Dangerous
Act this week
A flaw attackers are using right now, a serious flaw anyone could use without logging in, or a domain about to lapse.
Plate III. Notes on method
How theMendbird hunts.
Five steps, about ten seconds, and nothing on your site is touched. Tap any picture to watch it again.
Step I.
It visits your site like any browser
Mendbird opens your home page the way a visitor's browser would. It never logs in and never fills in a form, so your site cannot tell it apart from a curious customer.
Step II.
It works out what the site is built with
Every site leaves clues: file names, version numbers, the way its pages are put together. Mendbird reads them and labels each part it recognises, from the system the site runs on to every plugin and the server underneath.
Step III.
It checks every part against the lists of known flaws
Each label is looked up in the public lists of security flaws, updated every day: the flaws found in each version, the ones attackers are using right now, and the date each version stops getting fixes.
Step IV.
It sorts every bug it finds
Each bug goes in one of four jars, by how much harm it could do and how soon it needs fixing. The worse the bug, the bigger and pinker it is drawn.
Step V.
You get field notes in plain English
What was found, how serious it is, and the exact question to ask your developer. No scores to decode, nothing to install and nothing to sign up for.
The four jars.
Major
Fix soon
No padlock, software that no longer gets security fixes, or Google told to stay away.
Minor
Next time the site is worked on
Worth fixing but not urgent: a slow page, a missing email record, pictures without descriptions.
Advisory
Good practice
Small settings that make a site a little safer or easier to use.
How sure we are
Many sites hide their software versions, and some hosts fix flaws without changing the version number. Every software finding says how we know the version, and where we cannot be sure we say ask your developer to confirm, rather than guess.
What we never do
We never log in, never try to break in, and never change anything. We only read what any visitor's browser could read. A report says a flaw exists, not how to use it.