Can You Trust That Web Site?

Trust is hard to come by. When you get a phone call and the caller asks for personal information, it would be better for you to call them back at a telephone number you independently obtain. For example, they say they’re from your bank; call your bank and ask for them.

What can you do with web sites? The role of certificates is to allow you to trust that which is certified; a web site, for example. In the absence of a certificate or if you are convinced a certificate is insufficient, what else can you do?

The WHOIS command is a quick way to see if you might want to trust a web site. If they register anonymously, if they don’t want to tell you who they are, then don’t trust them. If their web page has no contact information, then don’t trust them. Don’t trust posted contact information to be accurate, but an absence of contact information is a good reason not to trust them.

If they market through fear, uncertainty and doubt (FUD), don’t trust them. Social engineering is at work. They may be correct, but shared mistrust should not be confused with trust.

A simple, free resource is hpHosts. It aggregates many information sources to discover if any of them know that the web site cannot be trusted.

1. Google Diagnostic
2. Perform vURL lookup
3. Malware Domain List Report
4. MalwareURL Report
5. RobTex Report
6. (McAfee) SiteAdvisor Report
7. (McAfee) Trusted Source Report
8. Web of Trust Report

The following message from hpHOSTS should not influence your decision to trust the website or ISP. Consult the IP reverse DNS feature of robtex.com or the Domain Dossier feature of CentralOps.net as a convenient mechanism to review DNS records.

WARNING: The IP PTR associated with this record, does not resolve. This is considered very bad practice and contravines (sic) the RFC Standards. Most legit ISP’s will have their PTR’s resolve to an IP.

Not included within hpHosts references: Trend Micro’s SecureCloud.

Security is transient. Each of these resources may have reviewed the web site and found it to be trustworthy one day only for it to be changed into an untrustworthy site the next day.

vURL Online will “quickly and safely dissect malicious or suspect websites.” Parse the HTML before you connect to a web page. It will run these tests from your choice of servers around the world. If you will be entering personally identifiable information, you may wish to know something to look for. Look for the HTML “form action“. You should see something similar to one of the following:

<form method="POST" action="/order.cgi">
<form method="POST" action="https://www.shop.com/cgi-bin/order.cgi">
You don’t want to see an IP address used; it is unprofessional and suspicious.

Here are some permutations of URLs and form actions:

http://domain.com/form.html <form action="/cgi-bin/login.cgi" method="get">	no encryption, not secure
https://domain.com/form.html <form action="http://domain.com/cgi-bin/login.cgi method="get">	switched from https to http, not secure
http://domain.com/form.html <form action=https://domain.com/cgi-bin/login.cgi method="get">	switched from http to https, secure
https://domain.com/form.html <form action=/cgi-bin/login.cgi method="get">	started and stayed secure

Malzilla, like vURL, is a web site analysis and de-obfuscation site, and Malware hunter.

hpHosts may help us find malware at this ISP [http://hosts-file.net/pest.asp?show=67.222.16.], perhaps even the new hosts for Russian Business Network (RBN). There are 0 (zero) found today.

DShield Mirror of ISC. ISC uses the DShield distributed intrusion detection system for data collection and analysis. Submit firewall logs here.

Temerc Check Spammers Learn if the email address or IP address or username is on someone’s SPAM list (and why).

Malware Block List Collects links to malware

Malware Patrol Malware Patrol is a free, automated and user contributed system for verifying URLs for the presence of Viruses, Trojans, Worms, or any other software considered Malware.

Additional network information tools are gathered at technicalinfo.net.

Summary: eCommerce and personally identifiable information require additional measures. Watch for the green bar in the URL window. See SSL Vulnerability Debriefing.