Everybody who uses a computer - and expects to use their computer for any amount of time - has one or more protective products on their computer.
Anybody who publishes a blog, with an audience that has any need for security, is going to receive occasional reports from would be readers.
I can't read your blog! My computer displays an "Unsafe website!" warning!
All computer security products, unfortunately, will occasionally generate false positives. Analysing false positive malware reports is as much a part of every security product, as identifying the actual malware.
If you publish a blog, you need to know how to handle reader malware alert reports.
Know online tools, for researching reported problems.
Google provides 2 websites, for analysis of blog / website malware alerts. Both Google SafeBrowsing, and VirusTotal, are Google products that can help to identify actual problems with blogs and websites.
Besides the two Google products above, I use 3 security analysis websites, which can identify specific security problems in blog / website code. Quttera Online Website Malware Scanner, and Sucuri SiteCheck, and Trend Micro SIte Safety Center, have been useful at various times, when a security problem is reported.
You may, from time to time, use all of these - and possibly others - in identifying and verifying a security problem with your blog, or with blogs and websites that you link. For best results, always specify the canonical blog URL, when requesting security analysis - and when sharing the blog, or individual posts.
Specify the canonical URL.
Not a country local domain.
Know what you need to do, to keep your blog healthy.
As a blog publisher, you will occasionally have 2 jobs to do, when receiving a malware alert report which references your blog.
- Verify / identify / remove any actual malicious content.
- Report false positives, to the protective service displaying a false positive.
Everybody who publishes a blog, with any reader audience, has seen this advice, or something similar, when surfing their blog.
Know how to keep your blog clean - and your reputation clean.
You have to use online malware analysis services, to identify any problem which you may have created, by installing the latest "gotta have this!" accessory on your blog. And, you have to report any false positive alert, to the owners of any security product, that falsely identifies your blog as a problem.
You do both, to support your readers. You do not want your readers computers hacked, through your inappropriately accessorising your blog - but at the same time,you want your readers to be able to read your blog.
- Keep your blog content clean.
- Keep your blog reputation clean.
Do both - or you may not have readers, to read your blog.
Any #Blogger blog owner needs to support the blog readers, by publishing a blog clean of any malware, and with a good reputation with the various security products that prevent malicious action by dangerous blogs and websites. Your readers need the ability to use their computers to read your blog - and they need their security to not falsely identify your blog as a problem.
Third party accessories are a big part of many blogs.
As Blogger proceeds to command a larger and larger share of the free online web site market, they encourage (directly or indirectly) the development of third party templates, and accessories. This lets us make our blogs more personal to our desires, and shinier to our egos.
Layouts Blogger is more mature, and commands an ever growing share of Blogger. And so, the the selection of Layouts compatible templates and accessories, again provided by third parties, will grow.
And as the selection grows, so does the possible risk, from installing what's available on our blogs. As I wrote long ago, what better way to hack somebody's blog (or computer) than by conning the victim into installing the hack, on his own?
As we install third party accessories, we need to remain aware of the risks involved, in using non Blogger components.
- Some accessories may not work as well as Blogger developed and certified products.
- All accessories may not work together, if developed by different third parties.
- Some accessories may not work at all.
- Some accessories, maliciously crafted, may work as designed - but their design may not be to our benefit.
- Some accessories, maliciously crafted, may attack the computers of our readers. What better way to acquire new victims en masse, than to con a third party into distributing malware without realising it?
Consider the last possibility carefully. It's one thing to unintentionally download and install a hack on your own computer - it's another thing to intentionally install the hack onto your blog, and then onto your readers computers.
Properly designed, a blog installed hack has to only contain code linking the blog to a web site where malware is distributed. Not all malware scanners, either installed on the computer or run from a web site, will detect the blog based component that merely redirects the victim to a malicious web site.
However, we are currently seeing reports of some malware scanners which do validate, on a page by page basis, against all links on the page.
Spread malware onto your computer, and you answer only to yourself. Help spread malware onto your readers computers, and you won't even know all of the people to whom you should answer.
In some cases, your readers won't know that you were the one who contributed to their problems - but you'll still be responsible. Your readers may not blame you for their troubles - but your blog will still suffer from less activity, because your readers are busy carrying their computers to the nearest tech shoppe, and paying for malware removal services, instead of reading your posts.
And should you choose to install a third party accessory or template on your blog, make sure that it's properly chosen and installed. And carefully control the install process.
And finally, keep track of what you install, after it's been installed and tested. Some accessories will work fine immediately when installed, and will fail later - giving your readers unwanted content, when they try to read your blog.
