4 ms·

So let's say that the jquery.com server was not compromised... What else could have caused RiskIQ to see the injected script tag at the end of the body element

So let's say that the jquery.com server was not compromised... What else could have caused RiskIQ to see the injected script tag at the end of the body element? Could there have been an injection at the ISP? Was it a DNS heist? Or another BGP compromise? I must admit I'm quite intrigued and looking forward to seeing what the investigation uncovers.

UnoriginalGuy 12y ago
They do run adverts from http://adzerk.com http://adzerk.com. Maybe it was them?
- bagels 12y ago
  "They", who, jquery.com?
kevjiang 12y ago
Were any HNers ever able to reproduce what RiskIQ reported? Namely seeing jquery.com include the script from the malicious jquery-cdn[.]com domain?
davidu 12y ago
We (OpenDNS) saw traffic to those domains spike during that time. We're investigating. https://www.dropbox.com/s/tfqpau25ugixiy6/Investigate_2014-09-23_20-32-51.png?dl=0 https://www.dropbox.com/s/tfqpau25ugixiy6/Investigate_2014-0...
- deweller 12y ago
  This implies that the script tag injection was indeed served to a wide audience. Although I guess there is no way to know that these requests came from the jquery.com site.
  - davidu 12y ago
    yes and yes