Sucuri Blog

The vast majority of websites that are inadvertently serving malware have been compromised through the website itself, which can happen totally independently of the web server software or the host.

About the best the host can do is have a reasonable IP blacklist, but even that doesn't stop nearly enough attackers. (My little mail server, hosting only around a dozen accounts, is currently averaging 14 new SSH bans per day for example.)

The only thing that a "secure" host guarantees is that a compromised website can not lead to a compromised server; attempting to measure that by checking the number of malware-hosting websites at a service provider is the wrong way to go about it.

All that said, if you want a "secure" host without spending a lot of money, your best compromise would be an OpenBSD VPS, and then either spend a lot of time learning how to set it up correctly (and maintain it), or have someone do it for you.

Having NetSol and GoDaddy on a list of potentially "secure" hosts is hilarious.

edit: I'd recommend checking the Sucuri Blog (http://blog.sucuri.net/) for an idea of who's been compromised and how they've responded. Sucuri's pretty good at keeping track of all this stuff.

REMOTE - Sucuri (sucuri.net): Junior (Security) Support analyst:

Description: As a Junior Support Analyst you will be required to troubleshoot web site security issues (learn to fix them), analyse and decode malware, patiently engage with clients, and learn a lot about security :)

We employ manual and automated techniques to analyze, decode, and fix web-based malware. The right candidate will have the opportunity to learn and apply these techniques in their day-to-day duties. If you like the challenge of fixing broken websites and reversing the effects of malware, then you’ll love this job.

Email: dd@sucuri.net
Link: http://blog.sucuri.net/2012/02/sucuri-hiring-junior-support-analyst.html

It's not unknown though, there's been PHP malware that executes an images exif data previously.

$exif = exif_read_data('/homepages/clientsitepath/images/stories/food/bun.jpg');
preg_replace($exif['Make'],$exif['Model'],'');

This particular one operates in a similar way but with significantly more stealth, even if you were looking right at it you wouldn't immediately suspect that it's a backdoor executing code. Looks a bit odd, but if it was shoved in a thumbnailing function or something similar you might never notice, doubly so if the code it's executing is a client supplied image.

http://blog.sucuri.net/2013/07/malware-hidden-inside-jpg-exif-headers.html

This has been done in the past. I remember seeing an advisory as far back as 2010, but at the moment can only find these two more recent advisories:

https://websec.io/2012/09/05/A-Silent-Threat-PHP-in-EXIF.html

https://blog.sucuri.net/2013/07/malware-hidden-inside-jpg-exif-headers.html

The way we protected ourselves against it at <earlier company> (since we allowed image uploads at a variety of locations) was to decode and recode the image before storing and strip out comments.

Also important to note that WordPress guru Otto commented the following on the Sucuri post about the vulnerability[1]:

"The plugin has been updated to 0.9.8.9, which is a copy of 0.9.8.6 (the last good version). This will remove the malicious code from the plugin, but not any code that was added to sites in the meantime. Please follow through with the Mitigation steps given by Denis in the post."

[1] https://blog.sucuri.net/2016/03/when-wordpress-plugin-goes-bad.html