9 ms·

PageFair: Economist hacked

103 points by aburan28 11y ago

mirimir 11y ago
Damn, they won't even show this page without subscription ;) Edit: Maybe I overreacted. I just tried the direct link again, and it loaded. The first time, loading stalled with a blank popover.
- peteretep 11y ago
  I have a paid Economist subscription but it's less hassle to not login and use a combination of expiring cookies, self-clearing cache, and some specific AdBlock rules to read their content...
  - IndianAstronaut 11y ago
    I've spoken to some devs who used to work for them. They have said the working environment ther for devs is terrible and retention of quality is a big issue. Their site is awful and has been awful for ages. Theh are also usually a good 3 to 5 years behind the times with their magazine technology. Late to deliver apps, poor user experience on the site, terrible mobile pages, etc. I say this as an avid reader (andnow listener) to their magazine for over nearly 15 years.
    - mrweasel 11y ago
      Even their subscription management site is terrible, it's really much more complicated than it needs to be. I love the paper version of The Economist, but I never read their online content. Partly because I can't be bothered to login.
    - zymhan 11y ago
      I love the "timekeeper" feature, only because it looks so retro at this point that I hope it never goes away.
cperciva 11y ago
I'm going to copy-and-paste the important bit in case nonsubscribers need to read it. I wouldn't normally do this, but I figure it's an important announcement rather than a creative work: On Oct. 31, 2015, one of economist.com’s vendors, PageFair, was hacked. If you visited economist.com at any time between Oct. 31, 23:52 GMT and 01:15 GMT, Nov. 1, using Windows OS and you do not have trusted anti-virus software installed; it is possible that malware, disguised as an Adobe update, was downloaded onto your PC.
- johncolanduoni 11y ago
  It doesn't appear to be paywalled (a smart policy for a security update).
  - stephengillie 11y ago
    With JavaScript off, I saw the full post. Lots of other posters are surprised too. I'm pretty sure you're right, this announcement isn't paywalled.
- cperciva 11y ago
  This is one of the most impressive security disclosures I've ever seen. They identify the precise window of exposure; they identify the systems which could have been affected; and they provide details which may help people determine if they were attacked. I'm also impressed with how quickly they fixed the problem: Apparently it only took 83 minutes to discover and shut down the malware distribution.
  - dfc 11y ago
    Just to be clear, you should be impressed with pagefair, not the economist. The PF blog has even more information with a no BS mea culpa that would make your grandmother proud: http://blog.pagefair.com/2015/halloween-security-breach/ http://blog.pagefair.com/2015/halloween-security-breach/ "If you are a publisher using our free analytics service, you have good reason to be very angry and disappointed with us right now. For 83 minutes last night, the PageFair analytics service was compromised by hackers, who succeeded in getting malicious javascript to execute on websites via our service"
johncolanduoni 11y ago
Ugh. To paraphrase PageFair's website, ads keep the internet free, but the way ads are implemented today also keeps botnets around.
- rayuela 11y ago
  Why is this so? Is this because of their use as fake traffic?
  - johncolanduoni 11y ago
    That's true, but not what I was thinking of. Even big websites of some repute (like The Economist) are in the habit of letting a multitude of external agents run unrestricted JavaScript on their pages. As in this case, that power can be used to distribute exploits.
    - rayuela 11y ago
      Ah, very interesting...
deleted 11y ago
[deleted]
hooray_yogurt 11y ago
This is why you own your infrastructure.
- johncolanduoni 11y ago
  For the Economist, yes. The attack on PageFair was by spearphising an employee's email, so there isn't much owning your own infrastructure can do for that.
  - chinathrow 11y ago
    Sure it is... their external CDN account was compromised - no 2FA in place. Proper 2FA (read: 2FA reset key stored offline and safe, not done via mail) helps against spearphishing.
    - johncolanduoni 11y ago
      So for a business with their traffic needs, you'd recommend they do what? Buy up a bunch of physical locations all over the world and get some of OC lines? I'd be shocked if they could stay out of the red, even at their size. Your proposal would also kill virtually every startup that needs a website.
      - chinathrow 11y ago
        No, that is not what I would recommend, so please don't label it "Your proposal". My recommendation was already stated: if you use any external CDNs, make sure you don't fuck up those accounts. 2FA is one thing to safeguard against account compromise. Subresource integrity would be the next step, it's coming soon or is already here. http://caniuse.com/#feat=subresource-integrity http://caniuse.com/#feat=subresource-integrity
        johncolanduoni 11y ago
        So then why was your response to > so there isn't much owning your own infrastructure can do for that. > Sure it is, ... ?
aexaey 11y ago
Hold on... Economist wants both subscription fee and to serve 3rd party malware (a.k.a. ads) to me?
- rglullis 11y ago
  Just like cable TV? Just like any sports broadcaster that charge for tickets AND have billboards? How long is it going to take people to realize that ads vs paid content is not an either/or proposition, and that we should get rid of any ad-supported economy?
  - manigandham 11y ago
    How long is it going to take people to realize there is nothing wrong with an ad supported economy and many products, services and media would go away without it, even if relying solely on subscriptions.
    - rglullis 11y ago
      "Nothing wrong"? - The ads are almost never useful for the consumers - Companies keep shoveling money into ad campaigns just so that marketing teams can justify their budgets - Ad publishers are incentivized to completely undermine the idea of private data - Thomas Watson is often mocked for saying "I think there is a world market for maybe five computers". If we look today at Google, Facebook, Amazon, Microsoft and Apple, we are not that far from that reality. The "ad economy" is at direct odds against an open web. I'll give you that Google's breakthrough came because they could find a way to revenue, and that without ads they would never bring many useful things for fruition. But the best way to justify their wealth creation is that they manage to make the social function of advertising (connect producers and consumers) and make it more effective. There was almost zero progress in that regards afterwards. It is just a race to the bottom. I can actually bet that we would be better off without these products, services and media if they were gone. Case in point: one of the links on the front-page right now is http://www.thedailybeast.com/articles/2015/11/04/no-spooning-isn-t-sexist-the-internet-is-just-broken.html http://www.thedailybeast.com/articles/2015/11/04/no-spooning...
cm2187 11y ago
Another attack that disabling javascript would have defeated.
- stevenh 11y ago
  The malicious bit was an .exe which did not autolaunch. The javascript itself was harmless.
- olemartinorg 11y ago
  Another attack that unplugging your computer and going to live in the woods would have defeated. More and more of the web is built on javascript, so opting out of a chunk of what the web runs on will naturally limit your exposure to the dangers (and joys) of the web.
  - jarek 11y ago
    > More and more of the web is built on javascript Yes, you should definitely allow arbitrary code to run in a Turing-complete interpreter on your personal computer to read some text in the Economist. This isn't some advanced app or game pushing the limits of web technology, it's words and a few charts.
  - cm2187 11y ago
    The "joys of the web" consist more often than not in moving the text I am trying to read to show some ads, messing with the scrolling of the browser (try scrolling news.google.co.uk on an ipad!), overlaying popups to tell me to register to some newsletter or give some feedback, etc. I actually find the web much faster and nicer without javascript. A couple of blog websites will only show complete gibberish without javascript but I think bloggers massively overestimate how keen a typical user is to read what they have to say.
  - wtbob 11y ago
    > More and more of the web is built on javascript No, the web is built on HTTP and HTML, and it runs just fine without JavaScript.
- 11y ago
manigandham 11y ago
I think it needs to be said that while external ad networks can increase the surface area of a hack like this, the major issue is email security and having tight access controls and MFA in place for all major services. The same thing could've easily happened to economists own website and CDN. There have been dozens of stories including major studios, politicians and the CIA that show how losing access to an email account can cause major damage or even cripple a business, if not get them shutdown completely. It's something that seems to be overlooked a lot but with the prevalence of email access everywhere on mobile devices and the amount of phishing attempts and surveillance, this should be one of the highest priority security issues.
k8tte 11y ago
with dnsmasq address=/pagefair.com/127.0.0.1 address=/pagefair.net/127.0.0.1 seriously, this only strengthens my argument for blocking all sorts of 3rd party crap
vonklaus 11y ago
> it is possible that malware, disguised as an Adobe update, was downloaded onto your PC. If you weren't affected by this you can still download genuine Adobe malware from: www.adobe.com/creativecloud.html
hannob 11y ago
There must be an error on that page. It is missing the part where they apologize and explain how they'll make sure that this never happens again. Oh, that part isn't there? Well...
- jacquesm 11y ago
  As linked above: http://blog.pagefair.com/2015/halloween-security-breach/ http://blog.pagefair.com/2015/halloween-security-breach/ So, that part is there. Note that the site posted is not the site that was affected by the breach.
GPGPU 11y ago
And _this_ is why I run adblockers, to reduce my exposure to this. I'm not against advertising as a revenue model, but it needs to be plain HTML and images that are inserted in the page.

103 points by aburan28 11y ago

Damn, they won't even show this page without subscription ;) Edit: Maybe I overreacted. I just tried the direct link again, and it loaded. The first time, loading stalled with a blank popover.

peteretep 11y ago
I have a paid Economist subscription but it's less hassle to not login and use a combination of expiring cookies, self-clearing cache, and some specific AdBlock rules to read their content...
- IndianAstronaut 11y ago
  I've spoken to some devs who used to work for them. They have said the working environment ther for devs is terrible and retention of quality is a big issue. Their site is awful and has been awful for ages. Theh are also usually a good 3 to 5 years behind the times with their magazine technology. Late to deliver apps, poor user experience on the site, terrible mobile pages, etc. I say this as an avid reader (andnow listener) to their magazine for over nearly 15 years.
  - mrweasel 11y ago
    Even their subscription management site is terrible, it's really much more complicated than it needs to be. I love the paper version of The Economist, but I never read their online content. Partly because I can't be bothered to login.
  - zymhan 11y ago
    I love the "timekeeper" feature, only because it looks so retro at this point that I hope it never goes away.

cperciva 11y ago

I'm going to copy-and-paste the important bit in case nonsubscribers need to read it. I wouldn't normally do this, but I figure it's an important announcement rather than a creative work: On Oct. 31, 2015, one of economist.com’s vendors, PageFair, was hacked. If you visited economist.com at any time between Oct. 31, 23:52 GMT and 01:15 GMT, Nov. 1, using Windows OS and you do not have trusted anti-virus software installed; it is possible that malware, disguised as an Adobe update, was downloaded onto your PC.

johncolanduoni 11y ago
It doesn't appear to be paywalled (a smart policy for a security update).
- stephengillie 11y ago
  With JavaScript off, I saw the full post. Lots of other posters are surprised too. I'm pretty sure you're right, this announcement isn't paywalled.
cperciva 11y ago
This is one of the most impressive security disclosures I've ever seen. They identify the precise window of exposure; they identify the systems which could have been affected; and they provide details which may help people determine if they were attacked. I'm also impressed with how quickly they fixed the problem: Apparently it only took 83 minutes to discover and shut down the malware distribution.
- dfc 11y ago
  Just to be clear, you should be impressed with pagefair, not the economist. The PF blog has even more information with a no BS mea culpa that would make your grandmother proud: http://blog.pagefair.com/2015/halloween-security-breach/ http://blog.pagefair.com/2015/halloween-security-breach/ "If you are a publisher using our free analytics service, you have good reason to be very angry and disappointed with us right now. For 83 minutes last night, the PageFair analytics service was compromised by hackers, who succeeded in getting malicious javascript to execute on websites via our service"

johncolanduoni 11y ago

Ugh. To paraphrase PageFair's website, ads keep the internet free, but the way ads are implemented today also keeps botnets around.

rayuela 11y ago
Why is this so? Is this because of their use as fake traffic?
- johncolanduoni 11y ago
  That's true, but not what I was thinking of. Even big websites of some repute (like The Economist) are in the habit of letting a multitude of external agents run unrestricted JavaScript on their pages. As in this case, that power can be used to distribute exploits.
  - rayuela 11y ago
    Ah, very interesting...

deleted 11y ago

[deleted]

hooray_yogurt 11y ago

This is why you own your infrastructure.

johncolanduoni 11y ago
For the Economist, yes. The attack on PageFair was by spearphising an employee's email, so there isn't much owning your own infrastructure can do for that.
- chinathrow 11y ago
  Sure it is... their external CDN account was compromised - no 2FA in place. Proper 2FA (read: 2FA reset key stored offline and safe, not done via mail) helps against spearphishing.
  - johncolanduoni 11y ago
    So for a business with their traffic needs, you'd recommend they do what? Buy up a bunch of physical locations all over the world and get some of OC lines? I'd be shocked if they could stay out of the red, even at their size. Your proposal would also kill virtually every startup that needs a website.
    - chinathrow 11y ago
      No, that is not what I would recommend, so please don't label it "Your proposal". My recommendation was already stated: if you use any external CDNs, make sure you don't fuck up those accounts. 2FA is one thing to safeguard against account compromise. Subresource integrity would be the next step, it's coming soon or is already here. http://caniuse.com/#feat=subresource-integrity http://caniuse.com/#feat=subresource-integrity
      - johncolanduoni 11y ago
        So then why was your response to > so there isn't much owning your own infrastructure can do for that. > Sure it is, ... ?

aexaey 11y ago

Hold on... Economist wants both subscription fee and to serve 3rd party malware (a.k.a. ads) to me?

rglullis 11y ago
Just like cable TV? Just like any sports broadcaster that charge for tickets AND have billboards? How long is it going to take people to realize that ads vs paid content is not an either/or proposition, and that we should get rid of any ad-supported economy?
- manigandham 11y ago
  How long is it going to take people to realize there is nothing wrong with an ad supported economy and many products, services and media would go away without it, even if relying solely on subscriptions.
  - rglullis 11y ago
    "Nothing wrong"? - The ads are almost never useful for the consumers - Companies keep shoveling money into ad campaigns just so that marketing teams can justify their budgets - Ad publishers are incentivized to completely undermine the idea of private data - Thomas Watson is often mocked for saying "I think there is a world market for maybe five computers". If we look today at Google, Facebook, Amazon, Microsoft and Apple, we are not that far from that reality. The "ad economy" is at direct odds against an open web. I'll give you that Google's breakthrough came because they could find a way to revenue, and that without ads they would never bring many useful things for fruition. But the best way to justify their wealth creation is that they manage to make the social function of advertising (connect producers and consumers) and make it more effective. There was almost zero progress in that regards afterwards. It is just a race to the bottom. I can actually bet that we would be better off without these products, services and media if they were gone. Case in point: one of the links on the front-page right now is http://www.thedailybeast.com/articles/2015/11/04/no-spooning-isn-t-sexist-the-internet-is-just-broken.html http://www.thedailybeast.com/articles/2015/11/04/no-spooning...

cm2187 11y ago

Another attack that disabling javascript would have defeated.

stevenh 11y ago
The malicious bit was an .exe which did not autolaunch. The javascript itself was harmless.
olemartinorg 11y ago
Another attack that unplugging your computer and going to live in the woods would have defeated. More and more of the web is built on javascript, so opting out of a chunk of what the web runs on will naturally limit your exposure to the dangers (and joys) of the web.
- jarek 11y ago
  > More and more of the web is built on javascript Yes, you should definitely allow arbitrary code to run in a Turing-complete interpreter on your personal computer to read some text in the Economist. This isn't some advanced app or game pushing the limits of web technology, it's words and a few charts.
- cm2187 11y ago
  The "joys of the web" consist more often than not in moving the text I am trying to read to show some ads, messing with the scrolling of the browser (try scrolling news.google.co.uk on an ipad!), overlaying popups to tell me to register to some newsletter or give some feedback, etc. I actually find the web much faster and nicer without javascript. A couple of blog websites will only show complete gibberish without javascript but I think bloggers massively overestimate how keen a typical user is to read what they have to say.
- wtbob 11y ago
  > More and more of the web is built on javascript No, the web is built on HTTP and HTML, and it runs just fine without JavaScript.
11y ago

manigandham 11y ago

I think it needs to be said that while external ad networks can increase the surface area of a hack like this, the major issue is email security and having tight access controls and MFA in place for all major services. The same thing could've easily happened to economists own website and CDN. There have been dozens of stories including major studios, politicians and the CIA that show how losing access to an email account can cause major damage or even cripple a business, if not get them shutdown completely. It's something that seems to be overlooked a lot but with the prevalence of email access everywhere on mobile devices and the amount of phishing attempts and surveillance, this should be one of the highest priority security issues.

k8tte 11y ago

with dnsmasq address=/pagefair.com/127.0.0.1 address=/pagefair.net/127.0.0.1 seriously, this only strengthens my argument for blocking all sorts of 3rd party crap

vonklaus 11y ago

> it is possible that malware, disguised as an Adobe update, was downloaded onto your PC. If you weren't affected by this you can still download genuine Adobe malware from: www.adobe.com/creativecloud.html

hannob 11y ago

There must be an error on that page. It is missing the part where they apologize and explain how they'll make sure that this never happens again. Oh, that part isn't there? Well...

jacquesm 11y ago
As linked above: http://blog.pagefair.com/2015/halloween-security-breach/ http://blog.pagefair.com/2015/halloween-security-breach/ So, that part is there. Note that the site posted is not the site that was affected by the breach.

GPGPU 11y ago

And _this_ is why I run adblockers, to reduce my exposure to this. I'm not against advertising as a revenue model, but it needs to be plain HTML and images that are inserted in the page.