mapleleaf
MB Enthusiast
- Joined
- Dec 4, 2002
- Messages
- 1,719
- Location
- Hinckley, Leicestershire
- Car
- 2022 GLC 300 estate- replaced 2018 Gle 43 AMG Night - replaced previous 2015 E63 AMG
My company web site has been recently infected with a virus which thankfully our workstations Sophos protection flagged up when opening the admin section of our site to perform regular database maintainance of registered users. Its an interactive site where users can register and upload CV's.
Our web designers who Host the site on their servers ( but who are not our ISP ) have decided that they need to charge me 7 hours development time @ £85/hr to eradicated the virus and set in place measures to prevent a similar occurance. I think they have me by the short & curly's and I have no choice but to stump up just to get my site functional again. And with no guarantees that it will end there.
Has anyone else come across this type of virus? and is it reasonable to be charged to have it fixed even though its hosted on what ought to be secure servers?
I of course questioned their thinking as to why I should be charged - here is their explaination to me - I have removed their company name>
"SQL injection is prevalent in many forms and each case, like a new virus, has to be assessed and a corrective course of actioned defined. The best analogy to use is that of a virus, a virus is a breach of security but no ISP can or will ever agree to protect any mail recipient of a virus as every day the range, number and techniques deployed can change dramatically.
Certain mainstream anti-virus suppliers such as Symantec provide fixes and patches to such attacks and the end user simply pays an annual fee for that protection.
To date XXXXXX does not offer any guarantee against virus, Trojan, or hacking on a site by site basis. What is does protect against is security for its systems and infrastructure which are protected by firewalls, anti-virus, and intrusion detection systems. Any violation of these systems is immediately identified and corrective action taken for the good of all its clients.
When an individual site is hacked or violated it is the responsibility of the site owner, unless the site is hacked or violated by attacking the ISP's infrastructure i.e. they discover a hole in the firewall or manage to hack a terminal services client that gives them administrative rights on to a web server.
Tomorrow or the day after could potentially see other attacks on your site and as technology and techniques improve XXXXX does not have a crystal ball to see what threats might be coming.
Summarising to date we know the type of attack your website suffered and we have identified modifications to your site that will prevent this attack happening again. It might not prevent any other future type of attack, in a form that as of yet is not being deployed by activists. We can only react on a case by case basis.
Had the virus been introduced by someone breaching our security systems then as you suggest we would have reacted immediately and at our cost. Because this attack was at site level and introduced through your website we have offered to help you to fix the database and then prevent this particular type of attack from happening again but it must be at your cost. It is not commercially viable and we would never guarantee for XXXX to go around fixing everyone's site every time a new hacking technique is deployed or discovered anywhere in the world, as the arena is too fluid for us to understand all the threats and the solutions.
At the time of your site being developed we had deployed a number of techniques to prevent certain types of SQL injection but, since then, activists have deployed new techniques that need additional and more complex protection. As mentioned above even this solution deployed to date might not stop future attacks as new techniques are designed.
I trust this answers your query."
Our web designers who Host the site on their servers ( but who are not our ISP ) have decided that they need to charge me 7 hours development time @ £85/hr to eradicated the virus and set in place measures to prevent a similar occurance. I think they have me by the short & curly's and I have no choice but to stump up just to get my site functional again. And with no guarantees that it will end there.
Has anyone else come across this type of virus? and is it reasonable to be charged to have it fixed even though its hosted on what ought to be secure servers?
I of course questioned their thinking as to why I should be charged - here is their explaination to me - I have removed their company name>
"SQL injection is prevalent in many forms and each case, like a new virus, has to be assessed and a corrective course of actioned defined. The best analogy to use is that of a virus, a virus is a breach of security but no ISP can or will ever agree to protect any mail recipient of a virus as every day the range, number and techniques deployed can change dramatically.
Certain mainstream anti-virus suppliers such as Symantec provide fixes and patches to such attacks and the end user simply pays an annual fee for that protection.
To date XXXXXX does not offer any guarantee against virus, Trojan, or hacking on a site by site basis. What is does protect against is security for its systems and infrastructure which are protected by firewalls, anti-virus, and intrusion detection systems. Any violation of these systems is immediately identified and corrective action taken for the good of all its clients.
When an individual site is hacked or violated it is the responsibility of the site owner, unless the site is hacked or violated by attacking the ISP's infrastructure i.e. they discover a hole in the firewall or manage to hack a terminal services client that gives them administrative rights on to a web server.
Tomorrow or the day after could potentially see other attacks on your site and as technology and techniques improve XXXXX does not have a crystal ball to see what threats might be coming.
Summarising to date we know the type of attack your website suffered and we have identified modifications to your site that will prevent this attack happening again. It might not prevent any other future type of attack, in a form that as of yet is not being deployed by activists. We can only react on a case by case basis.
Had the virus been introduced by someone breaching our security systems then as you suggest we would have reacted immediately and at our cost. Because this attack was at site level and introduced through your website we have offered to help you to fix the database and then prevent this particular type of attack from happening again but it must be at your cost. It is not commercially viable and we would never guarantee for XXXX to go around fixing everyone's site every time a new hacking technique is deployed or discovered anywhere in the world, as the arena is too fluid for us to understand all the threats and the solutions.
At the time of your site being developed we had deployed a number of techniques to prevent certain types of SQL injection but, since then, activists have deployed new techniques that need additional and more complex protection. As mentioned above even this solution deployed to date might not stop future attacks as new techniques are designed.
I trust this answers your query."
)
