Hacker News Reader

Comment by cperciva | Hacker News Reader

This is one of the most impressive security disclosures I've ever seen. They identify the precise window of exposure; they identify the systems which could have been affected; and they provide details which may help people determine if they were attacked.

I'm also impressed with how quickly they fixed the problem: Apparently it only took 83 minutes to discover and shut down the malware distribution.

View on HN

Just to be clear, you should be impressed with pagefair, not the economist. The PF blog has even more information with a no BS mea culpa that would make your grandmother proud:

http://blog.pagefair.com/2015/halloween-security-breach/

"If you are a publisher using our free analytics service, you have good reason to be very angry and disappointed with us right now. For 83 minutes last night, the PageFair analytics service was compromised by hackers, who succeeded in getting malicious javascript to execute on websites via our service"

Agreed; the pagefair post is great and described the exact nature of the attack. The economist should have linked to their original post. Until I read your comment, my main question was, "How would I know if I was infected?" Was it a silent drive-by download/install? Or would I have had to click a dialog? Did it require manual installation of a downloaded executable? In fact it required all those things, so it's very unlikely the average HN reader could have been infected without their knowledge just from having visited the economist during that window. From the economist post though, there's no way to know. In the extreme case, someone could end up spending a ridiculous amount of time changing all their passwords and financials completely needlessly.

Compare this to Symantec's response to issuing signed certificates for google.com[1], where they downplayed the issue and said they only found 3 instances when back over the last decade with a fine tooth comb. Followed by Google finding many more instances just using the certificate transparency logs, answered by Symantec with more doublespeak.

[1]: https://googleonlinesecurity.blogspot.com/2015/10/sustaining...

That is a fantastic response.

I would rather say we should be not so much impressed with pagefair.

Running stuff on an externally managed CDN without 2FA is simply stupid and dangerous. And even more as they are a third party script used by dozens of news papers.

Thanks for the link. I agree, it's a very nice disclosure.

I do find it somewhat ironic that that page links in javascript from 5(?) other domains according to noscript.

One of which is good old s3.amazonaws.com - which if this allows CORS in general is basically allowing any random person to inject js in your page? (I believe any bucket in the standard US east region is reachable as s3.amazonaws.com/example.com/example.js ?)

(The other being an ad network, disqus, google analytics (now that is ironic) and "add this")

To be fair, this incident demonstrates the danger of sourcing external scripts from little-known {1} providers providing a contentious {2} service. Yes, they may have better security than your own domain's server, but, if that's true, they're also more likely to be a target (all else being equal).

1. (Well, I'd never heard of them before)

2. Trying to subvert ad-blocking, albeit in a less intrusive manner than a 'real' ad, possibly.

EDIT: asterisks don't work for footnotes, do they.

PageFair's entire product is circumventing the software I've installed for my security and privacy. I don't think there's any way to do that responsibly. Coming clean with how they infected people with malware while bypassing their security software is the least they could do.

It's a shame then that hardly anyone will see it. Readers of The Economist are affected yet there is no mention of the problem on their home page.

One of the best handled security event in a long time (at the best of my knowledge), especially on the PR side.

Reply on news.ycombinator.com