dolfje

The HackerNews effect, was unfortunately down for 3 min. Should be okay now. Apparently login into Wordpress was a query to much.

Yes and then you are using a packaged version. But those hosters don't use a packaged version. So yum update doesn't work. I would definitely advice everybody to use a package manager, because that helps you keep everything secure ;)

To clarify, when we say outdated PHP 5.3, we only mean the standalone PHP version. When an ubuntu version was detected, it was correctly marked as maintained. So all these hosters use 5.3 without package managers.

That is true, there are many manufacturers that keep up to date and add their own patches. Though for a frontpage, I don't think that is true. It is much easier to update your software, than going through all patches, keeping up to date. So for clients I believe you can maintain 5.3, but for just your own frontpage? I doubt it...

Also I would believe that having PHP 5.3 is an unique selling point, so they would advert that unique selling point on their website. (What wasn't done)

Yes, the OnePlus 2 is an allround winner. Just alone the dual sim for that price with that specs

I find this the most interesting part: "As we look at the data about outdated software, we see a real trend. (We used the alexa top lists) The top 10 most visited sites are ‘fully safe’. They don’t leak a lot of software information, but whatever they leak shows signs that they have the most up to date software versions or even have patched outdated software before a new release is made available. In most cases, the internet is their core business and they take care of their servers.

Going to the top 100 most visited sites, this drops to 93% ‘fully safe’. In other words, we could detect outdated software on 7 of the top 100 sites. In most cases, these were minor issues but we are already see that some sites have relaxed policies on server security.

The further we go from the most visited sites, the more servers have outdated software. And we believe this trend will continue as we scan more and more of the world. Our estimate is that about half of the servers have outdated servers (extrapolating the one out of four we currently have on 25.000 servers to 10 million servers). If we just look at the data of our own clients, we can support this theory, 39% have outdated software (and our current users are still security savvy, because they opted to use a security tool). Scary if you ask us."

That is because wordpress has just had another update. So basically everyone is outdated at the moment. But luckily the automatic updates of Wordpress will update most in the following hours/days. So it will become green ;)

We will come back with some more details, but at the moment we are having an internal discussion of how many details can be published. So expect it somewhere next week.

Indeed the problem is solved. The mobile stylesheet wasn't loaded on production. Sorry for the inconvenience. But glad you noticed and warned us ;)

Thanks everybody! 1 day on Hacker News, 1574 uniques, 103 signups, 15% signup rate and 53% total vulnerability rate. You all have some fixing to do. If you have more feedback, let us know (or spread the love).

Thanks, solved ;)

Good question! As you already hinted, we will not disclose all our security measures. But our platform is secured on multiple levels. First of all, all communication between you and our server is encrypted. No eaves-dropping possible. So only you known your own vurnabilities. Second because you have to verify your server, a thirdy party can't get secret vurnability data about your system. So they cannot use our system as easy tool to get attack vectors. Third we separate the scan logic and webserver logic into different servers. And only the scanner has information about passwords and secret information. So while we make our webserver very safe, the scan server is fort knox. One particular nice thing, the scanner server has no open incoming ports. So you cannot access it. Fourth the PHP dectector file will only react to our server and all data exchange is encrypted with keys only known to the scan server. The commands that have to be executed are also signed with assymetric keys, signed on an offline computer. Fifth we keep improving our security while monitoring our systems (with our service but also with other tools). Because new attack vectors are released everyday.

There is more logic to it. We try to detect if you use ubuntu/debian and suggest those updates. From the moment we know the exploits, we show them. Probably you're talking about PHP? For PHP 5.5.25 there are the following exploits CVE-2015-3414, CVE-2015-3415, CVE-2015-3416, CVE-2015-2325, CVE-2015-2326 and CVE-2015-3152. But none of them have information yet. (see https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3152) So as soon as they are disclosed, the exploits will automatically be shown (within 5 minutes)

We indeed compare versions against the latest version of the software. Though we also keep track of which versions are supported and also create an inventory with the CVEs and their risk. There are also vulnerability scanners incorporated. That is why we sometimes still show a version is outdated, while we don't know the actual version.

For now we spend more time into giving information on how to keep your system secure and make that as easy as possible. If we can present 1 solution to fix 22 cve exploits, we find that preferable to showing 22 issues that need to get fixed with detailed information about the cve. But should that data should still be findable for experts and is also shown our the data cards. (Except when the data isn't disclosed yet by the software manufacturer) So if you don't see the CVE, please tell us more details about the software that doesn't has vulnerabilities.

Thank you very much for the feedback!

We have had multiple meetings about the security concern of mail communication. And we opted (for now) to send the information by mail, just for the convenience and rapid delivery to the end user. Also in the thought that all information we scan about your server is actually publicly available. So getting the information to the owner as fast as possible is more important than hiding the information (as in security through obscurity). But as we progress, we definitely see the need to hide data and/or encrypt them in the mail. (Especially with the PHP detector)

I encourage all people to check their website. On our checker (http://security.uwsoftware.be/logjam) we see that 59% is still vulnerable (<= 1024 key). Even after checking most people don't upgrade. Note: the solution isn't that difficult (see https://weakdh.org/sysadmin.html)

So for a full test, I would recommend https://tls.so/ or https://www.ssllabs.com/ssltest/. But if you just want to check if your server has the logjam vulnerability, I would suggest http://security.uwsoftware.be/logjam. It just says No, Yes or Yes by the NSA (for 1024 DH keys). A little bit humour inside a scanner.