4 ms·
Generally not a good idea to link directly to a hacked page. There's a bit of code injected into the page near the bottom: document.write("<SCR"+"IPT TYPE
by thaumaturgy 12y ago
Generally not a good idea to link directly to a hacked page.
There's a bit of code injected into the page near the bottom:
document.write("<SCR"+"IPT TYPE='text/javascript' SRC='" + "http" + (window.location.protocol.indexOf('https:')==0?'s':'') + "://js.revsci.net/gateway/gw.js?csid=I07714' CHARSET='ISO-8859-1'"+"><\/SCR"+"IPT>");
js.revsci.net seems to be redirecting some requests to localhost, so the code isn't loading for everyone. If it loads for you, you get redirected to a big "hacked by the Syrian Electronic Army etc. etc." page.
The location of the code doesn't look like it was from a malicious ad or social media thingy. Looks like it's near the bottom of the page template, so that's neat. It's embedded in other unrelated articles too.
edit: I was able to retrieve the content from elsewhere. It's up at http://pastebin.com/rzPeKKMH http://pastebin.com/rzPeKKMH -- it's not just doing a redirect, there's some funky stuff in there.
- voltagex_ 12y agoCould you try grabbing that again? When you pasted it it looks like linebreaks were added. I'm trying to deobfuscate it via JSNice.
- beejiu 12y agoAre you sure this is the malicious code? It looks like the standard Audience Science code, to me. Perhaps they or their CDN was hacked, or a malicious ad was placed on the advertising network?
- thaumaturgy 12y agoNope, not positive, and matheusbn posted an article saying it was something else: https://news.ycombinator.com/item?id=7928052 https://news.ycombinator.com/item?id=7928052