Sarah McMillan /cvnznews.com
A newly discovered cyber vulnerability has sparked fears that New Zealand business websites could already be helping criminals operate online without their owners even knowing it.
Cybersecurity experts warn hackers may be able to hijack ordinary Kiwi websites and use them to host illegal content, run scams, launch attacks on other organisations, or support dark web activity, all while the legitimate business remains completely unaware.
Auckland cybersecurity specialist Daniel Watson is warning business owners not to assume their websites are too small or too simple to attract criminal attention.
“Most small businesses have what we call a brochure website,” says Watson, Managing Director of Vertech. “There’s no customer database or sensitive information, so owners assume there’s nothing worth stealing.”
According to Watson, that assumption could prove costly.
“If somebody gains control of that website, they can use it for something entirely different. They could host illicit content, redirect visitors to fraudulent websites or use the server to launch attacks against other organisations.”
The warning follows the discovery of critical vulnerabilities in PHP, a programming language that powers a significant portion of the world’s websites, including many WordPress sites used by Kiwi businesses.
Watson says the danger is not necessarily that hackers want the information on a website. Instead, they want control of the website itself.
“You could effectively become part of a criminal operation without knowing anything about it.”
Once attackers gain access, compromised servers can be used to host fake banking websites, distribute scams, facilitate cyberattacks, or even become part of larger criminal networks known as botnets.
Watson recalls one case where a legitimate hotel website was secretly used to host a fraudulent overseas banking site. The discovery resulted in the hotel’s servers being seized for forensic investigation, taking systems offline and causing significant disruption.
“There can be serious reputational damage, but also operational disruption. Many business owners wouldn’t even know their website had been compromised until somebody else reported it.”
The problem is particularly acute for what Watson describes as “set-and-forget” websites, where owners assume their hosting provider or developer is handling security updates.
“Cybersecurity isn’t something you set up once and forget about,” he says. “New vulnerabilities are discovered all the time.”
Watson urges business owners to contact their hosting provider and ask three simple questions: Is the website regularly patched? What security protection is included? Are reliable backups being made?
“The question every business owner should be asking,” he says, “is whether somebody is actively looking after their website, or whether they’re simply hoping nothing goes wrong.”
