Update on malware issue

Hi everyone,

I just wanted to post another update as well as more information. The update is that the site has been reevaluated by google and given a clean bill of health so we are up and running again (yay!). If you are still seeing the warning, it is because the change in status has not propagated to your part of the web yet, but it will soon.

I’ve pieced together the order of events and wanted to clarify the steps that were taken on this end and steps that are being taken to improve our security and communication in the future. So — what happened over the past few days:

• Apparently, sometime Sunday evening, a hacker began injecting malicious code via several servers in our host’s server bank using url’s. The hacker did not access any of Hyena Cart’s databases or information that is stored on the site. Here is a quote from our host:

  “The core issue behind the issue was due to the attack from the IP which we have blocked yesterday and it had affected multiple servers. Once we blocked that IP, no more sites were blacklisted in google. In most of the servers, issue was due to vulnerable wordpress plugins. But we haven’t find any such occurrence in hyenacart.com. Also no traces of malware injection has reported in last 24 hours http request.

  Since we haven’t find out the exact issue, we will monitor the server for next few days to see whether injection attempts occur again. As a preventive measure we have updated modsecurity to the latest version.”

• By Monday morning, google had noticed the malware on the site and had blacklisted Hyena Cart. Tickets and facebook posts began to trickle in regarding the issue.
• By 11:12 am, I was aware of the issue and contacted the host about it. By 11:40, they had isolated the issue and blocked the IP that was injecting the malware. At this point, the site was secure and no viruses were being installed by the site.
• At noon, I replied to the few wall posts regarding the issue. From my computer, all issues were resolved and no warning messages were showing in my browsers.
• For the rest of the day, I had very limited access to the internet, but monitored my email (which gets notification of facebook wall posts — usually) to ensure things were still under control. Since I did not see much activity, I assumed things were fine. This would have been the point in time to issue a broader communication to everyone about what was going on, but because 1) I knew the site was secure, 2) I didn’t realize that warnings were still being shown, and 3) I did not have the time to sit down and compose a well worded and well informed note, I did not do this. I sincerely sincerely apologize for this, but please understand that I was making the best decision I could, balancing all of the priorities I had, and based on the information I had at the time.
• At this point, the site was safe, but google had not yet changed its status. Thus, people were still getting warnings, even though the site was secure.
• At about 9:30pm, I was able to get back online and realized that there had been many people still unsure about whether to access the site and a *ton* of conversation I hadn’t realized was happening. I have done my best since to respond to everyone in as timely a manner as possible.
• As of this morning, google has removed HC from its blacklist and the warning messages have been going away as this change in status propagates across the web.

For anyone who contracted the virus, it was the “Live Security Platinum” virus. Please see this page for more information.

If you would like compensation for featured time or paid time because of yesterday’s outage, please contact us at support@hyenacart.com.

Obviously, my response to the issue yesterday was not perfect. It is not a simple task, deciding when and how broadly to communicate with the group. There are multiple ways of contacting you, including direct email, this blog, and facebook. I tend to try to contact only the people who are affected and, based on what I knew on Monday morning, I tried to do just that — replying to the facebook wall posts, emails, and support tickets that had come in before noon. If I had known later in the day how widely people were being affected, I would have prioritized making a wider communication, but the lack of emails in my in-box reassured me that things were fine.

As mentioned in the quote from the host, steps have been taken to increase security on the server. As for communication, I am trying to figure out how best to manage and prioritize communications. This is my proposal:

• Direct email — I will reserve this for what I feel are “Code Red” situations (where passwords, addresses, or other personal information stored in HC databases are at risk.)
• Blog — I will continue to use this to update sellers on software updates and other critical information that is important for you to know. You do need to opt-in to receive emails of blog updates.
• Facebook page — I will use this for more ‘everyday’ communications — cool products, fun tidbits. I’ll also use it for broader communication in the event of site outages.

As I’ve mentioned on the facebook page, I understand that some of you may feel the site is undersupported for your business needs. But for those of you who weigh the pros and cons and find that HC is still right for you business, I am profoundly grateful for your understanding and so happy to have you on the site. Thanks again for all your support!