3 ms·
Looking at Twitter it sounds like they remove it and the attacker adds it back. Maybe a generous interpretation is they don’t know yet and have multiple servers
by brazzledazzle 8y ago
Looking at Twitter it sounds like they remove it and the attacker adds it back. Maybe a generous interpretation is they don’t know yet and have multiple servers backing cloudflare with only one compromised so it’s switching between caching the two versions. The alternative that they are breached and can’t contain it is terrifying if you’re their customer.
- eat_veggies 8y agoThey are breached and can't do anything about it. Some websites hacked by the same group tried to remove it, and later, they added in "IF YOU WILL DELETE MY CODE ONE MORE TIME I WILL ENCRYPT ALL YOUR SITES! YOU VERY BAD ADMINS" [0] Terrifying indeed. [0] https://www.riskiq.com/blog/labs/magecart-ticketmaster-breach/ https://www.riskiq.com/blog/labs/magecart-ticketmaster-breac...
- nneonneo 8y agoNot that I don’t believe you, but the linked page doesn’t seem to mention that fact.
- strictnein 8y agoIt's in one of the images: https://cdn.riskiq.com/wp-content/uploads/2018/07/rsz_image13-2.png https://cdn.riskiq.com/wp-content/uploads/2018/07/rsz_image1...