When it comes to websites, a lot of people are lured in by two features: (1) Price and (2) Services. Understandably though, many people do not need to spend much money since they just want to host a personal or small website, but does that mean you should go with a cheap web host? If web hosts have improperly configured Apache servers, you can bet that malware developers will take full advantage of them to exploit and deface your websites. Take MPack, for example…

Poor configuration of Apache servers allowed multiple websites hosted on the same physical server to become infected in last month’s Mpack compromise.

An analysis by security researchers at the SANS Institute’s Internet Storm Centre reveals that only one of the websites hosted on a machine needed to contain a vulnerable PHP script to infect all the sites hosted on systems, in cases where Apache permissions were improperly configured. Often the root cause of the problem is when hosting firms skimp on hardware needed to add an extra layer of protective virtualisation.

Thousands of websites (mainly in Italy) were recently compromised using the MPack malware kit. This contained iframe tags that pointed surfers towards hacker-controlled websites.[more]

Tags: Websites