Looking into shared hosting for your website? This is a great option for some people, as it is cheap hosting.
As with any business decision, however, there are some cons to consider. One of them: hackers. The Anti-Phishing Work Group (APWG) says that more and more, cybercriminals are hacking into the shared hosting servers to use the domains hosted there for large-scale phishing scams.
In the APWG's Global Phishing Survey report, they state that 47% of phishing attacks reported all over the world are attacked such as this.
How do they do it? Is there any way to protect yourself? Read on to find out what you need to know.
Shared Hosting: Who Is The APWG?
The APWG consists of over 2,000 organizations covering a variety of industries: financial institutions, security vendors, ISPs, retailers, defense contractors, telecommunication companies, law enforcement agencies, government agencies, trade groups, and more.
Shared Hosting: Phishing
Phishers hack into the shared hosting server and change its configuration in order to display phishing pages from a certain sub-directory of each website that the server hosts. They gather usernames, passwords, and in the worst cases, credit card details by appearing to be a trustworthy site.
How many websites are affected? It depends on the hosting company and how many sites they host on a single server. The APWG says that the number of sites hosted on a single server can vary, from dozens to thousands of websites.
Shared Hosting: Facts And Figures
Phishing is a common practice and reached its peak in August of 2012. At that time, the APWG saw more than 14,000 phishing attacks on 61 servers. According to the report, “levels did decline in late 2012, but still remained troublingly high.”
In the latter half of 2012, the report says that at least 123,486 different phishing attacks occurred worldwide, affecting 89,748 different domains. If you compare that to the first half of 2012, with 93,462 attacks to 64,204 domains, that's quite a jump.
“Of the 89,748 phishing domains, we identified 5,835 domain names that we believe were registered maliciously, by phishers,” said the APWG. “The other 83,913 domains were almost all hacked or compromised on vulnerable web hosting.” So although cheap hosting seems like a good fit for your website, shared hosting might not be the way to go after all.
Vulnerable Shared Hosting: How They Do It
How exactly do they get into the servers in the first place? Well, the hackers take advantage of vulnerabilities in the server admin panels such as c Panel or Plesk, as well as applications such as WordPress and Joomla.
Said the APWG, “These attacks highlight the vulnerability of hosting providers and software, exploit weak password management, and provide plenty of reason to worry.”
Vulnerable Shared Hosting: Not Just Phishing
Hackers aren't always phishing when they break into servers. Another reason hackers gain access to these shared hosting servers: to use their resources for other attacks. A group of hackers has been compromising shared servers since late 2012 to launch distributed denial-of-service (DDoS) attacks against various financial institutions.
In one such instance dubbed Dark-leech, hackers broke into thousands of Apache servers, installing SSH backdoors. It is still unknown how they were able to hack into these servers, but some think that vulnerabilities in c Panel, Webmin, Plesk, or WordPress might be how the hackers did it.
Vulnerable Shared Hosting: Weigh Your Options
To protect yourself and your business from phishing attacks and other nefarious hacking activity, you just need to look closely at your unique situation. If there is any sensitive information involved, you might rethink that shared hosting option. Cheap hosting doesn't have to be shared hosting, though shared hosting does offer savings over traditional hosting.
At the end of the day, if you cringe at the thought of being a victim, maybe shared hosting isn't right for you.
