SquareSpace among thousands of hacked websites that are infecting visitors with malware

[MyNameIsNicola]

•  https://arstechnica.com/information-technology/2018/04/nasty-malware-campaign-using-thousands-of-hacked-sites-hid-for-months/
•  https://blog.malwarebytes.com/threat-analysis/2018/04/fakeupdates-campaign-leverages-multiple-website-platforms/

 

Quote

 

Thousands of hacked websites have become unwitting participants in an advanced scheme that uses fake update notifications to install banking malware and remote access trojans on visitors' computers, a computer researcher said Tuesday.

The campaign, which has been running for at least four months, is able to compromise websites running a variety of content management systems, including WordPress, Joomla, and SquareSpace.

 

 

[Crunchy Dragon]

Need some personal input to match guidelines.

[Rune]

Eh, .js files should be a giveaway in any download. Anyone that falls for it probably earned it.

[Glenwing]

Quote

The sites were hacked because operators failed to install available security updates or possibly didn't follow other basic security measures, Segura said.

Welp

[SpaceGhostC2C]

Just now, Rune said:

Eh, .js files should be a giveaway in any download. Anyone that falls for it probably earned it.

I'm pretty sure the PC user base is far larger than the number of people who know what a file extension is.

It's like saying people scammed by fake police officers deserve it, because the actual police uniform in the city they were at is a different shade of dark blue...

[Tieox]

Linus looking at his sponsors over the past few months :

 

[Jtalk4456]

This hurts, it hurts deep. I can just imagine all the people thinking they just updated their browser and get a bank statement in the mail 

[Guest The Viking]

It's time for alternatives!

 

Let me recommend you... Maxthon Cloud Browser! Compatible with a large amount of websites and formats, blocks all ads, etc, great browser to use. Includes a content snooper or whatever the name is, so you can download all your favourite youtube (and p0rn) videos without the need of an extra tool!

 

Also includes built in Passkeeper to securely store and fill all your passwords (and give them to china directly, double win), Maxnotes (similar to notepad) & UUMail (virtual mail inbox).

 

Download it here for free and save yourself a bunch of headaches, as most scummy sites won't work properly on there :  http://www.maxthon.com/index.php

 

Available for Windows, MacOS, Linux, iOS & Android.

 

yes it's a chinese browser so probably china gonna spy on yo ass.

 

Need to build a new website? 

 

Let me show you... Weebly! Easy drag and drop, free for personnal sites, rather cheap if you take longterm plans with their pro plan. 216$ for 2 years of pro which gives you access to all features needed in a modern website! All the plans (even free!) include a certificate for safe connection (the green lock), free 1 year domain on all plans (except free) & adsense credit. You can have a website up and running in 5 minutes by using their templates. Know HTML and CSS? Perfect, you can customize even more your website with the code editor!

 

Try it here for free: https://www.weebly.com/

 

Check their pricings here: https://www.weebly.com/pricing?lang=en

 

ps: yes i'm actually serious here 

 

edit: kinda copied squarespace talking points 

edit2: more talking points for maxthon, lel

[mynameisjuan]

33 minutes ago, Rune said:

Eh, .js files should be a giveaway in any download. Anyone that falls for it probably earned it.

Seeing how squarespace is designed for non-technical people to easily create a website for their business, I can tell you they didnt deserve it. 

[Ryujin2003]

So is this a have within Square Space itself it just a variety of subdomains? I hope Linus can address this and provider some insight and make us feel happier...

[leadeater]

SquareSpace build it secure beautiful 

[NumLock21]

They should have installed the protection of tunnelbear. I mean McAfee.

 

[Syntaxvgm]

Squarespace. Like geocities, except not fun.

[HalGameGuru]

I'm confused. Did they compromise squarespace as a whole or individual accounts due to shoddy security?

[Bcat00]

1 hour ago, HalGameGuru said:

I'm confused. Did they compromise squarespace as a whole or individual accounts due to shoddy security?

Same here, I know WordPress have server side hosting and a package for those that want to get their own server and it didn't state any of that in the article