6 ms·

Equifax was loading this script: https://aa.econsumer.equifax.com/aad/uib/js/fireclick.js https://aa.econsumer.equifax.com/aad/uib/js/fireclick.js This script,

Equifax was loading this script: https://aa.econsumer.equifax.com/aad/uib/js/fireclick.js https://aa.econsumer.equifax.com/aad/uib/js/fireclick.js This script, from Fireclick Web Analytics, then loaded a script via Akami CDN that was hosted for a Fireclick domain, netflame.cc: a248.e.akamai.net/f/248/5462/3h/hints.netflame.cc/service/script/www.annualcreditreport.com So this package was not coming from Equifax, but was being injected by a compromised analytics provider.

FilterSweep 9y ago
That's Internet 2.0 in it's purest form, no?
easytiger 9y ago
Just got this same thing on some other site.
ceejayoz 9y ago
We were just talking about the potential dangers of these third-party analytics scripts the other day. https://news.ycombinator.com/item?id=15442636 https://news.ycombinator.com/item?id=15442636
- Bartweiss 9y ago
  This is only reinforcing my conviction that blocking scripts and advertising isn't a consumer decision but a security one. I'm not unwilling to be advertised to (or analyzed), but I'm completely unwilling to expand my vulnerability from "the site I opened" to "every external service they can think to load".
  - notyourwork 9y ago
    And the problem is the general population doesn't understand this.
  - deleted 9y ago
    [deleted]
  - feelin_googley 9y ago
    "... I'm completely unwilling to expand my vulnerability from the 'site I opened' to 'every external service they can think to load'." I think that is a reasonable decision. What would be the most effective way to protect against this vulnerability? 1. Ask the authors of the major browser you use to please change their software to your benefit instead of the advertisers who pay millions every quarter and finance the authors' salary. Right now, all major browsers load scripts automatically. No user input required. What gets loaded is determined by the website, not the user. 2. Turn off Javascript. 3. Use a browser that does not load scripts automatically. Or use one program to retrieve the stuff you want from the web, e.g., an http client, and another program or programs to read/view/play it, offline. Only the http client needs an internet conection. 4. Stop using the web. (Not meant to be flippant.) The web is but one part of the internet. Alas, it has been largely "taken over" by the lure of the sale of personal information about consumers and advertising. Look for existing or new internet protocols that do not use the web but which can provide the same things that the web does. The software to access these protocols does not have to be written by organizations with interests in data collection and advertising. It may be possible to have a segment of the network that is noncommercial. Free from ad delivery.
    - ceejayoz 9y ago
      What meaningful capability would the general public have of evaluating which JS requests to permit?
  - deleted 9y ago
    [deleted]
politician 9y ago
That's exactly the threat that Monday's post about Circle CI was about! Literally 3 days to a concrete example!
- bkovacev 9y ago
  Could you please give me a link to that? Are users in danger of a possible hack?
  - lstamour 9y ago
    https://news.ycombinator.com/item?id=15442636 https://news.ycombinator.com/item?id=15442636 - No more a danger than on most sites, it's just something to consider
    - wlesieutre 9y ago
      The difference pointed out in the headline being that when NYT, Amazon, Wikipedia, etc, have compromised scripts they can serve fake flash updates. If CircleCI has them they can compromise my source code and API keys. The vulnerability might be the same, but the danger to users is not. Excerpt for reference: This is a problem because the CircleCI browser context has full access to the CircleCI API, which is hosted on the same domain, so all eight of those companies' scripts can make requests to CircleCI API endpoints. Furthermore CircleCI customers frequently either include credentials in source code or as environment variables in CircleCI. Set these, and you are trusting that CircleCI won't get compromised, or at least, your application is at most as secure as CircleCI is.
  - nikolay 9y ago
    Potentially, yes! Here's the post about CircleCI: https://news.ycombinator.com/item?id=15442636 https://news.ycombinator.com/item?id=15442636
tyingq 9y ago
After poking around a bit, the "netflame.cc" domain may be where this was compromised. It used to be a Fireclick owned domain, but the current ownership might not be Fireclick. Try: whois -h whois.dynadot.com netflame.cc | grep Registrant The results don't really look like what they would be if Fireclick owned it. It's registered to a Thailand national using a personal gmail account. Can't prove it, but I have a suspicion Fireclick let the domain lapse/expire, and some bad actor registered it, then figured out what content to post where, or got hacked themselves.
- shallot_router 9y ago
  WHOIS history on that domain shows the registration changed hands on November 15, 2016. Before that, it was owned by "Digital River, Inc.": Registrant Name: Digital River, Inc. Registrant Organization: Digital River, Inc. Registrant Street: 10380 Bren Road West Registrant City: Minnetonka Registrant State/Province: MN Registrant Postal Code: 55343 Registrant Country: US Registrant Phone: +1.9522531234 Registrant Email: hostmaster@digitalriver.com Digital River appears to be an online commerce company: https://www.digitalriver.com/cloud-based-ecommerce-solutions/ https://www.digitalriver.com/cloud-based-ecommerce-solutions... They were probably the legitimate owners. The domain registration expiration date at that time was set for 2017, so it doesn't look like a registration lapse. It's unclear how and why the ownership was transferred.
  - tyingq 9y ago
    Digital river was the parent company of fireclick. > It's unclear how and why the ownership was transferred Yes, it's curious.

FilterSweep 9y ago

That's Internet 2.0 in it's purest form, no?

easytiger 9y ago

Just got this same thing on some other site.

ceejayoz 9y ago

We were just talking about the potential dangers of these third-party analytics scripts the other day. https://news.ycombinator.com/item?id=15442636 https://news.ycombinator.com/item?id=15442636

Bartweiss 9y ago
This is only reinforcing my conviction that blocking scripts and advertising isn't a consumer decision but a security one. I'm not unwilling to be advertised to (or analyzed), but I'm completely unwilling to expand my vulnerability from "the site I opened" to "every external service they can think to load".
- notyourwork 9y ago
  And the problem is the general population doesn't understand this.
- deleted 9y ago
  [deleted]
- feelin_googley 9y ago
  "... I'm completely unwilling to expand my vulnerability from the 'site I opened' to 'every external service they can think to load'." I think that is a reasonable decision. What would be the most effective way to protect against this vulnerability? 1. Ask the authors of the major browser you use to please change their software to your benefit instead of the advertisers who pay millions every quarter and finance the authors' salary. Right now, all major browsers load scripts automatically. No user input required. What gets loaded is determined by the website, not the user. 2. Turn off Javascript. 3. Use a browser that does not load scripts automatically. Or use one program to retrieve the stuff you want from the web, e.g., an http client, and another program or programs to read/view/play it, offline. Only the http client needs an internet conection. 4. Stop using the web. (Not meant to be flippant.) The web is but one part of the internet. Alas, it has been largely "taken over" by the lure of the sale of personal information about consumers and advertising. Look for existing or new internet protocols that do not use the web but which can provide the same things that the web does. The software to access these protocols does not have to be written by organizations with interests in data collection and advertising. It may be possible to have a segment of the network that is noncommercial. Free from ad delivery.
  - ceejayoz 9y ago
    What meaningful capability would the general public have of evaluating which JS requests to permit?
- deleted 9y ago
  [deleted]

politician 9y ago

That's exactly the threat that Monday's post about Circle CI was about! Literally 3 days to a concrete example!

bkovacev 9y ago
Could you please give me a link to that? Are users in danger of a possible hack?
- lstamour 9y ago
  https://news.ycombinator.com/item?id=15442636 https://news.ycombinator.com/item?id=15442636 - No more a danger than on most sites, it's just something to consider
  - wlesieutre 9y ago
    The difference pointed out in the headline being that when NYT, Amazon, Wikipedia, etc, have compromised scripts they can serve fake flash updates. If CircleCI has them they can compromise my source code and API keys. The vulnerability might be the same, but the danger to users is not. Excerpt for reference: This is a problem because the CircleCI browser context has full access to the CircleCI API, which is hosted on the same domain, so all eight of those companies' scripts can make requests to CircleCI API endpoints. Furthermore CircleCI customers frequently either include credentials in source code or as environment variables in CircleCI. Set these, and you are trusting that CircleCI won't get compromised, or at least, your application is at most as secure as CircleCI is.
- nikolay 9y ago
  Potentially, yes! Here's the post about CircleCI: https://news.ycombinator.com/item?id=15442636 https://news.ycombinator.com/item?id=15442636

tyingq 9y ago

After poking around a bit, the "netflame.cc" domain may be where this was compromised. It used to be a Fireclick owned domain, but the current ownership might not be Fireclick. Try: whois -h whois.dynadot.com netflame.cc | grep Registrant The results don't really look like what they would be if Fireclick owned it. It's registered to a Thailand national using a personal gmail account. Can't prove it, but I have a suspicion Fireclick let the domain lapse/expire, and some bad actor registered it, then figured out what content to post where, or got hacked themselves.

shallot_router 9y ago
WHOIS history on that domain shows the registration changed hands on November 15, 2016. Before that, it was owned by "Digital River, Inc.": Registrant Name: Digital River, Inc. Registrant Organization: Digital River, Inc. Registrant Street: 10380 Bren Road West Registrant City: Minnetonka Registrant State/Province: MN Registrant Postal Code: 55343 Registrant Country: US Registrant Phone: +1.9522531234 Registrant Email: hostmaster@digitalriver.com Digital River appears to be an online commerce company: https://www.digitalriver.com/cloud-based-ecommerce-solutions/ https://www.digitalriver.com/cloud-based-ecommerce-solutions... They were probably the legitimate owners. The domain registration expiration date at that time was set for 2017, so it doesn't look like a registration lapse. It's unclear how and why the ownership was transferred.
- tyingq 9y ago
  Digital river was the parent company of fireclick. > It's unclear how and why the ownership was transferred Yes, it's curious.