Kiwi Websites Could Be Hosting Dark Web Content
by Vertech · SCOOPA newly discovered vulnerability in PHP, software used by millions of websites worldwide, could see unsuspecting Kiwi businesses unwittingly providing cybercriminals with infrastructure to host illicit dark web content.
Auckland cybersecurity expert Daniel Watson warns that even basic business websites containing little more than contact details and a description of services could be hijacked and used to host illegal material, facilitate fraud or launch cyberattacks against other organisations.
The Managing Director of cybersecurity and managed IT services company Vertech and author of She’ll Be Right (Not!): A Cybersecurity Guide for Kiwi Business Owners says many small businesses mistakenly believe their websites hold nothing of interest to cybercriminals.
“Most small businesses have what we call a brochure website. It tells people who they are, what they do and how to contact them. There’s no customer database or sensitive information, so they assume there’s nothing worth stealing,” says Watson.
“But if somebody gains control of that website, they can use it for something entirely different. They could host illicit content, redirect visitors to fraudulent websites or use the server to launch attacks against other organisations.
“You could effectively become part of a criminal operation without knowing anything about it.”
The warning follows the discovery of two critical vulnerabilities in PHP, a programming language used by approximately 70% of websites worldwide, including many built using popular content management systems such as WordPress.
Advertisement - scroll to continue reading
The vulnerabilities could potentially allow attackers to execute unauthorised code on affected web servers, giving them access to systems that would otherwise be protected.
Watson says the consequences extend well beyond the theft of information.
“Once somebody has administrative access to a server, they can establish a presence there and run additional services. They might use it to host illegal material, create fraudulent banking pages or redirect visitors to other attacks.
“They could also hold on to that access and sell it to somebody else, or the server could become part of a botnet used to overwhelm other websites with traffic.”
He says criminals can exploit the credibility of an established business website to deceive visitors or disguise malicious activity.
The consequences for the legitimate business owner can be considerable, even when they have done nothing wrong.
Watson recalls an incident involving a hotel whose compromised web server was used to host a fraudulent copy of a Brazilian bank’s website. The resulting investigation led to the hotel’s servers being taken offline while forensic copies were made.
“There’s the potential for serious reputational damage, but there’s also the disruption to your business. You might not even realise anything is wrong until somebody contacts you or your hosting provider takes the website offline.
“How often do you actually look at your own website? For some businesses, it could be days or weeks before they discover what’s happening.”
The danger of set-and-forget websites
Watson says the PHP vulnerabilities illustrate a broader problem: businesses frequently commission websites, arrange hosting and then assume somebody else is looking after their security.
“It’s relatively easy to get a website up and running, particularly with platforms like WordPress. The problem is that websites are complex systems, and like any other technology, they need ongoing maintenance.
“Cybersecurity isn’t something you set up once and forget about. New vulnerabilities are discovered all the time, and software needs to be patched and maintained.”
He says the cost of website hosting can sometimes disguise significant differences in the protection businesses receive.
A hosting provider charging $40 a month, for example, may offer a basic service, while another charging $80 could include additional security measures, monitoring and maintenance.
“Most business owners don’t ask what they’re actually getting. They see two hosting packages, one is cheaper, and they choose that one.
“But there can be a substantial difference in the security services included. If you’re not paying for patching, filtering or other protection, you shouldn’t assume somebody is doing it.”
One safeguard is a web application firewall, which monitors incoming website traffic and can block suspicious requests before they reach the server.
Watson says this provides another layer of protection, particularly when a vulnerability has been discovered but the affected software has not yet been updated.
However, he cautions that no single security measure is sufficient.
“If you’re not filtering traffic, you’ve got an exposure. If you’re not patching the software, the vulnerability remains. And if an attack gets through before it’s patched, you’d better have a backup.”
Three questions every website owner should ask
Watson says businesses don’t need to become cybersecurity experts to reduce their exposure, but they should take an active interest in how their websites are maintained.
He recommends contacting their website developer or hosting provider and asking three questions:
Is our website being patched? Confirm that the operating system, website software and applications are regularly updated, including whether any action is required following the latest PHP vulnerabilities.
What security protection is included? Ask whether the hosting service provides a web application firewall, traffic filtering and other measures to detect or block malicious activity.
Are regular backups being made? Establish how frequently the website is backed up and whether it can be restored if compromised.
Watson also recommends that smaller businesses consider adopting a recognised cybersecurity framework, such as SMB1001, which provides a practical approach to improving security without requiring the resources of a large organisation.
The framework includes measures such as firewalls, antivirus protection, software updates, password management, backups and staff training.
“The point is to stop small businesses being easy targets. You don’t have to do everything at once, but you do need to start somewhere,” says Watson.
He says businesses should seek advice from a trusted IT provider if they are uncertain about their exposure.
“The PHP vulnerabilities are getting attention because they affect technology used across a huge proportion of the internet. But they’re just one example of the risks that come from leaving systems unmaintained.
“Even if your website contains nothing confidential, it’s still a computer connected to the internet, and that makes it useful to somebody who wants to do something illegal.
“Your website might not be worth much to a criminal for the information it contains, but it could be extremely useful for what they can do with it.
“The question every business owner should be asking is whether somebody is looking after it, or whether they’re simply hoping nothing goes wrong.”
Notes:
ABOUT DANIEL WATSON
Daniel Watson is Managing Director of Vertech, an Auckland-based cybersecurity and managed IT services provider. He is the author of She’ll Be Right (Not!): A Cybersecurity Guide for Kiwi Business Owners and has worked in IT and cybersecurity for more than two decades, advising New Zealand organisations on cyber risk, governance and business resilience.
Daniel was a regular technology commentator on RNZ National’s Tech Tuesday with Jesse Mulligan and has appeared as a cybersecurity expert on TVNZ’s You’ve Been Scammed, presented by Nigel Latta.
ABOUT VERTECH
Vertech is an Auckland-based cybersecurity and managed IT services provider specialising in supporting small and medium-sized businesses. Its clients include organisations in professional services, logistics, healthcare and the not-for-profit sector. Vertech provides cybersecurity, IT support and governance services aligned with recognised frameworks including CIS Controls and ISO 27001.
Advertisement - scroll to continue reading