4 ms·

1) Don't link to sites that you think may have been compromised. It's poor form... 2) Yes http://www.riskiq.com/resources/blog/jquerycom-malware-attack-puts-p

by aroch 12y ago

1) Don't link to sites that you think may have been compromised. It's poor form... 2) Yes http://www.riskiq.com/resources/blog/jquerycom-malware-attack-puts-privileged-enterprise-it-accounts-risk http://www.riskiq.com/resources/blog/jquerycom-malware-attac... https://news.ycombinator.com/item?id=8356062 https://news.ycombinator.com/item?id=8356062

cleverjake 12y ago
Quite a silly response, considering the content and how easy it is to view just the text Earlier today, RiskIQ published a blog post stating that the jQuery.com web servers were compromised and serving the RIG exploit kit for a short period of time on the afternoon of September 18th. Our internal investigation into our servers and logs have not yet found the RIG exploit kit or evidence that there was in fact a compromise. RiskIQ was able to make contact with the jQuery Infrastructure team on September 18th, at which point with members of the RiskIQ team tried to find evidence of compromise. So far the investigation has been unable to reproduce or confirm that our servers were compromised. We have not been notified by any other security firm or users of jquery.com confirming a compromise. Normally, when we have issues with jQuery infrastructure, we hear reports within minutes on Twitter, via IRC, etc. At no time have the hosted jQuery libraries been compromised. Currently the only potential system compromised is the web software or server that runs jquery.com. We have asked RiskIQ to help us look through our server logs and systems to help identify when and how a compromise happened. Please check this blog post for updates on the situation. Even though we don’t have immediate evidence of compromise, we have taken the proper precautions to ensure our servers are secure and clean. If you happened to visit any of the our sites on September 18th and are afraid of your system being compromised you can follow the advice RiskIQ recommends: Immediately re-image system Reset passwords for user accounts that have been used on the system See if any suspicious activity has originated from the offending system
0x0 12y ago
Are there any consequences for the hosting AS? Would they know who registered the domains and hosted the kit? If not, why are they still getting peers?

by aroch 12y ago

cleverjake 12y ago

Quite a silly response, considering the content and how easy it is to view just the text Earlier today, RiskIQ published a blog post stating that the jQuery.com web servers were compromised and serving the RIG exploit kit for a short period of time on the afternoon of September 18th. Our internal investigation into our servers and logs have not yet found the RIG exploit kit or evidence that there was in fact a compromise. RiskIQ was able to make contact with the jQuery Infrastructure team on September 18th, at which point with members of the RiskIQ team tried to find evidence of compromise. So far the investigation has been unable to reproduce or confirm that our servers were compromised. We have not been notified by any other security firm or users of jquery.com confirming a compromise. Normally, when we have issues with jQuery infrastructure, we hear reports within minutes on Twitter, via IRC, etc. At no time have the hosted jQuery libraries been compromised. Currently the only potential system compromised is the web software or server that runs jquery.com. We have asked RiskIQ to help us look through our server logs and systems to help identify when and how a compromise happened. Please check this blog post for updates on the situation. Even though we don’t have immediate evidence of compromise, we have taken the proper precautions to ensure our servers are secure and clean. If you happened to visit any of the our sites on September 18th and are afraid of your system being compromised you can follow the advice RiskIQ recommends: Immediately re-image system Reset passwords for user accounts that have been used on the system See if any suspicious activity has originated from the offending system

0x0 12y ago

Are there any consequences for the hosting AS? Would they know who registered the domains and hosted the kit? If not, why are they still getting peers?