is slim consolation for the damage caused. Many owners of small business, nonprofit, and interest-based sites are what we at StopBadware have come to call “consumer webmasters” – website owners who’ve taken advantage of easy and cheap hosting plans and the simplicity of many content management systems to create fully functioning websites without needing technical skills. When a consumer webmaster’s site is hacked, he or she has no technical staff to turn to, and may not even know where to look online for help.

If you’re a website owner, don’t wait until your site is hacked to find help. Talk with your web hosting provider about their security precautions, and ask them how they’d handle a malicious attack. Look for user forums for the software you use to manage your site, and make sure you’ll be one of the first to know when there are new security updates. Finding a network of others working with the same website setup will mean you have peers to turn to if your site ever does run into problems.

Of course, StopBadware’s own resources are also available. Our security tips for webmasters is designed for owners of any site, whether or not it has been the victim of a hacking attack. And our discussion group is a growing community where webmasters (and any internet user) can seek help and advice. For every internet user, the hacking of legitimate websites is a reason for caution. Even trusted sites can be attacked, so it’s important to protect your computer regardless of where your web surfing takes you. If you don’t know where to begin, start at our help pages on badware.