# sstatic.net “Malware” warning

Connecting to any SE site behind a ClearSwift web gateway now gives a "403 forbidden by proxy" error.

Clearswift reports 'cdn.sstatic.net' and 'sstatic.net' as categorized under 'Malware' category. Clearswift pulls in data from stopbadware.org so I did a search on there.

GFI reports badware-related activity on sstatic.net/ as of Oct 29th 2011

While I can just unblock the site for me (and have done, hence I'm here now) I fear this may be part of a bigger issue. Has anyone else seen issues like this?

## Edit

The site sstatic.net hosts obfuscated browser scripts known to be malicious

However running the ClearSwift virus scanner on all the resources loaded by SO reports no issues

-
If you Google for 'GFI', you get the website of this security company. –  Yi Jiang Oct 31 '11 at 9:33
Makes me wonder if they verify the reports if it is simply listed as "misc exploit." I would have expected it would show the type of exploit or at least more details publicly. –  Jeff Mercado Oct 31 '11 at 10:39
Are there any way of getting around this, if one doesn't control the firewall/filter? –  iStrindhaug Oct 31 '11 at 11:28
@Dan hardly. In that case, it's the contents of a specific question (some keywords) triggering the alert; in this case, it's SO's CDN being reported as dishing out malware –  Pëkka Oct 31 '11 at 12:38
Unrelated sidenote, why does meta.SO use links to /content/ instead of the CDN? –  Unfortunate Oct 31 '11 at 12:44
Works again, at least here! Thanks to everyone! –  l0b0 Oct 31 '11 at 13:32
I cannot understand how they could just randomly block whole domains based on just one vague report. --- Luckily it's temporarily "fixed" now; nice hack guys! =) –  iStrindhaug Oct 31 '11 at 13:40

Thanks for the heads-up; that sucks.

There is no evidence whatsoever of any problems on sstatic.net. I have requested a review on StopBadware.org; I have no idea how long that usually takes.

Update: Luckily, cdn.sstatic.net is just a CNAME for our CDN provider's sstatic.stackexchange.netdna-cdn.com, so we've switched over to serving from that domain now. If anyone has whitelisted cdn.sstatic.net in their NOSCRIPT settings (or whatever), this won't work at the moment – but at least for people with non-broken browsers, this should fix the issue until the whole thing is cleared up.

Update 2: StopBadware has sent an email that sounds like this:

Congratulations! Nobody says you're hosting malware anymore. We will therefore stop trying to kick you off the internet for no reason. Of course, you probably still are infected, we just don't know it yet.

Oh, and also, please send us money, because we did such an awesome job.

Well, I'm kinda paraphrasing... Anyway, we'll give a couple of hours for blacklists to be updated and then switch back to regular sstatic.

-
Maybe you should contact GFI directly, too. They being the source of the report –  Pëkka Oct 31 '11 at 11:16
I have no idea how long it takes, either, but the appeal on StopBadware seems to be moving along: i.stack.imgur.com/sR9P5.png. I agree with Pekka, go to the source. Flters other than ClearWire (Cisco) are also blocking based on the report, I'm not sure whether they pull from StopBadware or from GFI, or from whatever GFI pulls from. –  Kevin Vermeer Oct 31 '11 at 11:58
Would it be possible to fallback on non-CDN if this issue last too long? –  Loïc Wolff Oct 31 '11 at 12:57
@LoïcWolff: See my update; I did something very similar. –  balpha Oct 31 '11 at 13:32
@balpha works great, thanks. –  Loïc Wolff Oct 31 '11 at 13:39
@balpha did it apply to the chat, too? looks like the chat is using or.cdn.sstatic.net and it is blocked. –  Loïc Wolff Oct 31 '11 at 15:06
@LoïcWolff: Ah yeah, possibly. Thanks; switching that as well. –  balpha Oct 31 '11 at 15:47
Just for info: I think the switch to netdna-cdn also stops visual voting feedback and the pop-up summary of activity etc for noscript users. Allowing scripts from that domain fixed the issue for me. –  ire_and_curses Oct 31 '11 at 17:40
@ire_and_curses: Yes, I mentioned that in my answer. –  balpha Oct 31 '11 at 17:43

This was a false positive originating with GFI. I put in a call to their customer service who was a bit confused but helped us out getting routed to where we needed to go anyway. Not sure how you'd find it yourself, but their online appeal form is here: http://www.sunbeltsecurity.com/blockedsite/

I filed out request for review and it was responded to in about 5 minutes, their reply:

Hi:
Yes, this false positive has already been reported and acted on. The fix will go out in the next set of definitions, which should be released in 2-3 hours.

<removed>
GFI Software

So it looks like this should resolve itself as that's propagated downstream to all consumers like ClearSwift. Kudos to the GFI guys for helping us rectify this so quickly, hopefully all affected users will be good to go ASAP.

-

I'm getting similar problems, my work proxy reports:

Based on your corporate access policies, this web site ( http://cdn.sstatic.net/ ) has been blocked because it has been determined by Web Reputation Filters to be a security threat to your computer or the corporate network. This web site has been associated with malware/spyware.

Threat Type: othermalware Threat Reason: Domain reported and verified as serving malware. Identified as a malicious site via network activity logged during malware analysis.

If you have questions, please contact Help Desk ( helpdesk@mycorp.com ) and provide the codes shown below. If you believe this page has been misclassified, use the button below to report this misclassification. [Reported!]

(1, MALWARE, othermalware,
Domain reported and verified as serving malware.
Identified as a malicious site via network activity logged during malware analysis.,
BLOCK-MALWARE, 0x0919ac0d, 1320059640.952,


The source of this message is Cisco's IronPort Web Reputation Filters using the Cisco IronPort SenderBase Security Network, which reports:

Web Reputation Score: Poor

Why is the reputation Poor? These are the most common reasons:

• The website or IP address has exhibited activities that indicates it has been involved in the distribution of malware.
• The IP address associated with this Website has been linked to highly suspect behavior.
• By going to this site users are at high risk for getting infected with malware.
• The host has exhibited activity that indicates it has been involved in Phishing attacks.
• The hist[sic] is infected by malware or otherwise compromised by spammers or another malicious group.

The error causes my homepage to render as:

because the following network requests fail:

Strangely, everything (well, stub.js and all.css, I'm not a mod here) works just fine on MSO. They report 200 OK at http://meta.stackoverflow.com/content/js/stub.js?v=a1714a379225. It's the CDN that reports 403 Forbidden coming at http://cdn.sstatic.net/js/stub.js?v=a1714a379225.

I've used this fact to apply some styling to the broken homepage, with humorous results:

Off topic! Off topic! Off topic!

-
Yes, Meta serves its static content itself, instead of going through the CDN. –  balpha Oct 31 '11 at 12:42