36

Connecting to any SE site behind a ClearSwift web gateway now gives a "403 forbidden by proxy" error.

Clearswift reports 'cdn.sstatic.net' and 'sstatic.net' as categorized under 'Malware' category. Clearswift pulls in data from stopbadware.org so I did a search on there.

GFI reports badware-related activity on sstatic.net/ as of Oct 29th 2011

(From http://stopbadware.org/reports/3c8c4aab25dd4e180d3f1a0ee149835e)

While I can just unblock the site for me (and have done, hence I'm here now) I fear this may be part of a bigger issue. Has anyone else seen issues like this?

Edit

More information is avaliable on the reason from ClearSwift;

The site sstatic.net hosts obfuscated browser scripts known to be malicious

However running the ClearSwift virus scanner on all the resources loaded by SO reports no issues

Improve this question
8
  • If you Google for 'GFI', you get the website of this security company.
    – Yi Jiang
    Commented Oct 31, 2011 at 9:33
  • Makes me wonder if they verify the reports if it is simply listed as "misc exploit." I would have expected it would show the type of exploit or at least more details publicly.
    – Jeff Mercado
    Commented Oct 31, 2011 at 10:39
  • Are there any way of getting around this, if one doesn't control the firewall/filter?
    – iStrindhaug
    Commented Oct 31, 2011 at 11:28
  • @Dan hardly. In that case, it's the contents of a specific question (some keywords) triggering the alert; in this case, it's SO's CDN being reported as dishing out malware
    – Pekka
    Commented Oct 31, 2011 at 12:38
  • Unrelated sidenote, why does meta.SO use links to /content/ instead of the CDN?
    – Unfortunate
    Commented Oct 31, 2011 at 12:44
  • Works again, at least here! Thanks to everyone!
    – l0b0
    Commented Oct 31, 2011 at 13:32
  • I cannot understand how they could just randomly block whole domains based on just one vague report. --- Luckily it's temporarily "fixed" now; nice hack guys! =)
    – iStrindhaug
    Commented Oct 31, 2011 at 13:40
  • @Unfortunate the link stopbadware.org/reports/3c8c4aab25dd4e180d3f1a0ee149835e is dead (I think?, I can't access it)
    – William Martens
    Commented Nov 13, 2022 at 10:35

3 Answers 3

Reset to default
29

Thanks for the heads-up; that sucks.

There is no evidence whatsoever of any problems on sstatic.net. I have requested a review on StopBadware.org; I have no idea how long that usually takes.

Update: Luckily, cdn.sstatic.net is just a CNAME for our CDN provider's sstatic.stackexchange.netdna-cdn.com, so we've switched over to serving from that domain now. If anyone has whitelisted cdn.sstatic.net in their NOSCRIPT settings (or whatever), this won't work at the moment – but at least for people with non-broken browsers, this should fix the issue until the whole thing is cleared up.

Update 2: StopBadware has sent an email that sounds like this:

Congratulations! Nobody says you're hosting malware anymore. We will therefore stop trying to kick you off the internet for no reason. Of course, you probably still are infected, we just don't know it yet.

Oh, and also, please send us money, because we did such an awesome job.

Well, I'm kinda paraphrasing... Anyway, we'll give a couple of hours for blacklists to be updated and then switch back to regular sstatic.

Improve this answer
8
  • 1
    Maybe you should contact GFI directly, too. They being the source of the report
    – Pekka
    Commented Oct 31, 2011 at 11:16
  • 1
    I have no idea how long it takes, either, but the appeal on StopBadware seems to be moving along: i.sstatic.net/sR9P5.png. I agree with Pekka, go to the source. Flters other than ClearWire (Cisco) are also blocking based on the report, I'm not sure whether they pull from StopBadware or from GFI, or from whatever GFI pulls from.
    – Kevin Vermeer
    Commented Oct 31, 2011 at 11:58
  • 1
    Would it be possible to fallback on non-CDN if this issue last too long?
    – Loïc Wolff
    Commented Oct 31, 2011 at 12:57
  • @LoïcWolff: See my update; I did something very similar.
    – balpha StaffMod
    Commented Oct 31, 2011 at 13:32
  • @balpha did it apply to the chat, too? looks like the chat is using or.cdn.sstatic.net and it is blocked.
    – Loïc Wolff
    Commented Oct 31, 2011 at 15:06
  • 1
    @LoïcWolff: Ah yeah, possibly. Thanks; switching that as well.
    – balpha StaffMod
    Commented Oct 31, 2011 at 15:47
  • Just for info: I think the switch to netdna-cdn also stops visual voting feedback and the pop-up summary of activity etc for noscript users. Allowing scripts from that domain fixed the issue for me.
    – ire_and_curses
    Commented Oct 31, 2011 at 17:40
  • @ire_and_curses: Yes, I mentioned that in my answer.
    – balpha StaffMod
    Commented Oct 31, 2011 at 17:43
26

This was a false positive originating with GFI. I put in a call to their customer service who was a bit confused but helped us out getting routed to where we needed to go anyway. Not sure how you'd find it yourself, but their online appeal form is here: http://www.sunbeltsecurity.com/blockedsite/

I filed out request for review and it was responded to in about 5 minutes, their reply:

Hi:
Yes, this false positive has already been reported and acted on. The fix will go out in the next set of definitions, which should be released in 2-3 hours.

<removed>
GFI Software

So it looks like this should resolve itself as that's propagated downstream to all consumers like ClearSwift. Kudos to the GFI guys for helping us rectify this so quickly, hopefully all affected users will be good to go ASAP.

Improve this answer
10

I'm getting similar problems, my work proxy reports:

Based on your corporate access policies, this web site ( http://cdn.sstatic.net/ ) has been blocked because it has been determined by Web Reputation Filters to be a security threat to your computer or the corporate network. This web site has been associated with malware/spyware.

Threat Type: othermalware Threat Reason: Domain reported and verified as serving malware. Identified as a malicious site via network activity logged during malware analysis.

If you have questions, please contact Help Desk ( [email protected] ) and provide the codes shown below. If you believe this page has been misclassified, use the button below to report this misclassification. [Reported!]

Notification codes: 

(1, MALWARE, othermalware, 
Domain reported and verified as serving malware. 
Identified as a malicious site via network activity logged during malware analysis., 
BLOCK-MALWARE, 0x0919ac0d, 1320059640.952,    
AAAD+gAAAAAAAAAAJP8ACP8AAAD/AAAAAAAAAAAAAAE=, http://cdn.sstatic.net/)

The source of this message is Cisco's IronPort Web Reputation Filters using the Cisco IronPort SenderBase Security Network, which reports:

Web Reputation Score: Poor

Why is the reputation Poor? These are the most common reasons:

  • The website or IP address has exhibited activities that indicates it has been involved in the distribution of malware.
  • The IP address associated with this Website has been linked to highly suspect behavior.
  • By going to this site users are at high risk for getting infected with malware.
  • The host has exhibited activity that indicates it has been involved in Phishing attacks.
  • The hist[sic] is infected by malware or otherwise compromised by spammers or another malicious group.

The error causes my homepage to render as:

enter image description here

because the following network requests fail:

enter image description here

Strangely, everything (well, stub.js and all.css, I'm not a mod here) works just fine on MSO. They report 200 OK at http://meta.stackoverflow.com/content/js/stub.js?v=a1714a379225. It's the CDN that reports 403 Forbidden coming at http://cdn.sstatic.net/js/stub.js?v=a1714a379225.

I've used this fact to apply some styling to the broken homepage, with humorous results:

enter image description here

Off topic! Off topic! Off topic!

Improve this answer
1
  • 2
    Yes, Meta serves its static content itself, instead of going through the CDN.
    – balpha StaffMod
    Commented Oct 31, 2011 at 12:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .