3 ms·

If you were hit with this attack, would you see a pdf attempt to load in the browser? Was it a hidden iframe? Were any popular tube sites affected (PH-network,

If you were hit with this attack, would you see a pdf attempt to load in the browser? Was it a hidden iframe? Were any popular tube sites affected (PH-network, etc)?

EwanToo 11y ago
It was completely invisible to the end-user from what I understand
- neuromute 11y ago
  So, is there a comprehensive list of affected sites anywhere? I've seen a short list of sites serving the malware, but I see no mention of whether this was distributed via any large-scale tube sites.
  - EwanToo 11y ago
    It was served through ad networks, the only version in the wild I've heard of was targetting a russian network
    - neuromute 11y ago
      Yeah, I just wondered if any of these ad networks would be serving through any of the large-scale adult sites like pornhub, tube8, etc.
    - fukusa 11y ago
      It was disguised as an ad, not served through ad networks. In other cases it was disguised as a file from a CDN.
  - fukusa 11y ago
    The list of affected sites is in the article, the only site that's not mentioned is: http://www.themoscowtimes.com/ http://www.themoscowtimes.com/
- userbinator 11y ago
  If it was attempting to search the whole filesystem for interesting files to upload, I think that might be somewhat noticeable - at least for those who don't have an SSD, or have a HDD activity light in plain view. If some process on my system suddenly decides to scan the filesystem, I'd definitely notice the HDD seeking.
fukusa 11y ago
Now that this has been disclosed, one of the affected websites that has not been listed is: http://www.themoscowtimes.com/ http://www.themoscowtimes.com/. I was a victim of the exploit myself, so if you have visited that website before August 8, you might have been as well. The attempt to load a PDF was visible in the browser in 2 ways. 1.) Displaying a message that the PDF may not be displayed correctly, which looked like this: https://support.cdn.mozilla.net/media/uploads/images/2013-03-01-15-26-09-2f3711.png https://support.cdn.mozilla.net/media/uploads/images/2013-03... except for the PDF of course, because it was loaded in a hidden iframe. 2.) In my case the exploit tried to open one of my public keys (with the .pub file extension) but because the browser determined this was an executable file (because of the mime-type) that should not be displayed by the browser it triggered a file dialog asking me to open the file with some other program. This is what alarmed me and that way I discovered this 0-day. I must say however that other versions of the exploit have surfaced that do no longer target the public key file (maybe for this reason?) so the file theft may not be noticed.

If you were hit with this attack, would you see a pdf attempt to load in the browser? Was it a hidden iframe? Were any popular tube sites affected (PH-network, etc)?

EwanToo 11y ago

It was completely invisible to the end-user from what I understand

neuromute 11y ago
So, is there a comprehensive list of affected sites anywhere? I've seen a short list of sites serving the malware, but I see no mention of whether this was distributed via any large-scale tube sites.
- EwanToo 11y ago
  It was served through ad networks, the only version in the wild I've heard of was targetting a russian network
  - neuromute 11y ago
    Yeah, I just wondered if any of these ad networks would be serving through any of the large-scale adult sites like pornhub, tube8, etc.
  - fukusa 11y ago
    It was disguised as an ad, not served through ad networks. In other cases it was disguised as a file from a CDN.
- fukusa 11y ago
  The list of affected sites is in the article, the only site that's not mentioned is: http://www.themoscowtimes.com/ http://www.themoscowtimes.com/
userbinator 11y ago
If it was attempting to search the whole filesystem for interesting files to upload, I think that might be somewhat noticeable - at least for those who don't have an SSD, or have a HDD activity light in plain view. If some process on my system suddenly decides to scan the filesystem, I'd definitely notice the HDD seeking.

fukusa 11y ago

Now that this has been disclosed, one of the affected websites that has not been listed is: http://www.themoscowtimes.com/ http://www.themoscowtimes.com/. I was a victim of the exploit myself, so if you have visited that website before August 8, you might have been as well. The attempt to load a PDF was visible in the browser in 2 ways. 1.) Displaying a message that the PDF may not be displayed correctly, which looked like this: https://support.cdn.mozilla.net/media/uploads/images/2013-03-01-15-26-09-2f3711.png https://support.cdn.mozilla.net/media/uploads/images/2013-03... except for the PDF of course, because it was loaded in a hidden iframe. 2.) In my case the exploit tried to open one of my public keys (with the .pub file extension) but because the browser determined this was an executable file (because of the mime-type) that should not be displayed by the browser it triggered a file dialog asking me to open the file with some other program. This is what alarmed me and that way I discovered this 0-day. I must say however that other versions of the exploit have surfaced that do no longer target the public key file (maybe for this reason?) so the file theft may not be noticed.