April 2019 Web Server Survey

In the April 2019 survey we received responses from 1,445,266,139 sites across 233,886,577 unique domain names and 8,613,630 web-facing computers. This reflects a loss of 16.8 million sites, but a gain of 1.72 million domains and 87,000 computers.

Most websites now use nginx!

Despite the overall loss of sites this month, nginx gained 22.3 million websites and 2.03 million additional active sites. nginx also gained the largest number of web-facing computers, increasing its total by 63,000 to 2.57 million (+2.52%). nginx's market share of web-facing computers is now nearly 30%, and this is continuing to grow steadily closer to Apache's leading share of 37.3%.

Microsoft and Apache lost shares in every headline metric this month, with both vendors contributing significantly to this month's overall loss of sites. Microsoft lost 18.9 million sites, while Apache lost 17.2 million, causing their shares to decrease by 1.01 and 0.87 percentage points.

These changes have pushed nginx into the lead, giving it a 27.5% share of all sites in Netcraft's April 2019 Web Server Survey. Significantly, this is the first time since 1996 that a vendor other than Microsoft or Apache has served the largest number of websites.

The reign of "a patchy" web server

If we cast our minds back to early 1996 (not long before the arrest of the Unabomber and the release of the Spice Girls' first cassette tape single), the most commonly used web server software was still NCSA HTTPd. This long-since discontinued web server was originally developed three years earlier by Rob McCool at the National Center for Supercomputing Applications; but when he left the NCSA in mid-1994, development stalled, prompting many webmasters to develop their own extensions and bug fixes.

A small group of these developers coordinated their changes in the form of patches, eventually leading to the foundation of the independent Apache Group. By April 1995, the group had made its first official public release of the Apache web server (version 0.6.2), which was based on NCSA HTTPd 1.3.

Although the NCSA resumed development of its own web server around the same time, Apache quickly took hold of the market. Exactly a year after Apache's first public release, Netcraft's April 1996 Web Server Survey showed that Apache had succeeded in overtaking NCSA's lead, marking the start of a remarkable uninterrupted 18-year reign.

The non-profit Apache Software Foundation, was later formed in 1999, and today is home to hundreds of other projects in addition to the Apache HTTP Server. Microsoft briefly took the lead from Apache in 2014, and retook the lead from 2016 until being beaten by nginx this month.

However, for now, Apache remains on top of every other headline metric: It leads with a 30.3% share of active sites, 37.3% of all web-facing computers, 31.5% of all domains, and it serves 32.2% of the top million websites. Nonetheless, nginx's strong and consistent growth makes it look set to challenge Apache's lead within a year or two. Most noticeably, it is rapidly catching up with Apache's declining share of web-facing computers, and may also soon threaten Apache's share of the top million websites.

New web server releases

There have been several new releases over the past month:

  • Apache 2.4.39 was released on 1 April. As usual, this latest release in the 2.4.x stable branch is regarded by the Apache Software Foundation to be the best available version; but more importantly, it resolves several security issues including an access control bypass and privilege escalation vulnerability.
  • nginx 1.15.10 mainline was released on 26 March, adding some new directives and certificate features. This was followed by two bugfix releases: nginx 1.15.11 on 9 April, and nginx 1.15.12 on 16 April.
  • njs 0.3.1 (the JavaScript-like scripting language that allows nginx functionality to be extended) was released on 16 April, adding several new features, including support for arrow functions.
  • OpenLiteSpeed 1.4.46 was released on 5 April, adding support for PHP7 and app servers that use nodeJS, Python and Ruby.
  • Taobao's Tengine 2.3.0 was released on 25 March. This development version of the open source nginx fork inherits all features from nginx 1.15.9 and includes several new features, changes and bugfixes.

Tengine Aserver

Visible uptake of the latest Tengine 2.3.0 development version is likely to be slow. The most commonly used numbered version is still 2.2.0, despite there being four newer development versions since its release more than three years ago; and development version 1.4.2, which was released in 2012, is not far behind.

Tengine 2.2.0 is currently used by 13.9% of all Tengine-powered websites, but the majority – 42.4% – do not reveal a version number at all, and a further 29.8% respond with the Tengine/Aserver server header. Nearly all of the websites that use Tengine Aserver are online stores hosted on subdomains of taobao.com and the domain of its parent company, alibaba.com, suggesting that it is a custom version designed specifically for these applications.

Development versions of Tengine appear to be far more popular than stable releases. The most recent stable version, Tengine 2.1.2, was released in December 2015 and is used by only 0.26% of all Tengine-powered websites.

Total number of websites

Web server market share

DeveloperMarch 2019PercentApril 2019PercentChange
nginx375,431,60625.68%397,728,88927.52%1.84
Apache403,603,74527.61%386,380,89326.73%-0.87
Microsoft381,017,77626.06%362,109,19625.05%-1.01
Google24,809,6821.70%25,956,0801.80%0.10
Continue reading

Well known UK bank vulnerable to impersonation for five years

Netcraft has found that Halifax has been left vulnerable to convincing impersonation attacks for five years. The operator of a website promoting Spanish hotels is able to send and receive emails on the official Halifax online banking domain, and get legitimate security certificates issued for the same domain.

Halifax Online

Halifax operates its online banking service on a separate domain (halifax-online.co.uk) to its main website (halifax.co.uk).

The entry point to Halifax's banking service is via www.halifax-online.co.uk. Visitors to the site without the www. prefix are presented with a browser error.

halifax-online.co.uk

halifax-online.co.uk

The mail server configuration of halifax-online.co.uk domain is configured in such a way that makes it open to attack.

MX records

A Mail Exchanger (MX) record publishes the location where email should be sent to for addresses on that domain. For example, Netcraft’s own MX records point to mail.netcraft.com. Any system wanting to send email to info@netcraft.com would look up the MX record for netcraft.com, and see they need to forward the email to mail.netcraft.com.

It is common for many domain name owners to delegate its mail processing to a third-party service; Microsoft and Google are notable providers. In the case of halifax-online.co.uk, the MX records point to mail.btwebworld.com.

BT WebWorld

BT WebWorld was a B2B web host and email service offered by BT. BT WebWorld launched in October 1996 and was discontinued in 2013/2014. During its heyday, BT WebWorld was a popular hosting provider used by many British SMEs and large organisations.

The domain name, btwebworld.com, continued to belong to BT until 2015, at which time the domain registration lapsed. It was then registered by an unaffiliated party on 22nd November 2015, and presently redirects to a hotel-themed website. Some of the original BT WebWorld website content has been copied on to this website. This is likely an attempt by the operator of the website to appear more genuine to search providers, in the hopes of increasing visibility in search results.

Metadata for the IP Address used by btwebworld.com indicates the server is located in Dominica. However, tracing the IP Address shows the server is probably located on the east coast of America. The stated location of the IP Address may have been chosen in an attempt to place the website outside the jurisdiction of certain law enforcement agencies.

Screenshot of btwebworld.com

Screenshot of btwebworld.com

Why is this a concern?

Any Halifax customer aware of the halifax-online.co.uk website would unlikely be concerned if they received an email appearing to be from halifax-online.co.uk, and could be tricked into sending sensitive information to email accounts on the same domain.

Inconsistent configuration of Halifax’s SPF record increases the chance that fraudulent emails purporting to be from halifax-online.co.uk do not get sent to the ‘spam’ folder, and Halifax would not be alerted to spoofed emails.

Being able to receive email at @halifax-online.co.uk addresses also allows the domain owner to request TLS certificates for the official Halifax online banking domain. This would allow a fraudster to create convincing impersonations of the Halifax website.

SPF

Sender Policy Framework (SPF) is a mechanism that allows a domain name owner to assert control over which servers are permitted to send email from that domain.

An SPF record includes a list of IP Addresses that are allowed to send email for the domain, and an instruction informing email servers how to process email they receive which does not originate from one of the allowed IP Addresses. When a mail server receives an email, the mail server may perform a lookup of the SPF record for the associated domain to determine whether the email is genuine.

A misconfigured SPF record can be advantageous to fraudsters. Email that is permitted by an SPF record is more likely to land in the user’s inbox. Email not permitted is more likely to land in the ‘spam’ folder, or not even get delivered.

The SPF record for halifax-online.co.uk instructs mail servers to only allow email from IP Addresses in its MX record, which in this case is btwebworld.com.

The owner of btwebworld.com — or any sites that share the same email server — would be able to successfully send email from @halifax-online.co.uk addresses, even to email servers which perform checks on SPF records.

TLS Certificates

In order to obtain a certificate issued for a website and appear ‘secure’ the owner of that website needs to prove to a Certificate Authority that they have control over the website. One common method is to prove that you can receive emails sent to a special email address on the domain.

Certificate Transparency (CT) is an initiative where Certificate Authorities publish certificates they issue. This allows unauthorised certificates to be identified. The authorised party could then request the certificate be revoked — although most browsers do not check if certificates have been revoked. It could also request the unauthorised website be taken offline. Providing evidence that the certificate has been included in a CT log is only a requirement for the Chrome browser and recent versions of iOS.

This kind of attack could be partially mitigated through the use of Certificate Authority Authorization (CAA) records. These records allow the domain owner to list the set of Certificate Authorities that are permitted to issue certificates for sites on that domain. There is no CAA record on halifax-online.co.uk.

The end result is that it would be possible for the owner of btwebworld.com to request — and be issued with — a valid certificate for the official Halifax online banking website. The owner could request the certificate from a Certificate Authority that does not require certificates they issue to be logged, reducing the chance of discovery, and would, at least for a significant proportion of web users, appear in the web browser as ‘secure’.

Combined with another attack, such as man-in-the-middle, it would be trivial for a fraudster to create a highly convincing impersonation designed to capture banking credentials of Halifax customers.

Who else is affected?

Netcraft found 131 other domains that still point its MX records at btwebworld.com, including three other Halifax domains, the primary domain of BT’s own BT Wholesale division, 13 domains owned by investment bank Rothschild & Co, a domain for UK insurance company esure, a sub-domain of the NHS, and a domain belonging to soft-drinks company Robinsons.

Netcraft has also found that www.e-commerce.bt.com and www.btbroadband.com both resolve to the same IP Address as btwebworld.com. The owner of this IP Address would be able to set up a phishing attack against BT under an official BT domain.

Remediations

Halifax can make simple changes to their DNS in order to protect itself and its customers from impersonation attacks:

  • redirect halifax-online.co.uk to www.halifax-online.co.uk to prevent visitors attempting to try alternative combinations that might lead them to fraud;
  • update or remove MX records to prevent email being delivered to a non-affiliated website;
  • update the SPF policy to reject emails sent from halifax-online.co.uk addresses if it not used for that purpose by Halifax;
  • add CAA records to ensure only Halifax’s chosen Certificate Authorities are permitted to issue certificates for its domains.

Netcraft has found 171 phishing attacks impersonating Halifax over the past 12 months.

Netcraft offers a range of services to protect organisations against cybercrime, including monitoring of DNS for look-a-like domains, SPF record auditing, and processing DMARC email reports.

Most Reliable Hosting Company Sites in March 2019

Rank Performance Graph OS Outage
hh:mm:ss
Failed
Req%
DNS Connect First
byte
Total
1 Rackspace Linux 0:00:00 0.000 0.676 0.008 0.020 0.020
2 New York Internet (NYI) FreeBSD 0:00:00 0.000 0.559 0.060 0.120 0.121
3 One.com Linux 0:00:00 0.000 0.394 0.085 0.256 0.256
4 www.dinahosting.com Linux 0:00:00 0.000 0.302 0.091 0.181 0.181
5 Pair Networks FreeBSD 0:00:00 0.000 0.350 0.092 0.186 0.186
6 CWCS Managed Hosting Linux 0:00:00 0.004 0.304 0.076 0.154 0.154
7 GoDaddy.com Inc Linux 0:00:00 0.008 0.442 0.007 0.024 0.025
8 www.choopa.com Linux 0:00:00 0.008 0.285 0.008 0.027 0.027
9 Bigstep Linux 0:00:00 0.008 0.245 0.072 0.146 0.146
10 Swishmail FreeBSD 0:00:00 0.013 0.255 0.092 0.182 0.184

See full table

Rackspace had the most reliable hosting company site in March 2019. This is the second month in a row, and the third time in the last 12 months, that Rackspace has topped the ranking. Rackspace offers a range of managed dedicated and cloud hosting solutions.

The top five hosting company sites each responded to all of Netcraft's requests in March; to break the tie they are ranked by average connection times. This puts New York Internet in second place. NYI offers bare metal, cloud and colocation services in its US datacentres. One.com took third place, appearing in the top 10 for a second consecutive month. One.com offers a variety of internet services including a no-code website builder, 1-click WordPress installations, domain registrations and email hosting.

Linux is used by seven of the top 10 in March and remains the most popular choice of operating system, with the remaining three sites all powered by FreeBSD.

Netcraft measures and makes available the response times of around twenty leading hosting providers' sites. The performance measurements are made at fifteen minute intervals from separate points around the internet, and averages are calculated over the immediately preceding 24 hour period.

From a customer's point of view, the percentage of failed requests is more pertinent than outages on hosting companies' own sites, as this gives a pointer to reliability of routing, and this is why we choose to rank our table by fewest failed requests, rather than shortest periods of outage. In the event the number of failed requests are equal then sites are ranked by average connection times.

Information on the measurement process and current measurements is available.