Top all-time · #541
Sucuri Blog
Company blog · blog.sucuri.netsecurity
Sucuri Blog is the company blog at blog.sucuri.net, writing about security. Since 2009, 108 different Hacker News readers have linked it 393 times, most often “Uceprotect: When RBLs Go Bad”. It is still writing: the last post was on 2026-10-27, and you can follow it by feed.
Learn about website security, emerging vulnerabilities, and web malware infections from our team of website security researchers.
Most-linked posts?
- Uceprotect: When RBLs Go Bad7 people · 7 mentions · first linked 2021-02-13
- Large IoT CCTV Botnet Leveraged in DDoS Attacks6 people · 7 mentions · first linked 2016-06-27
- More Than 162,000 WordPress Sites Used for Distributed Denial of Service Attack3 people · 3 mentions · first linked 2014-03-10
- When a WordPress Plugin Goes Bad3 people · 3 mentions · first linked 2016-03-04
- Content Injection Vulnerability in WordPress3 people · 3 mentions · first linked 2017-02-01
- New Brute Force Amplification Attack Against WordPress XML-RPC3 people · 3 mentions · first linked 2015-10-08
- /2013/07/malware-hidden-inside-jpg-exif-headers.html3 people · 3 mentions · first linked 2016-08-10
- ImageMagick RCE Vulnerability – Critical3 people · 3 mentions · first linked 2016-05-04
- Beware of Unverified TLS Certificates in PHP, Python and Go3 people · 3 mentions · first linked 2016-03-31
- AdSense Abused with Malvertising Campaign3 people · 3 mentions · first linked 2015-01-30
What Hacker News says?
This has been done in the past. I remember seeing an advisory as far back as 2010, but at the moment can only find these two more recent advisories: https://websec.io/2012/09/05/A-Silent-Threat-PHP-in-EXIF.htm... https://blog.sucuri.net/2013/07/malware-hidden-inside-jpg-ex... The way we protected ourselves against it at <earlier company> (since we allowed image uploads at a variety of locations) was to decode and re…
Comment linking /2013/07/malware-hidden-inside-jpg-exif-headers.html
on “This JPEG is also a webpage”Submitted MySQL.com compromised via (guess what?) SQL injection as a story · 303 points
HN discussionhttps://blog.sucuri.net/2013/07/malware-hidden-inside-jpg-ex... Once you can run any command, you start passing in whatever commands you want.
Comment linking /2013/07/malware-hidden-inside-jpg-exif-headers.html
on “4chan Sharty Hack And Janitor Email Leak”Submitted GoDaddy store your passwords in clear and may access your VPS without permission as a story · 288 points
HN discussionThe main problem I've run into while running my own email server is IP reputation issues. It is still an ongoing issue for me. You can read my previous IP reputation issue in this comment [11]. You should make sure your server's IP address isn't blacklisted. If it is, you're going to have major delivery issues with some email server providers (ESP). Some blacklists you can check are listed here [0]-[3]. I think my m…
Comment linking /2021/02/uceprotect-when-rbls-go-bad.html
on “Running your own email is increasingly an artisanal choice, not a practical one”Submitted Malware Hidden Inside JPG EXIF Headers as a story · 221 points
HN discussionThat's very similar to what we are seeing as well: http://blog.sucuri.net/2014/09/bash-shellshocker-attacks-inc... Also, if anyone need a WAF to protect it in the mean while, we offer one that works very well with CloudFlare (their free plan). Our team is giving is free for 30 days to help out. Details: https://sucuri.net/website-firewall/ *Just email info@sucuri.net and they will get you hooked up. thanks,
Comment linking /2014/09/bash-shellshocker-attacks-increase-in-the-wild-day-1.html
on “Everything you need to know about the Shellshock Bash bug”Submitted Sony Music Brazil hacked as a story · 141 points
HN discussionWe posted some more details here: https://blog.sucuri.net/2016/05/imagemagick-remote-command-e...
Comment linking /2016/05/imagemagick-remote-command-execution-vulnerability.html
on “Remote code execution vulnerability in ImageMagick”Submitted MySQL.com currently Hacked (and serving javascript malware) as a story · 118 points
HN discussion>If it's an add, it's the most well-hidden ad in history So well hidden, it's practically underwater. http://www.paulgraham.com/submarine.html Yet in spite of how well hidden it was (or rather, because of), we're now all talking about Mr. Robot, somehow. Funny how that works! > No, it doesn't [parasitically hook in and waste resources]. [...] since you need [...] a specific and non-documented website to let it displ…
Comment linking /2014/10/threat-introduced-via-browser-extensions.html
on “Update: Looking Glass Add-On”Submitted Open Source Backdoor – Copyrighted Under GNU GPL as a story · 101 points
HN discussionIt looked like someone got access through a plugin to the htaccess file and some db entries. This article helped ( http://blog.sucuri.net/2010/07/understanding-and-cleaning-th... ) though I only found one db entry. However fixed the htaccess file.
Comment linking /2010/07/understanding-and-cleaning-the-pharma-hack-on-wordpress.html
on “Why you might not want to incorporate in the USA”Submitted Non-alphanumeric Backdoors as a story · 98 points
HN discussionTechnically true, but UCEPROTECT, in particular, is known to have some shady practices: https://blog.sucuri.net/2021/02/uceprotect-when-rbls-go-bad....
Comment linking /2021/02/uceprotect-when-rbls-go-bad.html
on “Ask HN: Why can't I host my own email?”Submitted Popular sites with Apache server-status enabled (leaking internal details) as a story · 95 points
HN discussionThat's a problem that will only get worse. To give an example, last year, Incapsula recorded ~9,000 IoT cameras attacking them. A few months ago, Sucuri recorded ~25,000. CloudFlare is seeing close to 50k. And that's the attackers just using a small portion of their real power for http floods. Our report from a few months ago breaking down the types of cameras and networking doing the attack - very similar to what C…
Comment linking /2016/06/large-cctv-botnet-leveraged-ddos-attacks.html
on “Say Cheese: a snapshot of the massive DDoS attacks coming from IoT cameras”Submitted GoDaddy shared servers compromised – .htaccess redirection to sokoloperkovuskeci as a story · 81 points
HN discussionHeck, even compromised wireless routers[1] and CCTV systems[2] become part of botnets. Anything that's known to be insecure will be exploited. [1]: http://krebsonsecurity.com/2015/01/lizard-stresser-runs-on-h... [2]: https://blog.sucuri.net/2016/06/large-cctv-botnet-leveraged-...
Comment linking /2016/06/large-cctv-botnet-leveraged-ddos-attacks.html
on “Is your SSH password revealed when you attempt to connect to the wrong server?”Submitted Google bots follow SQL-injected URLs from third party sites as a story · 75 points
HN discussionWe tell our customers that ad blockers are their first line of defense against malware on the web, and it's true. Web ads have been bad for years and continue to get worse, and content providers aren't doing enough yet to police the advertising on their site. Did you happen to see the recent link about the AdSense redirects? e.g. http://blog.sucuri.net/2015/01/adsense-abused-with-malvertis...
Comment linking /2015/01/adsense-abused-with-malvertising-campaign.html
on “Yahoo Homepage – Now Featuring Extra-Scammy Scams”Submitted New attacks today against Wordpress (lots of sites hacked) as a story · 66 points
HN discussionIt absolutely is. Specially now with thousands of cPanel servers known to be vulnerable: http://blog.sucuri.net/2014/09/bash-vulnerability-shell-shoc...
Comment linking /2014/09/bash-vulnerability-shell-shock-thousands-of-cpanel-sites-are-high-risk.html
on “Bash 'shellshock' bug is wormable”Submitted OpenX.org compromised and downloads injected with a backdoor as a story · 63 points
HN discussionUpdate from Godaddy's CSO (Chief Security officer): http://blog.sucuri.net/2010/02/godaddy-security-update.html
Comment linking /2010/02/godaddy-security-update.html
on “GoDaddy store your passwords in clear and may access your VPS without permission”Submitted SSH Brute Force – The 10 Year Old Attack That Still Persists as a story · 61 points
HN discussionREMOTE - Sucuri (sucuri.net): Junior (Security) Support analyst: Description: As a Junior Support Analyst you will be required to troubleshoot web site security issues (learn to fix them), analyse and decode malware, patiently engage with clients, and learn a lot about security :) We employ manual and automated techniques to analyze, decode, and fix web-based malware. The right candidate will have the opportunity to…
Comment linking /2012/02/sucuri-hiring-junior-support-analyst.html
on “Ask HN: Who is Hiring? (March 2012)”Submitted Bluehost got hacked and responded pretty badly (by lying to their customers) as a story · 61 points
HN discussionThat's as big as it can be. We started seeing attacks hours after the initial disclosure and shared some of them here: http://blog.sucuri.net/2014/10/drupal-sql-injection-attempts... This is a lot worse than Heartbleed, Poodle and others. Full database / server take over for 700,000+ sites that use Drupal.
Comment linking /2014/10/drupal-sql-injection-attempts-in-the-wild.html?updated
on “Drupal Core – Highly Critical Public Service announcement”Submitted How We Decoded Some Nasty Multi-Level Encoded Malware as a story · 46 points
HN discussion
