站长手记-015 目录（手机版）

We recently discovered that some of your pages can cause users to beinfected with malicious software. We have begun showing a warning page to users who visit these pages by clicking a search result on Google.com.Below are some example URLs on your site which can cause users to be
infected (space inserted to prevent accidental clicking in case yourmail client auto-links URLs):

../
../master/master-015.htm
../englishweb/engmovies/e-engmovies-004a.htm

Here is a link to a sample warning page:
http://www.google.com/interstitial?url=http%3A//morricone.cn/

We strongly encourage you to investigate this immediately to protectyour visitors. Although some sites intentionally distribute malicioussoftware, in many cases the webmaster is unaware because:

1) the site was compromised
2) the site doesn't monitor for malicious user-contributed content
3) the site displays content from an ad network that has a malicious advertiser

If your site was compromised, it's important to not only remove themalicious (and usually hidden) content from your pages, but to alsoidentify and fix the vulnerability. We suggest contacting your hosting provider if you are unsure of how to proceed. StopBadware also has a
resource page for securing compromised sites:
http://www.stopbadware.org/home/security

Once you've secured your site, you can request that the warning be removed by visiting
http://www.google.com/support/webmasters/bin/answer.py?answer=45432
and requesting a review. If your site is no longer harmful to users,we will remove the warning.

Sincerely,
Google Search Quality Team

译文: 亲爱的morricone.cn网站所有人或管理员:

近日我们发现您的一些网页可能引起用户被其所带有的恶意软件所感染.我们已经开始对通过GOOGLE搜索结果来访问这些网页的访问者出示了一个警告页.下面是一些这类网页的URL地址:(为防止您的E-mail程序意外地自动链接到这些地址,我们已在其中插入了空格)

http://morricone .cn/
http://morricone .cn/master/master-015.htm
http://morricone .cn/englishweb/engmovies/e-engmovies-004a.htm

以下是我们的警告页的一个样例: http://www.google.com/interstitial?url=http%3A//morricone.cn/

我们强烈地敦促您立即去调查这个问题以保护访问者.由于有些站点故意地散布这些恶意软件,在很多情况下,(被其毒害的)网站站长对此却并不知情,这是因为:

如果您的网站已经被毒害,不仅需要从您的网页中移除这些恶意软件(通常它们是隐蔽的),更重要的还要确定和修补这些易受攻击的漏洞.如果您不知道怎样去进行,我们建议您联系您的主机提供者.为了保护您的网站免受毒害,还可以参阅一个资料网页: http://www.stopbadware.org/home/security

一旦您的网站已经得到了安全保护,您可以访问 http://www.google.com/support/webmasters/bin/answer.py?answer=45432 去要求重新检查您的网站并移除警告.如果您的网站不再对用户有害,我们将移除这些警告

GOOGLE搜索品质小组

There are three basic steps to maintaining a clean site:

Identifying badware on your site Removing badware from your site Preventing badware in the uture
Identifying badware on your site. The first step to keeping your website badware-free is to check for any badware that may already be on your site. Badware is software that fundamentally disregards a user's choice over how his or her computer will be used. Some applications are badware because they act deceptively or irreversibly (for example, an application that secretly installs spyware or that is difficult or impossible to uninstall). Other applications are badware because they have objectionable behaviors (such as displaying pop-up ads or changing a user's homepage) without fully and prominently disclosing those behaviors to the user in advance and seeking his or her consent. You can learn more about badware in our Software Guidelines.

Here are some common types of badware to look for:

1. Badware available for download on your site
Evaluate the software that you are offering for download -- including any third-party applications that are bundled with your software -- based on StopBadware's Software Guidelines. If the software that you are offering for download violates our guidelines, then it constitutes badware.

If your software is bundled with third-party applications, you may also want to check whether the bundled applications install any dangerous or deceptive code. One method for detecting this is to download the entire software bundle onto a virtual machine and scan it using anti-virus or anti-spyware programs.

2. Badware available on sites that you link to
If your website links to badware, your site's visitors may be in danger, even when the bad software or code exploits are not actually hosted on your site. Your web pages may violate our Website Guidelines if they automatically redirect to a website that hosts or distributes badware; directly link to executable files that are badware; link to another website that automatically attempts to install badware by exploit onto the user's computer; or contain substantial links to other website(s) that predominantly host or distribute badware.

Some ways to determine whether the links on your site violate our guidelines would be to check whether any of your links lead to bad software available for download on another site, or whether they lead to an infected page on another site. (We recommend that, when looking for badware, you use a virtual machine to avoid damaging your own computer.) It may also be useful to search through your site's source code and look for links to unknown sites, especially if the links are to executable files. Executable files include files with extensions such as .exe, .bat, .cmd, .scr, and .pif. There are also applications available that will allow you to scan for malicious links within a web page, and you can use these applications to help decide whether to link to that page.

You can also use the StopBadware reports and our Badware Website Clearinghouse as a resource -- search our database for information on the sites and software to which you link or are planning to link.

3. Badware distributed through ads running on your site
Advertising displayed on your site is another potential source of badware, since most ads include direct links to an external web page. Please see section 1.2 above for general information about our guidelines for badware found via links. If you display third-party ads on your website, check that the links do not lead to bad software or to a badware-infected web page. The methods for evaluating the software that is available through ads are similar to those described in section 1.1 above ("Badware available for download on your site").

You can use the StopBadware in-depth reports and our Badware Website Clearinghouse as a resource. Check the ad networks you are considering using in our database to learn whether other websites have had badware problems with those ad providers.

4. Badware links posted in user-generated areas of your site
If there are any areas of your site where users can post or upload content, these areas may be a potential source of badware or badware links. Please see sections 1.1 and 1.2 above for information about badware and badware links.

5. Hacking attacks to your site
Another common source of badware on websites is hacking attacks, which allow third parties to insert code or executables onto poorly secured websites. A common example is the "injection attack," in which a hacker uses a security vulnerability to inject harmful code into one of your web pages. Usually this code will be invisible on your site to you and to any site visitors, but will trigger the download of badware in the background of a visitor's computer. You can often detect whether this kind of attack has occurred by looking at the source code of your web pages and determining whether it contains any code that you did not place there.

Two common types of "injection attack" are:

Invisible iframes
Iframe tags are a kind of HTML tag. An iframe creates a small "window" on a webpage so that another webpage can load within the embedded window. Iframes are not always used for nefarious purposes; one frequent use, for example, is to embed a video into a blog post. When used by malicious hackers, an iframe can be made so small that it is invisible, and the visitor to the infected web page never knows that another page is also loading in the tiny iframe window. If you see code for an iframe with width="0" and height="0" in the source code of any page on your website, you have found an invisible iframe. Iframes are most commonly inserted at the very top or the very bottom of a web page's source code. A good first place to check for iframes is before the initial <html> tag that starts a web page's standard code, or after the final </html> that ends a page's code.

Obfuscated Code
Obfuscated code or scripts are designed to be hidden within the normal code for your site, so they can be hard to detect. The code is written specifically to prevent automated tools from discovering its purpose. Obfuscated code is not necessarily badware; some legitimate coders obfuscate in order to prevent others from copying their work. However, if you write the code on your site and you do not intentionally obfuscate, finding a block of obfuscated code may indicate an injection attack. The two most common ways code is obfuscated are through encoding and encrypting.

Encoding can sometimes be easy to spot because the encoding uses either "hex" or "unicode/wide" characters. For hex characters, you will see strings of javascript code that consists of percent signs with two character combinations after them (e.g. %AA%BB%CC). For unicode characters, you will see strings that consist of "\u" with four characters after (e.g. \u0048\u0069\u0021). Generally, blocks of code that have been encoded in this fashion will take up several paragraphs. If you find large blocks of text in your web page source code with either of the above patterns, it is likely to be obfuscated code.

Encrypted code is harder to find, because there are no set patterns. However, encrypted code will look like a block of unintelligible text. Even if you are not familiar with javascript coding, you will notice that normal javascript code on your site will use a syntax based on actual English words. Encoded or encrypted text will look like completely unintelligible blocks of letters, numbers, and symbols. Check your web logs for references to executable files that you don't recognize. Executable files include files with extensions such as .exe, .bat, .cmd, .scr, and .pif.

While most hacking attacks focus on html code, it is also possible for bad software itself to be uploaded onto a poorly secured site. Bad software can include unknown executables (such as files that end in .exe, .bat, .cmd, .scr, and .pif), javascript files, or even images uploaded to your site without your knowledge. Sometimes attackers will simply use your website to host badware and link to it from other victim sites. One method for detecting whether you are hosting bad software on your site is to download all of your source code from the live website onto a virtual machine and scan it using an anti-virus or anti-spyware program.

Removing badware from your site
How you should go about removing badware from your site will depend on what kind(s) of badware your site is hosting or linking to. Our general recommendation is to take your website offline while you clean and secure it, to prevent your site's visitors from being unwittingly infected in the interim.

1. If your site is hosting bad software for download
Remove the bad software from your website and don't make it available for download again unless you can be sure that it is no longer badware. You can learn more about what makes a piece of software badware in our guidelines. If you are the creator of the software in question, StopBadware may be able to offer recommendations for bringing your software into compliance with our guidelines.

2. If your site links to badware
Remove all badware links from your website.

3. If ads on your site are linking to badware
Remove all ads that link to badware. If you use an ad network, this may mean removing all the network's ads from your site until you can be sure the network is clean. You may also want to contact your ad provider and let them know that one or more of their ads is causing badware to be linked from your site.

4. If badware is linked in user-generated areas of your site
Remove the badware links from your site. This may involve editing user posts to remove the badware content, or deleting entire user posts.

5. If your site has been hacked
Take the site offline in order to keep from putting your site's visitors and your customers at risk. Then remove all of the offending code and fix all underlying security vulnerabilities before putting your site back online. Finding and removing a specific block of bad code that a hacker has inserted can clean your site for a time, but keeping your site from being infected in the future will require fixing the security vulnerabilities that allowed the hacker to insert the code in the first place. As such, be sure to check for and remove any backdoors left by the attacker. A backdoor will allow an attacker to get back into your site even after you have locked down the site.

Your hosting provider should also be able to help you figure out where the underlying vulnerabilities on your site are, so contacting them should be a top priority if you think your site has been hacked. You can also check your hosting provider's forums to see if any other webmasters using that host have been compromised. Checking user forums for the software used by your site can also help you see if other users have been compromised through flaws in the software, or if there are security updates which your site does not yet have in place.

Preventing badware in the future
1. Check software for badware before making it available for download
See section 1.1 above for general information on badware and our software guidelines.

2. Check links for badware before posting them to your site
See section 1.2 above for general information and our guidelines about badware in links.

3. Use only reputable, conscientious ad providers and regularly monitor them to be sure they stay clean
Make sure your ad network is reputable and actively screens for badware from advertisers. If not, switch and tell them why you switched. Remember that an ad hosted on your site, even if provided by a third party, is still a part of your web page. You should only accept ads from providers that you are confident are diligent about protecting clients from badware. You can use StopBadware's reports as a resource. StopBadware is working to bring the worst ad networks to light by posting reports showing websites that we've seen being victimized by ad providers.

4. Monitor user-generated areas of your site
Make sure your terms of use for posting to forums, blogs, and other user-generated areas of your site explicitly forbid posting links to badware. You may also choose not to allow users to link directly to any form of executable file or to insert javascript into forum messages or other user-generated content areas. Then actively monitor these areas of your site for suspicious links or executables. See section 1.2 above for general information and our guidelines about badware in links.

5. Close security loopholes to secure your site against hacking
Some basic steps that can be taken to make your site more secure include the following:

Use strong passwords.
Use SSH and SFTP protocols, instead of telnet or FTP. Telnet and FTP are both considered insecure because of their use of plain text protocols. They transmit usernames and passwords in a way that anyone with access to the network can read. SSH and SFTP are based on an encrypted protocol which prevents eavesdropping.
Scan your site for security vulnerabilities using a vulnerability auditing scanner (both free and commercial versions are available). Use security update management tools to detect missing patches and then apply those patches immediately.
Keep up to date on news relating to any software you or your host use on your site, and make sure you are always running the most recent versions, including security patches. Subscribe to, and regularly read, any newsletters or alerts offered by your hosting provider and software providers.
Make sure your hosting provider keeps all software updated, including security patches. If they do not, urge them to do so or switch to a hosting provider that you are confident does its best to keep its clients' websites secure.
When your site is clean, secure, and back online, you may want to notify your site visitors about the badware problem, and the steps you've taken to address it. If a user has become infected with badware after visiting your site, knowing what you've found will help them clean up their own computer. And telling your story can help other webmasters deal with similar situations on their own sites. If you'd like to share your story of how you cleaned your site with other webmasters, or would like to share tips for keeping websites secure, please visit our discussion list.

This page is an evolving resource. If you have further questions or suggestions for additions, please join our discussion group and share your ideas.

Thanks for your E-mail and important information, even though it seems too late.

It is sure that my web site was attacked by the hackers for many times since Dec.22,2007. These problems have been solved up to Jan.15,2008. All history has been published in my web page ../master/master-015.htm. I have browsed your wed page http://www.stopbadware.org/home/security . It give me much knowledge about the virus and hacker, 2-5 point of them mentioned by the page, just is that I have suffered in this time. For share the history, I have submitted a post in your forum today (name: qilingren)

I have submit a request as your prompt on Jan.30,2008. and I have checked your search result for "Morricone's music" or "莫里康音乐" yesterday, all results of English or other language (example French, German, Italian.....) have shown normal, but only Chinese search result is still harmful. So I have to submit request again today, I hope you will care and help to solve the thing.

With best regards

A Chinese webmaster HAN

译文: 亲爱的GOOGLE搜索质量小组先生们:

感谢您们地电邮和它的重要信息,尽管它似乎太晚了些

从2007年12月22日起,我的网站确实遭到了黑客的多次攻击.直到2008年1月15日,这些问题已经得到了解决.所有的经过已发表在我的网站的网页上 ../master/master-015.htm 我已经浏览了您们的网页 http://www.stopbadware.org/home/security . 它给了我很多关于病毒和黑客的知识,文章提到的2-5点,正是在这次事件中我所遭遇的问题. 为了和大家共享这段经历,今天我已在您们的论坛上发布了一的帖子(名字 qilingren)

在2008.1.30. 按照您们来件的提示,我已经提交了要求重新审核的申请,昨天,我在您们的搜索引擎中输入"Morricone's music" 或者 "莫里康音乐" 以进行检查,所有的英语和其它外语(例如法文,德文,意文....)站的搜索结果都已显示正常,但唯有中文站的搜索结果仍然显示是有害的.所以我不得不在今天再一次提出了重新审核的要求,我希望您们也能关心和帮助解决这个问题

最好的祝愿

一个中国站长 HAN

黑客遭遇记

2007.12.22-2008.1.16 我的网站连续发生了多起黑客攻击和有害链接造成的网页带毒事件.几乎涵盖了http://www.stopbadware.org/home/security 网页中所指出的各种网站受害类型.经过一个多月的努力,陆续查清了原因并逐渐恢复了正常运转.为了和诸位站长共享这一段艰苦经历所带来的教训,我已在 ../master/master-015.htm 我的网站网页上比较详细地介绍了整个过程.欢迎大家访问交流

有几点重要的问题在此说一下:
1.最后一次带毒是由太极链统计代码引起的.我已和他们联系.他们说他们正在和GOOGLE沟通此事.但何时解决不好说.我们实在等不起,我只好将其代码全部删除.杀毒软件的带毒提示立即消除了.另外据我的ISP告诉我,ITSUN统计也有类似问题(这些天该站似已停止服务),正好我也在用它的统计,所以也一并删除了,特告知在使用这两个统计的朋友

2.现在的互联网形势,可以用"环境险恶"四个字来形容.我看到全国互联网举报中心公布的举报数字每个月就有两万多件,平均每天700件.真不知他们是否忙的过来.因此只有自己先扎紧篱笆,防范野狗,千万不要麻痹大意.现在大家常用的各种ASP程序,漏洞不少,对于大多数非专业IT人士的站长来讲,要想完全堵死漏洞实在困难.本人思量再三,下决心舍卒保车.停用了包括留言本,统计,论坛,博客,ASP上传功能等等在内的一切ASP程序,只留一条EMAIL联系通道,虽感至痛(这里有几百位朋友的心血,虽有备份并准备在网页上陆续整理发表,但毕竟是一个极大的损失),但为了从根本上防止病毒重来,也只好忍受这断臂之痛了.也请各位站长慎思