Hacker News Reader

Comment by cperciva | Hacker News Reader

I'm going to copy-and-paste the important bit in case nonsubscribers need to read it. I wouldn't normally do this, but I figure it's an important announcement rather than a creative work:

On Oct. 31, 2015, one of economist.com’s vendors, PageFair, was hacked. If you visited economist.com at any time between Oct. 31, 23:52 GMT and 01:15 GMT, Nov. 1, using Windows OS and you do not have trusted anti-virus software installed; it is possible that malware, disguised as an Adobe update, was downloaded onto your PC.

View on HN

This is one of the most impressive security disclosures I've ever seen. They identify the precise window of exposure; they identify the systems which could have been affected; and they provide details which may help people determine if they were attacked.

I'm also impressed with how quickly they fixed the problem: Apparently it only took 83 minutes to discover and shut down the malware distribution.

Just to be clear, you should be impressed with pagefair, not the economist. The PF blog has even more information with a no BS mea culpa that would make your grandmother proud:

http://blog.pagefair.com/2015/halloween-security-breach/

"If you are a publisher using our free analytics service, you have good reason to be very angry and disappointed with us right now. For 83 minutes last night, the PageFair analytics service was compromised by hackers, who succeeded in getting malicious javascript to execute on websites via our service"

Agreed; the pagefair post is great and described the exact nature of the attack. The economist should have linked to their original post. Until I read your comment, my main question was, "How would I know if I was infected?" Was it a silent drive-by download/install? Or would I have had to click a dialog? Did it require manual installation of a downloaded executable? In fact it required all those things, so it's very unlikely the average HN reader could have been infected without their knowledge just from having visited the economist during that window. From the economist post though, there's no way to know. In the extreme case, someone could end up spending a ridiculous amount of time changing all their passwords and financials completely needlessly.

Compare this to Symantec's response to issuing signed certificates for google.com[1], where they downplayed the issue and said they only found 3 instances when back over the last decade with a fine tooth comb. Followed by Google finding many more instances just using the certificate transparency logs, answered by Symantec with more doublespeak.

[1]: https://googleonlinesecurity.blogspot.com/2015/10/sustaining...

That is a fantastic response.

I would rather say we should be not so much impressed with pagefair.

Running stuff on an externally managed CDN without 2FA is simply stupid and dangerous. And even more as they are a third party script used by dozens of news papers.

Thanks for the link. I agree, it's a very nice disclosure.

I do find it somewhat ironic that that page links in javascript from 5(?) other domains according to noscript.

One of which is good old s3.amazonaws.com - which if this allows CORS in general is basically allowing any random person to inject js in your page? (I believe any bucket in the standard US east region is reachable as s3.amazonaws.com/example.com/example.js ?)

(The other being an ad network, disqus, google analytics (now that is ironic) and "add this")

To be fair, this incident demonstrates the danger of sourcing external scripts from little-known {1} providers providing a contentious {2} service. Yes, they may have better security than your own domain's server, but, if that's true, they're also more likely to be a target (all else being equal).

1. (Well, I'd never heard of them before)

2. Trying to subvert ad-blocking, albeit in a less intrusive manner than a 'real' ad, possibly.

EDIT: asterisks don't work for footnotes, do they.

It's a shame then that hardly anyone will see it. Readers of The Economist are affected yet there is no mention of the problem on their home page.

One of the best handled security event in a long time (at the best of my knowledge), especially on the PR side.

PageFair's entire product is circumventing the software I've installed for my security and privacy. I don't think there's any way to do that responsibly. Coming clean with how they infected people with malware while bypassing their security software is the least they could do.

It doesn't appear to be paywalled (a smart policy for a security update).

With JavaScript off, I saw the full post. Lots of other posters are surprised too. I'm pretty sure you're right, this announcement isn't paywalled.

Not a subscriber and I had no trouble viewing the information thanks to ublock and noscript.

Reply on news.ycombinator.com