Heh.

My primitive websites are FREE of all javascript, the tool by which advertisers and corporation anger us with Paywalls, Nag screens and the like.

Hope all of them explode.

Make a website, name it 15579infected.com and name everywebsite. Most of the website owners would soon wise up by word of mouth and visit your website and most probably contact you and you tell them what vulnerability each one has so they can rectify. You can charge them for your service.

The old answer: communicate with major search engines and browser vendors. Dunno what to tell you now...

Report each domain to the major browser vendors so they can update their list of suspicious sites?

I believe the default configuration for suspected spam and phishing and other malicious sites is that the user gets a red warning page that they have to click through first. Website owner would either get notifications from users or notice the drop off in traffic?

In the old days you'd just do a whois of the domain name and email the system administrator or tech contact. But GDPR made whois data illegal and destroyed that system so now there is no way to contact anyone unless you both happen to be on the same corporate walled garden (facebook, twitter, etc) they might list on their site.

    > whois ycombinator.com
    Domain Name: ycombinator.com
    [snip]
    Admin Name: REDACTED FOR PRIVACY
    [snip]
    Admin Email: 1bd279b6ad24fb60b2e200db8f486c3f-2545852@contact.gandi.net

As someone in the UK, I'd expect something along the lines of (1) reporting to the website owner by email and if they don't respond then just (2) reporting it to the police. It used to be common to go to the hosting provider but I'm not sure if people still do that anymore. At this scale it would be kind to do (1) but also just jumping to (2) seems like more than enough to have 'done the right thing'.

https://www.ncsc.gov.uk/section/about-this-website/report-sc...

Work to add them to Google Safe Browsing blocklist (Why are they not on the list anyway? Surely Google will be interested in their technique)

Google, Facebook, Bing, other large platforms will get those websites blocked. Their traffic falls almost to zero. Then:

either web admin notices and fixes website

or people stop visiting yhem

either way, no more infected people, win for everyone.

oh by all means email them all directly saying you found a vulnerability.

im sure for 15,579 websites there will only be about 2500 of them that send the cops after you for "hacking their site", manageable

You could send an interview request to their technical staff with an assignment that injects the fix into their production environment.

I suspect that these problems exist everywhere at this moment in all major systems.

Perhaps a bot to attempt to make contact and alert the staff.

I like to imagine a rogue good-samaritan will go around "hacking" these websites to apply security fixes before logging out.

It's too bad that such a person would likely end up arrested if they don't mask their identity.

Tangential but related: can anyone point me towards what tools are being used to identify this kind of malicious JS?

I host a modest pile of WordPress and other applications, and all traffic gets proxied by nginx. I've been occasionally sniffing around for something that I could use to monitor the JS of outbound traffic and give me a heads-up if it smells like one of the sites is delivering something it shouldn't be, but I haven't found a tool for this that I like yet.

Whois on domain and IP.

Try abuse@[domain] or the admin contact listed in WHOIS.

Are you trying to get a bounty or something or just want to be responsible?

You can list them all out, with the specific pages/methods that are compromised and shouldn't get much backlash from the owners.

This is a different situation than a CVE

If you want to be paid for your efforts, I dunno :\

> We continue to reach out directly to those sites that we identify as particularly high impact and try to notify them, though this is happening on an admittedly small scale. The process of responsible disclosure consumes a lot of resources, use of security.txt is low, and the vast majority of our emails and messages go unanswered. It's simply not possible for us to scale this up.

...why?

Some of the sites collect credit card information. Wouldn't they have a 'contact us' or some other legal identity information required for collecting and charging cc's?

Other than looking at security.txt what else have they tried? did they try programmatically checking for a 'contact us'? or the old trick of emailing 'webmaster@domain.com' or 'admin@domain.com'? did I miss those details in the article?

Maybe things have changed in the past 10 years, but it was a MASSIVE deal if a website ended up on some site claiming it has malware. Like, contract-ending, people-getting-fired, 10s of thousands of dollars in lawyer fees kinda deal.

I don't think 'it's hard' is a good excuse to ignore responsible disclosure

[delayed]