3 ms·

I'm going to copy-and-paste the important bit in case nonsubscribers need to read it. I wouldn't normally do this, but I figure it's an important announcement

I'm going to copy-and-paste the important bit in case nonsubscribers need to read it. I wouldn't normally do this, but I figure it's an important announcement rather than a creative work: On Oct. 31, 2015, one of economist.com’s vendors, PageFair, was hacked. If you visited economist.com at any time between Oct. 31, 23:52 GMT and 01:15 GMT, Nov. 1, using Windows OS and you do not have trusted anti-virus software installed; it is possible that malware, disguised as an Adobe update, was downloaded onto your PC.

johncolanduoni 11y ago
It doesn't appear to be paywalled (a smart policy for a security update).
- stephengillie 11y ago
  With JavaScript off, I saw the full post. Lots of other posters are surprised too. I'm pretty sure you're right, this announcement isn't paywalled.
cperciva 11y ago
This is one of the most impressive security disclosures I've ever seen. They identify the precise window of exposure; they identify the systems which could have been affected; and they provide details which may help people determine if they were attacked. I'm also impressed with how quickly they fixed the problem: Apparently it only took 83 minutes to discover and shut down the malware distribution.
- dfc 11y ago
  Just to be clear, you should be impressed with pagefair, not the economist. The PF blog has even more information with a no BS mea culpa that would make your grandmother proud: http://blog.pagefair.com/2015/halloween-security-breach/ http://blog.pagefair.com/2015/halloween-security-breach/ "If you are a publisher using our free analytics service, you have good reason to be very angry and disappointed with us right now. For 83 minutes last night, the PageFair analytics service was compromised by hackers, who succeeded in getting malicious javascript to execute on websites via our service"
  - tempestn 11y ago
    Agreed; the pagefair post is great and described the exact nature of the attack. The economist should have linked to their original post. Until I read your comment, my main question was, "How would I know if I was infected?" Was it a silent drive-by download/install? Or would I have had to click a dialog? Did it require manual installation of a downloaded executable? In fact it required all those things, so it's very unlikely the average HN reader could have been infected without their knowledge just from having visited the economist during that window. From the economist post though, there's no way to know. In the extreme case, someone could end up spending a ridiculous amount of time changing all their passwords and financials completely needlessly.
  - johncolanduoni 11y ago
    Compare this to Symantec's response to issuing signed certificates for google.com[1], where they downplayed the issue and said they only found 3 instances when back over the last decade with a fine tooth comb. Followed by Google finding many more instances just using the certificate transparency logs, answered by Symantec with more doublespeak. [1]: https://googleonlinesecurity.blogspot.com/2015/10/sustaining-digital-certificate-security.html https://googleonlinesecurity.blogspot.com/2015/10/sustaining...
  - neilwillgettoit 11y ago
    That is a fantastic response.
  - chinathrow 11y ago
    I would rather say we should be not so much impressed with pagefair. Running stuff on an externally managed CDN without 2FA is simply stupid and dangerous. And even more as they are a third party script used by dozens of news papers.
    - deleted 11y ago
      [deleted]
  - e12e 11y ago
    Thanks for the link. I agree, it's a very nice disclosure. I do find it somewhat ironic that that page links in javascript from 5(?) other domains according to noscript. One of which is good old s3.amazonaws.com - which if this allows CORS in general is basically allowing any random person to inject js in your page? (I believe any bucket in the standard US east region is reachable as s3.amazonaws.com/example.com/example.js ?) (The other being an ad network, disqus, google analytics (now that is ironic) and "add this")
- joosters 11y ago
  It's a shame then that hardly anyone will see it. Readers of The Economist are affected yet there is no mention of the problem on their home page.
- thomasrossi 11y ago
  One of the best handled security event in a long time (at the best of my knowledge), especially on the PR side.
- NelsonMinar 11y ago
  PageFair's entire product is circumventing the software I've installed for my security and privacy. I don't think there's any way to do that responsibly. Coming clean with how they infected people with malware while bypassing their security software is the least they could do.
dfc 11y ago
Not a subscriber and I had no trouble viewing the information thanks to ublock and noscript.

johncolanduoni 11y ago

It doesn't appear to be paywalled (a smart policy for a security update).

stephengillie 11y ago
With JavaScript off, I saw the full post. Lots of other posters are surprised too. I'm pretty sure you're right, this announcement isn't paywalled.

cperciva 11y ago

This is one of the most impressive security disclosures I've ever seen. They identify the precise window of exposure; they identify the systems which could have been affected; and they provide details which may help people determine if they were attacked. I'm also impressed with how quickly they fixed the problem: Apparently it only took 83 minutes to discover and shut down the malware distribution.

dfc 11y ago
Just to be clear, you should be impressed with pagefair, not the economist. The PF blog has even more information with a no BS mea culpa that would make your grandmother proud: http://blog.pagefair.com/2015/halloween-security-breach/ http://blog.pagefair.com/2015/halloween-security-breach/ "If you are a publisher using our free analytics service, you have good reason to be very angry and disappointed with us right now. For 83 minutes last night, the PageFair analytics service was compromised by hackers, who succeeded in getting malicious javascript to execute on websites via our service"
- tempestn 11y ago
  Agreed; the pagefair post is great and described the exact nature of the attack. The economist should have linked to their original post. Until I read your comment, my main question was, "How would I know if I was infected?" Was it a silent drive-by download/install? Or would I have had to click a dialog? Did it require manual installation of a downloaded executable? In fact it required all those things, so it's very unlikely the average HN reader could have been infected without their knowledge just from having visited the economist during that window. From the economist post though, there's no way to know. In the extreme case, someone could end up spending a ridiculous amount of time changing all their passwords and financials completely needlessly.
- johncolanduoni 11y ago
  Compare this to Symantec's response to issuing signed certificates for google.com[1], where they downplayed the issue and said they only found 3 instances when back over the last decade with a fine tooth comb. Followed by Google finding many more instances just using the certificate transparency logs, answered by Symantec with more doublespeak. [1]: https://googleonlinesecurity.blogspot.com/2015/10/sustaining-digital-certificate-security.html https://googleonlinesecurity.blogspot.com/2015/10/sustaining...
- neilwillgettoit 11y ago
  That is a fantastic response.
- chinathrow 11y ago
  I would rather say we should be not so much impressed with pagefair. Running stuff on an externally managed CDN without 2FA is simply stupid and dangerous. And even more as they are a third party script used by dozens of news papers.
  - deleted 11y ago
    [deleted]
- e12e 11y ago
  Thanks for the link. I agree, it's a very nice disclosure. I do find it somewhat ironic that that page links in javascript from 5(?) other domains according to noscript. One of which is good old s3.amazonaws.com - which if this allows CORS in general is basically allowing any random person to inject js in your page? (I believe any bucket in the standard US east region is reachable as s3.amazonaws.com/example.com/example.js ?) (The other being an ad network, disqus, google analytics (now that is ironic) and "add this")
joosters 11y ago
It's a shame then that hardly anyone will see it. Readers of The Economist are affected yet there is no mention of the problem on their home page.
thomasrossi 11y ago
One of the best handled security event in a long time (at the best of my knowledge), especially on the PR side.
NelsonMinar 11y ago
PageFair's entire product is circumventing the software I've installed for my security and privacy. I don't think there's any way to do that responsibly. Coming clean with how they infected people with malware while bypassing their security software is the least they could do.

dfc 11y ago

Not a subscriber and I had no trouble viewing the information thanks to ublock and noscript.