Ask HN: Microsoft SmartScreen is destroying our business

320 points by captain_dfx 3 years ago | 195 comments

About a month ago, Microsoft SmartScreen suddenly started flagging the login page of our SaaS dashboard as 'unsafe', scaring away our customers.

We understand false flags can happen. So we took to the official SmartScreen feedback site to report the false flag (as the website owner). Received an email that stated it would take up to 24hrs to analyse: 'If the status of your site has not changed after 24 hours, please contact us with a reply to this message'.

Sep 8 - first ticket sent. Sep 9 (24h later) - nothing. So we replied to the message as instructed. Sep 12 - still nothing. One more reply sent. Asked some of our customers to report our site as safe. Sep 15 - crickets. Tried calling phone support, impossible to get through; they just hang up on us. Reached out to MS support on Twitter, said they would look into the case. Sep 22 - no changes - MS twitter support has been unable to find the correct person internally. We replied to the SmartScreen ticket once more. Opened two new tickets. Asked more customers to report the site as safe. Sep 30 (Today) - now the warning has started to spread from our login page to our entire dashboard. Still no word from Microsoft.

We are totally baffed that MS allows a false flag to stay up this long, totally ignoring us for almost a full month, meanwhile destroying a business that did nothing wrong...

We suspect one of our competitors is responsible for falsely reported us. Is 'weaponized SmartScreen' a thing?

Does anyone have a similar experience? Any advince on resolving this matter is greatly appreciated!

jcrawfordor 3 years ago |

Very important that you develop complete confidence that there isn't anything wrong with your product. It's not uncommon, in fact it's very common, for compromise kits for websites to take measures to avoid detection. A common one is only serving the malicious content when a specific referrer is present (I've seen this be Yahoo Search in the case of compromised Drupal installations multiple times, not really sure why). It might be wise to engage a security firm to conduct an investigation if you don't have in-house expertise in this area. You should definitely review logs carefully for any unusual inbound traffic. Sometimes looking up your own domain on services like virustotal can reveal the problem, as it might turn up samples of malware retrieved from your website.

I say this because I have been involved in this exact situation multiple times: website flagged by some or other security service, website operator has no idea why and insists it is fine, website turns out to be serving the landing page of a major pharma scam campaign unnoticed by the website operator due to anti-detection measures.

runjake 3 years ago | |

This!

I worked with a very well-known university that unknowingly had been compromised and was being flagged for malware by various protective services.

They, assuming it was just a false positive, put up a banner at the top of their webpages that said they were falsely being flagged and that visitors should ignore any warnings and essentially shut off any protections for their website.

Meanwhile their site was compromised and attempting to dump payloads onto visitors.

Have you ensured you are not compromised?

lucb1e 3 years ago | |

Should they then not just reply with "You're on the list because of the malware payload at <URL>"?

burnished 3 years ago | | |

Just a guess, but I think they don't want to serve as an oracle for the people whose malware they are trying to block.

Not saying that isn't shit or frustrating.

300bps 3 years ago | | |

In this case, that sure would be helpful. Now imagine that you're running a website that is intentionally trying to trick people into installing malware. You've successfully evaded tools like Smart Screen but now you've ended up on the list.

You're not sure which one of your virus payloads set off their screen so you open a ticket. And Microsoft is supposed to tell you exactly how to get off their list again?

_8j50 3 years ago | | |

How does MS know they aren't hosting it on purpose? That might cause them to just change the malicious URL.

abpavel 3 years ago | | |

No, because they would cause the following scenario: Malicious attacker looks for exactly what Microsoft detected, and fixes each specific detection while keep operating the undetected ones. The end result would be operational malicious site, without being detected.

algoritmi 3 years ago | | |

I believe they will if you use their vulnerability management offering it should come up with such details.

We can not expect companies to give free security advice. Secondly, providing such info without consent might result in legal actions from not so smart companies.

jcrawfordor 3 years ago | | |

should? probably. But I also get, from a capitalist perspective, why they don't: they probably get enough "we swear our website is actually fine" tickets each day that they would need a sizable dedicated team to offer that kind of assistance. I don't think any of the browser vendors, Google and Mozilla included, will go to any real effort to help the reporter. At least I haven't seen them do so. I think they take the view, and I don't totally blame them, that securing your website is your problem, and they aren't going to offer security consulting for free.

codegeek 3 years ago | |

In this case, Microsoft "SmartScreen" is a big culprit. Just google "microsoft smartscreen false positive". Tons of support forums on this including even some product companies explaining to their users on how to unblock because of false positives. It happened to some of our customers as well and it is very difficult to explain why we cannot do much except them asking to whitelist somehow or turning off this stupid thing.

natch 3 years ago | | |

Both can be true.

Jnr 3 years ago | |

This is a good suggestion to check your system carefully.

I have seen and investigated cases where malware runs for everyone except in certain locations or even excluding only the site operators.

Look for weird scripts, includes, base64 decode and exec calls in your codebase/site.

celestialcheese 3 years ago | |

Hijacking for tangentially related question:

> It might be wise to engage a security firm to conduct an investigation if you don't have in-house expertise in this area.

Any good security firms you recommend for a small to midsize website?

m3047 3 years ago | | |

Do you practice know your customer (are you required to)? Is this shared hosting? Who runs the site? Who is responsible for security? What are your assets? Any other way(s) for them to be compromised? Where are your backups; did someone get ahold of those?

What about all of the garbage that people pull in from the webs (and into their customer's browsers)? Do you know why fonts.google.com is controversial? Is some ad network participating in a watering hole attack? Got a chatbot on your payment page?

Once you have a handle on that, you can start looking for answers. If that's too much to ask, then the time to start paring down your attack surface is before there are questions.

Use hosting that provides such guarantees. Use an MxP. Don't keep customer information you don't need. What you quote is facile.

dboreham 3 years ago |

I've noticed that the people running automated flagging systems seem to become inordinately smug to the point that they believe their false positive result over all forms of external evidence. So to them you are a criminal and that's that.

pmarreck 3 years ago | |

I am currently in a 3 day Facebook ban because I posted an NIH (National Institute of Health, peak legitimacy right here) link which was meant to help someone understand something.

Unfortunately, the medical procedure it covered thumbnailed down (in the generated preview) to a fairly graphic photo of a woman's private parts being operated on... and that resulted in an uncontestable instaban. No humans can be reached about it, of course.

I hate automated flagging. Not only can I now not help that person on the platform in question, but I am now discouraged from even using that product further (probably not a bad thing in FB's case!)

barneygale 3 years ago | | |

Facebook + Google hold similar levels of power as governments over our lives, and so should adopt similar structures. An independent judiciary, review bodies, ombudsmen, aldermen, etc.

tacon 3 years ago | | |

After the post, there is a button to remove the preview. Is that available before posting? Or would immediately removing the preview avoid the ban? Just wondering...

counttheforks 3 years ago | |

The government desperately needs to step in and regulate these automated "destroy your business" practices.

gkoberger 3 years ago | | |

Totally. It should be illegal for Edge, Chrome and other browsers to take any measures, such as a little warning, in an attempt protect users from malware. I see no way that getting the government involved in this could go badly.

floren 3 years ago | |

See: spam blacklists

dboreham 3 years ago | | |

My own experience was with Wells Fargo, where I conduct quite a bit of business, but they still treated me like a criminal because their dumb AI thought that "I don't often initiate wire transfers online" and "my voice didn't sound like my age".

freedomben 3 years ago |

As has already been said, there's a chance that you are compromised and don't know. Obviously keep trying to contact MS, but in the mean time I'd make as much sure as you can that they don't have a legitimate beef.

If you're willing to share more details about your site such as your tech stack, we can probably give you more specific advice beyond "check your logs for weirdness and hire a consultancy firm that deals with breach detection," though that is good advice.

For what it's worth I went through something similar to this not too long ago, so I know how maddening it is. My client never found any breach (though I did find some PHP library CVE's that could have conceivably been chained together to wreak some havoc), but I ended up rebuilding their prod environment clean and the flag went away on it's own after a couple days, probably because whatever malware was in there had disappeared.

tootie 3 years ago | |

I can absolutely confirm that Edge is blocking sites based on spurious signals. One of mine is still getting a similar warning. We were given an explicit reason, namely that a form action was pointing to a different URL that looked suspicious. The URL was an API service that we also operate. I followed up with their support who said they couldn't remove the warning unless I sent a link to a page on that URL they could look at. I replied that it's an API server and does not have any pages which got no reply. Besides the fact that that's a terrible test of authenticity. We could easily apply a DNS TXT record or something but it wasn't offered as an option. MS are definitely in the wrong in my case and the only solution is to change our implementation and cross our fingers.

NohatCoder 3 years ago | |

If MS have found a compromise they should share it. Making the allegation but not disclosing any reason is just slander.

jefftk 3 years ago | | |

That's not actually slander/libel. Truth is an absolute defence, and that does not require you to disclose details up front. You'd only need to demonstrate truth to defend yourself if sued.

In this case I also expect it's all very carefully worded ("Be careful! This site might be trying to harm your computer") to be legal even in cases when they accidentally (and inevitably) miscategorize a site.

freedomben 3 years ago | | |

Yeah maybe, but the reality is they won't. You can shake fists at MS all day long but it won't get your business up and running. Fixing the breach (if it's not a false positive of course) will. It's not right or fair, but it is reality, and you can only control your own actions.

missedthecue 3 years ago |

When this happened to my software product I fixed it by purchasing a Comodo EV code signing certificate. It cost me $502, it was FedExed to me in a USB, and I signed my program. Tens of thousands of installs later, I have never had an issue with smart screen. Note that there are two types of code signing certs, you want the EV Code Signing Certificate. It will instantly give your program reputation that ends the smartscreen filter issue.

Is it a corrupt system? Pay to play? Sure. But this is a guaranteed way to solve the problem. And way cheaper and 1000x faster and less of a headache than contacting an attorney (which a surprising number of people here are recommending!)

lixtra 3 years ago | |

> It cost me $502, it was FedExed to me in a USB, and I signed my program.

I’m surprised that it apparently had to be delivered physically. Did Comodo generate the private key for you?

meltedcapacitor 3 years ago | | |

The point is the private key is on the USB gadget and stays there. It's not a dumb USB drive.

chabad360 3 years ago | | |

IIRC you are able to get the cert signed to an existing HSM USB (depends on the provider tho).

WesolyKubeczek 3 years ago | |

Looks like protection racket.

Eleison23 3 years ago | | |

Well, when you're driving and you get pulled over, you show your driver's license to the police and they don't arrest you for driving without a license.

It seems like asking to run code on other people's machines is a privilege, too. Unfortunately the World Wide Web has trained consumers to grant that privilege willy-nilly to every web page they visit. I am thankful that code signing and validation is ending the party in that way.

gw99 3 years ago |

I had problems with Windows Defender finding a false positive in the output of a product I was working on. This was an EV code signed MSI package with signed exe. This eventually inflamed SmartScreen and despite getting the thing sorted as a false positive by the AV guys it took 3 months for it to stop being flagged.

After working on Microsoft dev for ~20 years, 2019 was the last thing I touched. I handed everything else over and moved on. I will NEVER deal with that company again. Nothing but fucking shit for that entire time. The grass /is/ greener on the other side.

phrz 3 years ago |

Have you considered that your service, unbeknownst to you, may have been compromised at some point in time, and the source of some phishing page or other malicious material?

Besides that possibility, if your business is truly being "destroyed," have you contemplated retaining counsel to escalate things with Microsoft?

marcosdumay 3 years ago | |

Does it hurt Microsoft in any way to answer those tickets with "no, your site is participating in a phishing campaign"? And maybe tell the OP how, so that he can clean the malicious material?

And yes, that is a major defamation campaign led by Microsoft against the OP. And since MS even refuses to clarify their claim about the OP's wrongdoing, I imagine he would have an easy time in a court.

Quarrelsome 3 years ago | | |

> Does it hurt Microsoft in any way to answer those tickets with "no, your site is participating in a phishing campaign"? And maybe tell the OP how, so that he can clean the malicious material?

Ye, it tells bad actors how the detection system works.

m3047 3 years ago | |

This. Also: magecart for TTPs.

OTOH it might not be. LinkedIn flagged a domain I own as malware and pointed fingers at Spamhaus. Spamhaus had it flagged, but removed the flag when I objected. Their management claimed sites which they flag did something to deserve it on LinkedIn, but never said what. (There is no malware. It's just cranky, especially to bots.) I doubt that Spamhaus' intent was that someone should publicly mark it as malware for other parties though.

ryandrake 3 years ago | |

Yea, the first thing I would do is rigorously determine whether the problem is actually a false positive (note: not a "false flag" which is something entirely different). Seems a bit early to jump straight to "it must be a competitor."

jbk 3 years ago |

And yet, when we submit crapware clones of VLC repackaged, while giving extensive details about the spyware, adware and services installed, MS refuses to block them…

I love Smartscreen…

lixtra 3 years ago |

Get a lawyer. Ask for an injunction by a court. Make smartscreen liable for the damage they do to you.

neilv 3 years ago | |

Yes, poster needs to talk with a lawyer. Ideally, a company would do this on Day One of the situation.

And keep all the data you can (from Web, marketing, ads, etc.), to try to figure out and show how much this is costing you. "And here's where the hockey stick snapped in half."

Animats 3 years ago | | |

Of course. As an outside party, you're not bound by Microsoft's EULA. You can go after them for defamation, tortuous interference with contract, etc. You're in a much better legal position than a customer.

This is when you have a lawyer send a letter. That's cheap. That gets your lawyer talking to Microsoft's lawyers. Most commercial disputes are, in practice, resolved that way.

progre 3 years ago | |

You sound like a lawyer.

nvr219 3 years ago |

People talking about is it a false flag, real flag... Post your SaaS URL and you'll get a free security assessment from a dozen hners.

freedomben 3 years ago | |

That's undoubtedly true, but you'll also get a lot of assholes and script kiddies hoping to pwn your site for lulz, and they often don't care who gets hurt along the way. By posting you've just given them an easy legal defense. If it were me, I wouldn't do it. Not worth the risk.

I would however, probably be willing to DM people individually after doing a small amount of due diligence on their comment history. I guess it depends on sensitivity of the site and how desperate they are.

stickfigure 3 years ago | | |

That is such a weird take. You get assholes and script kiddies the moment your IP interface starts accepting packets. If you don't advertise to people who can help you (be it customers or potential advocates/partners) then what on earth are you doing?

I put my company's website in my HN profile. Go ahead, make my day.

(I'm not the OP and as far as I know don't have any security issues)

nvr219 3 years ago | | |

> you'll also get a lot of assholes and script kiddies hoping to pwn your site for lulz, and they often don't care who gets hurt along the way.

Yes... "Free security assessment" was a euphemism I'm afraid.

nickhalfasleep 3 years ago |

I encountered this, I had a cloud service that I had spun up services on with some DNS records pointing to, and then abandoned. The IP address was then used by malware, but because my DNS pointed to it, my whole domain got blacklisted.

jefftk 3 years ago | |

This is risky for things other than malware blacklisting. For example, the attacker can get a certificate for your domain, and then they can access any HTTPONLY and/or SECURE cookies set at the registrable domain level and impersonate your users just by getting someone to visit their page.

djbusby 3 years ago | |

This is a good point, to properly "offline" your old hostnames and IPs. I've seen many of these cases where stale DNS started pointing to $BAD_THING

genewitch 3 years ago | |

how exactly does this work? I had to request that one of my server's IP address reverse mapped to the domain name. In that circumstance i could see "abandoning" that ip, and maybe it gets reused by someone i can't send a nasty letter to, but other than that, how would some subdomain on my domain pointing to an AWS IP i haven't used in a decade remotely trace back to me or my domain?

Maybe i am too tired and am missing some feature in whois or something.

twistslider 3 years ago |

I've seen someone with a similar experience to you (and also a SaaS) a few days ago: https://twitter.com/xhfloz/status/1574404009288425472

Not sure if they solved it, but might be helpful asking them.

captain_dfx 3 years ago | |

Thanks, I'll contact them!

_8j50 3 years ago |

Do you allow user generated content at all that is internet accessible? Have you looked up your domain and IPS in virustotal and other similar services? Can users host any type of file that can be accessed without authentication?

Yes/no/yes to the above questions means that is where you should look.

captain_dfx 3 years ago | |

We’re a web analytics product. We don’t show any user generated content. All pages (except login/signup/etc..) are behind an authwall.

_8j50 3 years ago | | |

I recommend two things as a minimum then:

1) Check your DNS registrar and make sure there are no new subdomains. dnsdumpster can also help a bit.

2) Check for any new files in the directory tree of public facing sites.

If you're sure all is good you just have to keep escalating with microsoft and creating new requests to remove your domain multiple times a day from different IPs and emails so you can land in the right queue eventually. Squeaky wheel and all (don't forget social media noise).

gkoberger 3 years ago |

I know you probably don't want to dox yourself, but this post has a good amount of traction. It wouldn't hurt to include either contact information or the site in question, just in case someone who can do something sees this!

yashg 3 years ago |

Oh yes! I have a desktop software and MS defender sometimes flags it as unsafe. Mostly happens after I release a new version. It scares away new users, even existing users get spooked. Have to file a report and have to send customers scan report from other scanners and convince them it's a false flag. Feel really hopeless in such a situation.

Guid_NewGuid 3 years ago |

Same thing happened to us, after a week or so we just had to change subdomain of our login site. No answer was ever forthcoming on the previous domain and the new one remains unflagged months later.

rjc 3 years ago |

I'm so sick and tired of businesses abusing my trust and/or not publishing their security breaches that I'm using plus ('+') email addresses everywhere, i.e.:

my_account+site_address@example.org

for regular interactions, or:

my_account+site_address-current_date@example.org

for one-off interactions.

Won't help with historical abuses/data breaches but it'll certainly be invaluable in the future.

ok123456 3 years ago | |

About 10% of sites don't allow you to use a plus sign in your email address.

aetherspawn 3 years ago | |

I started doing the same years ago and nothing came out of it. Most spam I got subscribed to, seemed to get my details some other way (or sanitised my email).

cdaringe 3 years ago | | |

Same. I still do, but 90% of the spam that actually lands is due to a biz I legitimately gave info to illegitimately sharing it with others

bombcar 3 years ago |

Do you have a link to the domain? Perhaps it can be determined why it is triggering.

codegeek 3 years ago |

This happens to some of our customers (they have custom domains on our SAAS). It is beyond ridiculous.

jotm 3 years ago |

You need to buy an EV certificate which is why many Devs complain SmartScreen made Windows Pay2Win.

But you can pay for it by implementing malware in your newly whitelisted app :D

rsync 3 years ago |

Where can I go to test what "smartscreen" thinks of a particular URL ?

I am neither a "smartscreen" nor even a Microsoft customer - is it possible for me to see what they think of a particular domain/adress/URL ?

FateOfNations 3 years ago | |

Go to the website in Microsoft Edge and see what happens. If there's a SmartScreen issue, you will be given a warning message.

gypon 3 years ago |

What if it's a true flag? Your website might be compromised and serving malware.

What sort of business is it? If it's something particularly scammy, it might be being screened for that reason.

t0bia_s 3 years ago |

Similar thing happen to me. My OneDrive links that I share with clients end in their email spam folder. It took mi few weeks before I realized that few clients was still waiting for my work, because they did not have it in inbox.

I know that it is problem of email providers, but still I would like to leave OneDrive, but I cannot find alternative that is in similar price range as OneDrive (about 2 USD/month for 1TB).

_hl_ 3 years ago | |

If it's for clients, does it really matter whether you're spending $2 or $5 or $10 a month?

t0bia_s 3 years ago | | |

Yes, I'm one-man-band, not a company.

TheLoafOfBread 3 years ago |

I sorted this out by buying a certificate and digitally signing the binaries. You can get it from GoDaddy, Sectigo, etc.

simooooo 3 years ago |

This happened to me too because a subdomain was the same as a popular product brand name. This was kicked off by chrome/google, then feed through to smart screen. Which took a few days to sort out. Had to claim the domain on google search tools and find the reason

shishy 3 years ago |

Do you have any scripts loading that might be malicious / triggering a flag? What's the website?

mkl95 3 years ago |

The answer is in your logs. If there are no logs, Microsoft know your site better than you do.

midislack 3 years ago |

Are you in the same competitive space as MS? If so you shouldn’t act surprised.

crumpled 3 years ago |

I'm having the same issue, but it's Xfinity blocking my site from their business customers. The official contact form seems to be a sinkhole. It's beyond frustrating. I feel maligned and defamed.

ROTMetro 3 years ago |

Would it be possible to hire a lawyer to send them a letter notifying them you intend to sue for defamation of character?

timnetworks 3 years ago |

Microsoft SmartScreen is a broken product staffed by presumably broken people.

[edit] buy a cert like the smart people are saying

fxtentacle 3 years ago |

Weaponized flagging is totally a thing on Amazon, so I wouldn't be surprised if with SmartScreen, too.

Benanov 3 years ago |

Is your login page vulnerable to an Open Redirect?

Run your page against OWASP top 10. You might find something

wahnfrieden 3 years ago |

Good luck getting them to care

swayvil 3 years ago |

Look at most of the replies here. "Nuh uh, it's you. You have failed to check the obvious..."

It inspires paranoia I tell you.