4 ms·

Just to be clear, you should be impressed with pagefair, not the economist. The PF blog has even more information with a no BS mea culpa that would make your g

by dfc 11y ago

Just to be clear, you should be impressed with pagefair, not the economist. The PF blog has even more information with a no BS mea culpa that would make your grandmother proud: http://blog.pagefair.com/2015/halloween-security-breach/ http://blog.pagefair.com/2015/halloween-security-breach/ "If you are a publisher using our free analytics service, you have good reason to be very angry and disappointed with us right now. For 83 minutes last night, the PageFair analytics service was compromised by hackers, who succeeded in getting malicious javascript to execute on websites via our service"

tempestn 11y ago
Agreed; the pagefair post is great and described the exact nature of the attack. The economist should have linked to their original post. Until I read your comment, my main question was, "How would I know if I was infected?" Was it a silent drive-by download/install? Or would I have had to click a dialog? Did it require manual installation of a downloaded executable? In fact it required all those things, so it's very unlikely the average HN reader could have been infected without their knowledge just from having visited the economist during that window. From the economist post though, there's no way to know. In the extreme case, someone could end up spending a ridiculous amount of time changing all their passwords and financials completely needlessly.
johncolanduoni 11y ago
Compare this to Symantec's response to issuing signed certificates for google.com[1], where they downplayed the issue and said they only found 3 instances when back over the last decade with a fine tooth comb. Followed by Google finding many more instances just using the certificate transparency logs, answered by Symantec with more doublespeak. [1]: https://googleonlinesecurity.blogspot.com/2015/10/sustaining-digital-certificate-security.html https://googleonlinesecurity.blogspot.com/2015/10/sustaining...
neilwillgettoit 11y ago
That is a fantastic response.
chinathrow 11y ago
I would rather say we should be not so much impressed with pagefair. Running stuff on an externally managed CDN without 2FA is simply stupid and dangerous. And even more as they are a third party script used by dozens of news papers.
- deleted 11y ago
  [deleted]
e12e 11y ago
Thanks for the link. I agree, it's a very nice disclosure. I do find it somewhat ironic that that page links in javascript from 5(?) other domains according to noscript. One of which is good old s3.amazonaws.com - which if this allows CORS in general is basically allowing any random person to inject js in your page? (I believe any bucket in the standard US east region is reachable as s3.amazonaws.com/example.com/example.js ?) (The other being an ad network, disqus, google analytics (now that is ironic) and "add this")
oneeyedpigeon 11y ago
To be fair, this incident demonstrates the danger of sourcing external scripts from little-known {1} providers providing a contentious {2} service. Yes, they may have better security than your own domain's server, but, if that's true, they're also more likely to be a target (all else being equal). 1. (Well, I'd never heard of them before) 2. Trying to subvert ad-blocking, albeit in a less intrusive manner than a 'real' ad, possibly. EDIT: asterisks don't work for footnotes, do they.

by dfc 11y ago

tempestn 11y ago

Agreed; the pagefair post is great and described the exact nature of the attack. The economist should have linked to their original post. Until I read your comment, my main question was, "How would I know if I was infected?" Was it a silent drive-by download/install? Or would I have had to click a dialog? Did it require manual installation of a downloaded executable? In fact it required all those things, so it's very unlikely the average HN reader could have been infected without their knowledge just from having visited the economist during that window. From the economist post though, there's no way to know. In the extreme case, someone could end up spending a ridiculous amount of time changing all their passwords and financials completely needlessly.

johncolanduoni 11y ago

Compare this to Symantec's response to issuing signed certificates for google.com[1], where they downplayed the issue and said they only found 3 instances when back over the last decade with a fine tooth comb. Followed by Google finding many more instances just using the certificate transparency logs, answered by Symantec with more doublespeak. [1]: https://googleonlinesecurity.blogspot.com/2015/10/sustaining-digital-certificate-security.html https://googleonlinesecurity.blogspot.com/2015/10/sustaining...

neilwillgettoit 11y ago

That is a fantastic response.

chinathrow 11y ago

I would rather say we should be not so much impressed with pagefair. Running stuff on an externally managed CDN without 2FA is simply stupid and dangerous. And even more as they are a third party script used by dozens of news papers.

deleted 11y ago
[deleted]

e12e 11y ago

Thanks for the link. I agree, it's a very nice disclosure. I do find it somewhat ironic that that page links in javascript from 5(?) other domains according to noscript. One of which is good old s3.amazonaws.com - which if this allows CORS in general is basically allowing any random person to inject js in your page? (I believe any bucket in the standard US east region is reachable as s3.amazonaws.com/example.com/example.js ?) (The other being an ad network, disqus, google analytics (now that is ironic) and "add this")

oneeyedpigeon 11y ago

To be fair, this incident demonstrates the danger of sourcing external scripts from little-known {1} providers providing a contentious {2} service. Yes, they may have better security than your own domain's server, but, if that's true, they're also more likely to be a target (all else being equal). 1. (Well, I'd never heard of them before) 2. Trying to subvert ad-blocking, albeit in a less intrusive manner than a 'real' ad, possibly. EDIT: asterisks don't work for footnotes, do they.