8

On Christmas day, our web service came under an apparent attack and we responded by blocking the (single) source IP. Upon later investigation, it turns out the 'attack' was actually an intense vulnerability scan by a reputable company. It appears one of our hosting customers had requested it, but we don't know for sure.

The scan started with a request for what I assume to be a verification file (e.g. 38fsoif3n4.html) which did not exist. Unfortunately, our custom 404 page was temporarily misconfigured and returned an HTTP response code of 200 instead of 404. Presumably the bot checked for the verification file, was satisfied with a 200 response, and continued with the scan.

This version of events was pieced together from our log files and seems to make sense. The problem is, the company in question refuses to discuss the issue with us. In their first (and only) response to my questions, they acknowledged a scan took place and offered to pass our contact info along to the party that requested the scan.

Is this an acceptable response? I followed up and requested that since they had scanned our servers without our knowledge or consent - and presumably provided a report to a 3rd party - they should at least give us a copy of that report.

I also asked that they make their verification a bit more robust. They should, at the very least, inspect the contents of their verification file, rather than rely on a single HTTP 200 response. This was a fairly intrusive scan, with thousands of form submissions and SQL injection attempts over a short period of time. With that kind of impact, they should probably also verify via root domain email (e.g. postmaster@domain.com).

They have not responded at all to these (reasonable, I think) requests. For a security company, they've displayed a surprisingly lax approach to verification and may have revealed a vulnerability to a competitor or hacker.

How should I proceed? Legally? Executive Email Carpet-bomb? Public Shaming?

EDIT to clarify

We're not that concerned about our customer and would not pursue them legally. We provide a site-builder/CMS for non-technical users and host their sites in subdirectories. They can upload whitelisted files (no code) and enter text & html (client-side JS is OK, if they want). They would have no need to pen-test their own code, since they have none.

Our concern is the security company that scanned our server without permission, presumably gave the results of that scan to a 3rd party, and now will not even talk to us about it. I'd love to just let it go ("eh, big companies, whatta ya gonna do?"), but it seems irresponsible to just ignore it.

Just looking for any leverage, short of lawyering-up, to get the company to respond.

closed as off-topic by Deer Hunter, Graham Hill, Ohnana, schroeder Jan 14 '16 at 18:48

  • This question does not appear to be about Information security within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 6
    I'm voting to close this question as off-topic because it should be resolved by the legal department. – Deer Hunter Jan 14 '16 at 7:47
  • 1
    This is a legal question, but within the field of information security first. I would resume it to: "How to counterstrike when I am under attack from an unsollicited security scan?" – daniel Azuelos Jan 14 '16 at 7:56
  • I don't actually see it as a legal question, as I was being slightly facetious. The question is more along the lines of, "How does the security community police itself?" – michaelg Jan 14 '16 at 8:00
  • 2
    Public shaming opens you up to libel suits. Please, please consult a lawyer. – Deer Hunter Jan 14 '16 at 9:27
  • 1
    Your relationship with your customer isn't clear. You provide a CMS service, but what assurances do they have that you're providing real security? If the service scanned your customers website, with your customers permission, then do you really have any legal recourse against that? I don't think that's at all clear. – Steve Sether Jan 14 '16 at 19:12
2

Whether you could pursue legal action depends on the contract and terms of service you have established, however that's probably not the right way to go as it will cost you money and lose you at least one customer. You might also discourage your customers from having penetration testing done, which would be a bad thing.

I would recommend educating all your clients as to the right way to go about having pentests done. Inform them you wholeheartedly support security testing, but that it can impact all customers if it is not done right so they should contact you to discuss scope and timings.

1

What kind of service are you providing? It depends on your TOS what users can and can not do, if you have a hosting service it depends on your TOS if a user can scan his hosting account for exploits with automated means without your prior consent. Most secure aware people DO test their production scripts/programs not only on localhost, because configuration on shared hosting may reduce security or turn other unexpected security implications. They are right to not give out information as you are not the customer, you should pinpoint the third party and start from there, as far as the check goes they should have a better one, but my guess is there are other means of verifying ownership of a script/product so a test can be run. Also you can always look for intrusive script on your hosting service that was used to proxy or directly attack someone and that triggered the scan. Anywya the company was just doing their job.

  • 2
    I don't really blame the customer for requesting the scan, though we will be revisiting our TOS. I blame the security company for being so lax about obtaining appropriate permission to probe a server, and then (potentially) providing a list of vulnerabilities to someone other than that server's owner. – michaelg Jan 14 '16 at 8:04
  • It depends on the scan, you mentioned form submissions, that most likely is XSS, and SQL Inj. so most likly it was a test against a script and not the server config itself, they probably used a well known automated tool probably commercial one, you can actually pinpoint with good percentage the product by the attacks made and their succession, but that's not what you're after. I do understand you disapproving the situation, and i'm supporting that, still if you provide shared hosting than this is not a big deal and users should be able to do so. – Setekh Jan 14 '16 at 8:14
  • 2
    Users should be able to test the security of the virtual servers used in shared hosting but if I'm not mistaken this was a scan on the service itself which should be on a different non-virtual server. – Jonathan Gray Jan 14 '16 at 8:33

Not the answer you're looking for? Browse other questions tagged or ask your own question.