jQuery.com Compromised To Serve Malware

← Back to Stories (view on slashdot.org)

jQuery.com Compromised To Serve Malware

Posted by timothy on Tuesday September 23, 2014 @04:01AM from the send-you-this-query-to-have-your-advice dept.

An anonymous reader writes jQuery.com, the official website of the popular cross-platform JavaScript library of the same name, had been compromised and had been redirecting visitors to a website hosting the RIG exploit kit and, ultimately, delivering information-stealing malware. While any website compromise is dangerous for users, this one is particularly disconcerting because of the demographic of its users, says James Pleger, Director of Research at RiskIQ.

65 of 103 comments (clear)

Min score:

Reason:

Sort:

They will never learn by drinkypoo · 2014-09-23 04:03 · Score: 4, Interesting

People get upset when you call them incompetent for sourcing stuff out to foreign CDNs, but stuff like this happens all the time. It's not safe to pull stuff in from other sites for reasons which are obvious to anyone competent.

--
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
1. Re:They will never learn by _xeno_ · 2014-09-23 04:16 · Score: 5, Informative
  
  According to the article, the library itself wasn't affected.
  Plus most people don't use jQuery.com as a CDN. Instead jQuery recommends you use Google's CDN if you want to use a CDN for jQuery.
  Of course, this is still bad - I visit jQuery.com fairly frequently to check the documentation. The article doesn't say what was required for the malware to run so I have no idea if I was vulnerable to it or not, but if it was dropped on all pages and not just the home page, I definitely could have been hit by it.
  
  --
  You are in a maze of twisty little relative jumps, all alike.
2. Re:They will never learn by Dracos · 2014-09-23 04:20 · Score: 4, Informative
  
  You're speaking of the wrong "they". jQuery.com runs WordPress: that's the incompetence. If I had a nickel for every WP-based exploit or compromise, I'd have about $50, and I'm pretty sure this is another one.
3. Re:They will never learn by Anonymous Coward · 2014-09-23 04:25 · Score: 1
  
  Why do you use 85k of javascript when 25 lines of pure javascript will do?
4. Re:They will never learn by gandhi_2 · 2014-09-23 04:33 · Score: 3, Interesting
  
  Every mass-use CMS has had exploits. Even wtihout the plugin exploit problems.
  
  --
  THL phish sticks
5. Re:They will never learn by pooh666 · 2014-09-23 04:47 · Score: 3, Insightful
  
  What makes YOUR site so safe?
6. Re: They will never learn by Anonymous Coward · 2014-09-23 05:01 · Score: 1
  
  Wrong. You're supposed to use code.jquery.com, which is hosted by (wait for it) jQuery. You know, the people who were compromised.
  There's apparently no sign the jQuery CDN was hacked (jQuery.com is a different server), but it's not a good sign if you use the CDN you're supposed to use, the theory being browsers only need to cache the single code.jquery.com copy of the library instead of one per site.
  But, you know, go ahead and spread false information. It's Slashdot, after all.
7. Re:They will never learn by Alrescha · 2014-09-23 05:20 · Score: 1
  
  My firewall is whitelist-based. This means if a site uses stuff hosted off-site (jquery, googleapis) it probably isn't going to load. The net affect is that while I can browse such storefronts, I have to do work to buy from them. So I buy elsewhere. They might learn, eventually.
  A.
  
  --
  ...bringing you cynical quips since 1998
8. Re:They will never learn by jonasty · 2014-09-23 05:30 · Score: 1
  
  It was a drive-by download - no action required on your part to get popped.
9. Re:They will never learn by DahGhostfacedFiddlah · 2014-09-23 05:45 · Score: 1
  
  There's only one of it?
  
  --
  Last post!
10. Re:They will never learn by Anonymous Coward · 2014-09-23 05:46 · Score: 1
  
  By offloading resources resources to an external site you introduce an additional point of failure. If that site goes down or becomes compromised, your site does as well. However, if your site goes down or gets compromised, it's already down/compromised, so it doesn't matter that the external resource is also there.
11. Re:They will never learn by CODiNE · 2014-09-23 05:57 · Score: 1
  
  Have you ever said "I don't run a virus scanner and I've never gotten a virus"?
  
  --
  Cwm, fjord-bank glyphs vext quiz
12. Re:They will never learn by tlhIngan · 2014-09-23 06:01 · Score: 2
  
  Plus most people don't use jQuery.com as a CDN. Instead jQuery recommends you use Google's CDN if you want to use a CDN for jQuery.
  While the recommendation may be there, I can tell you that is NOT the case. Far too often if you use NoScript, "jquery.com" is listed right there as a necessary script for the website to work.
13. Re:They will never learn by Anonymous Coward · 2014-09-23 06:09 · Score: 1
  
  When you get into higher mathematics you tend to keep away from actual numbers.
14. Re:They will never learn by RabidReindeer · 2014-09-23 06:11 · Score: 2
  
  Why do you use 85k of javascript when 25 lines of pure javascript will do?
  Because they're really, really nasty lines of Javascript. And the same 25 lines won't work on all the different web clients.
15. Re:They will never learn by Vellmont · 2014-09-23 06:14 · Score: 1
  
  I disagree with your basic premise, that things are secure, or insecure. Everything is a tradeoff. Using a foreign CDN is a tradeoff of trusting a third party to be secure vs doing it yourself. Just because you do it yourself doesn't mean it's "more secure", it's just more in your control, which can be good or bad.
  We make this tradeoff all the time. Have you ever used 3rd party software on your website? Well then you're making a tradeoff as well.
  You're right to be suspcious of trusting a 3rd party, but I don't agree that using a CDN is always a bad choice, incompetent, and obvious to anyone competent.
  
  --
  AccountKiller
16. Re:They will never learn by TWX · 2014-09-23 06:59 · Score: 1
  
  Yep. I HATE cross-site scripting. Unfortunately everyone under the sun has gone to it in the last few years even when it doesn't seem to serve any purpose, even for advertising revenue.
  
  --
  Do not look into laser with remaining eye.
17. Re:They will never learn by TWX · 2014-09-23 07:01 · Score: 1
  
  They won't learn. There have always been individuals that have gone against the grain or against the easiest path. You happen to be among them right now, and that element is small enough that it doesn't really pose a problem for everyone else.
  
  --
  Do not look into laser with remaining eye.
18. Re:They will never learn by jellomizer · 2014-09-23 07:25 · Score: 1
  
  The exact moment when your site is safe is when you think it is safe.
  Because at the point where you think it is safe, is the point where you have stopped trying to improve security and that is when problems can happen.
  
  --
  If something is so important that you feel the need to post it on the internet... It probably isn't that important.
19. Re:They will never learn by Anonymous Coward · 2014-09-23 08:00 · Score: 1
  
  What makes YOUR site so safe?
  Nobody uses it.
20. Re:They will never learn by drinkypoo · 2014-09-23 08:44 · Score: 1
  
  My site is not particularly safe. I'm using specious hosting and the most I do is occasionally log in and run updates.
  However, my site is safer than my site plus some other sites, too.
  
  --
  "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
21. Re:They will never learn by wonkey_monkey · 2014-09-23 09:17 · Score: 1
  
  So... it's safe when you think it's safe, and when you think it's safe, it's not safe? So when it's safe, it's not safe?
  
  --
  systemd is Roko's Basilisk.
22. Re:They will never learn by TangoMargarine · 2014-09-23 09:29 · Score: 1
  
  What's wrong with his grammar?
  
  --
  Unity? Screw that: XFCE. Slashdot Beta? Screw that: SoylentNews. Australis? Screw that: Pale Moon. UX developers DIAF
23. Re:They will never learn by lennier · 2014-09-23 09:42 · Score: 2
  
  My site is not particularly safe. I'm using specious hosting
  
  That's nothing, I've implemented an entire fallacious reasoner on a casuistic cloud architecture using sophistic inferencing. I'm pretty confident in the results I'm getting.
  
  --
  You are not a brain: http://books.google.com/books?id=2oV61CeDx-YC
24. Re:They will never learn by Just+Some+Guy · 2014-09-23 10:08 · Score: 1
  
  Something like Jekyll can never have a server-side exploit, and statically-generated sites are certainly popular enough among larger projects.
  
  --
  Dewey, what part of this looks like authorities should be involved?
25. Re:They will never learn by Just+Some+Guy · 2014-09-23 10:12 · Score: 3, Informative
  
  The purpose for parking JavaScript on a CDN is so that your visitors are likely to already have it in their cache. A million sites referring to the same URL is far more resource friendly than 10,000 sites hosting their own copy.
  
  --
  Dewey, what part of this looks like authorities should be involved?
26. Re:They will never learn by plcurechax · 2014-09-23 11:18 · Score: 2
  
  What makes YOUR site so safe?
  I used FrontPage to create it, and host it on MySpace.
27. Re:They will never learn by Frobnicator · 2014-09-23 15:50 · Score: 1
  
  My firewall is whitelist-based. This means if a site uses stuff hosted off-site (jquery, googleapis) it probably isn't going to load. The net affect is that while I can browse such storefronts, I have to do work to buy from them. So I buy elsewhere. They might learn, eventually.
  They won't notice or care. Why would they? You aren't doing anything to trip any kinds of alarms or alerts with them.
  If you want them to do something, call their help desk and act like an incompetent computer user. "My kids set up this newfangled computer and I can't buy from you..." If enough people did that it might make a blip on their stats that "JavaScript All The Things!" menatlity will cost them in support calls and possibly lost business.
  
  --
  //TODO: Think of witty sig statement
28. Re: They will never learn by Anonymous Coward · 2014-09-23 16:40 · Score: 1
  
  For many years code.jquery.com actually to Google itself. It wasn't until about a year ago that they got support from a different CDN to host it from code.jquery.com directly again. They still list alternative CDNs on their instructions, and say you can use which ever works best as long as you don't mind alternatives being possibly a couple days out of date on updates.
29. Re: They will never learn by int19h · 2014-09-23 21:35 · Score: 1
  
  "gotten" instead of "contracted", perhaps.
30. Re:They will never learn by chrish · 2014-09-24 01:27 · Score: 1
  
  Pulling bits from a foreign CDN also leaks information via the referrer headers, which might be something you need to worry about if you're using it for internal projects.
  
  --
  - chrish
31. Re:They will never learn by unimacs · 2014-09-24 01:34 · Score: 1
  
  What? People don't like to be called incompetent ? Who knew ? ;)
  
  The chance of an average American being in a car accident in the next 5 years is 1 in 4. 37,000 people die each year in car accidents and over 2 million are injured. Yet most of us still drive even though a lot of us have alternatives. Having your site compromised is bad but for most of us it's a lot better than being dead. My point is that life is full of risks and trade offs.
  
  Using a CDN like googleapis to host some of your content can improve the performance of your site, especially in terms of latency which is often a bigger concern on mobile networks than bandwidth.
  
  One has to weigh the risks of using a CDN against the benefits. If you understand the risks and decided that it's worth it in your case, it many not be incompetent at all.
32. Re: They will never learn by TangoMargarine · 2014-09-24 02:28 · Score: 1
  
  Ich läufe nicht einen Virusscanner und habe nie ein Virus bekommen.
  
  --
  Unity? Screw that: XFCE. Slashdot Beta? Screw that: SoylentNews. Australis? Screw that: Pale Moon. UX developers DIAF
33. Re:They will never learn by drinkypoo · 2014-09-24 02:35 · Score: 1
  
  The purpose for parking JavaScript on a CDN is so that your visitors are likely to already have it in their cache.
  If you're dumping so much JS on your users that this matters, you're doing it wrong. If your users visit your site so infrequently that your site doesn't stay cached, then it probably doesn't matter anyway.
  
  --
  "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
34. Re:They will never learn by drinkypoo · 2014-09-24 02:37 · Score: 1
  
  Because they're really, really nasty lines of Javascript. And the same 25 lines won't work on all the different web clients.
  So you deliver different lines to different web clients. It's not exactly rocket surgery. Doesn't jquery do this already regardless of where the code is hosted?
  
  --
  "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
35. Re:They will never learn by TangoMargarine · 2014-09-24 03:19 · Score: 1
  
  http://www-personal.umich.edu/...
  "I've gotten" meaning "I have received," not "I currently have."
  
  --
  Unity? Screw that: XFCE. Slashdot Beta? Screw that: SoylentNews. Australis? Screw that: Pale Moon. UX developers DIAF
36. Re:They will never learn by RabidReindeer · 2014-09-24 04:02 · Score: 1
  
  And then it's no longer 25 lines you're maintaining. In parallel.
  Yes, one of the prime benefits of jQuery is that it handles the client-specific warts of Javascript.
  Not to mention quite a few of the other warts.
37. Re:They will never learn by Just+Some+Guy · 2014-09-24 05:06 · Score: 2
  
  But if you and I are using the same library, why make the visitor fetch and store it twice? That's a slower startup for both of our sites. Multiplied across hundreds of thousands of jQuery-using instances, it adds up.
  The fastest GET is the GET which need not be made.
  
  --
  Dewey, what part of this looks like authorities should be involved?
38. Re:They will never learn by drinkypoo · 2014-09-24 06:49 · Score: 1
  
  But if you and I are using the same library, why make the visitor fetch and store it twice?
  Because of things like this. Sure, the library was allegedly not compromised, but that's this time.
  
  --
  "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
39. Re:They will never learn by sjames · 2014-09-25 08:30 · Score: 1
  
  Because I feel at least some sense of responsibility for not infecting people who visit my site but I have no idea how well you or some other party have secured their sites.
wow.... by gandhi_2 · 2014-09-23 04:12 · Score: 4, Funny

did I just hear some relevent news on slashdot before i saw it on twitter?
today is a bright, shiney day!

--
THL phish sticks
The key piece of info that you need to know by Fnord666 · 2014-09-23 04:13 · Score: 4, Informative

The key piece of info that you need to know is this:

The only good news in all of this is that there is no indication that the jQuery library was affected.

--
'The tyrant will always find pretext for his tyranny.' - Aesop's Fables
Thats not good. by stewsters · 2014-09-23 04:15 · Score: 1, Interesting

This is going to be a large one. Many small to medium websites use their cdn for hosting JQuery rather than pulling it down and hosting it themselves. Kinda feel a little better about hosting it myself now.
1. Re:Thats not good. by Jason+Levine · 2014-09-23 04:30 · Score: 3, Interesting
  
  Except they've said that the library wasn't affected. So it would just be people who went to the jQuery website... like I did a couple of days ago. :-O
  
  --
  My sci-fi novel, Ghost Thief, is now available from Amazon.com.
2. Re:Thats not good. by pooh666 · 2014-09-23 04:50 · Score: 1
  
  yep, and the low visibility of your one single site means that any exploit on your version of jquery will be much more likely to go unnoticed. Not to mention the not RTFA part about it not affecting hosted versions.
3. Re:Thats not good. by _xeno_ · 2014-09-23 05:04 · Score: 1
  
  It would be nice if the article mentioned what browsers/plugins were vulnerable, wouldn't it? (And does this cover api.jquery.com or just the home page?) Although it wouldn't surprise me that they just don't know yet since jQuery is still investigating.
  I'm pretty sure I'm up to date with everything, but...
  
  --
  You are in a maze of twisty little relative jumps, all alike.
4. Re:Thats not good. by freezin+fat+guy · 2014-09-23 05:07 · Score: 1
  
  The good news is that admins are more likely to run flash block or equivalent settings, and jquery.com isn't one of those evil sites that requires flash.
  Now if we could just get Google to fully commit to a flash-free world...
5. Re:Thats not good. by Jason+Levine · 2014-09-23 05:24 · Score: 1
  
  Exactly. I visited api.jquery.com with Google Chrome. Am I safe because I used Chrome or because I didn't go to www.jquery.com? Or am I still potentially infected? Was the infection only on September 18th (removed that day) or did it linger for a few days after this? (When I went there on September 19th, could I have been infected?) Details would be very helpful.
  
  --
  My sci-fi novel, Ghost Thief, is now available from Amazon.com.
6. Re: Thats not good. by mi · 2014-09-23 09:41 · Score: 1
  
  So you inspected every line of source code of your browser, operating system, and java runtime, and visually verified that they are all secure?
  No, I simply know enough about exploits. The software on my system may — indeed, is likely to — contain the common vulnerabilities. In theory it is just as exploitable as anything else.
  However, to be able to exploit my machine in practice, you need to know exactly how my stuff is compiled. How exactly should your JPG file be crafted, for example, to insert executable code to where it will be executed? People running pre-compiled binaries can all be infected by the same image.
  People like myself, using non-default compilers with non-default optimization flags, require customization. And there is no profit in such individual customizations for any regular hacker — one has to target me specifically spending considerable effort. People, who'd do that to get me, can already issue subpoenas and obtain search-warrants...
  Like a person hugging the ground when a mortar falls, I'm not invincible. But I'm far safer, than the fools standing-up are...
  (BTW, it really is a bad style to down-mod and then post anonymously in the same thread...)
  
  --
  In Soviet Washington the swamp drains you.
More reason for Requestpolicy by TheCarp · 2014-09-23 04:20 · Score: 2

This is exactly the sort of reason I run requestpolicy, and jquery is always one of the ones I hate seeing because I know what it means to allow so many sites to talk to load code the same one, so it only ever gets a temporary exception, same for googleapis.

--
"I opened my eyes, and everything went dark again"
1. Re:More reason for Requestpolicy by pjt33 · 2014-09-23 05:05 · Score: 4, Informative
  
  If you're that worried about it, why don't you run a local mirror and point your hosts file at it?
2. Re:More reason for Requestpolicy by TheCarp · 2014-09-23 05:11 · Score: 1
  
  well, I, because.... fucking great idea. I really just never considered it.
  
  --
  "I opened my eyes, and everything went dark again"
Always assumed it was ... by gstoddart · 2014-09-23 04:25 · Score: 2

I have always treated it like it's an external 3rd party, not the web site I'm visiting, and therefore not an entity I trust.
I've always viewed jquery as about as trusted as doubleclick or scorecardresearch. I don't know or care what you do, I didn't visit your site.
But then, I've learned not to trust the web in general.
With so many sites using this, dumping malware into it means you can get a whole lot of sites easily ... making this a fairly obvious target.

--
Lost at C:>. Found at C.
jQuery.com Compromised To Serve Malware by marsu_k · 2014-09-23 04:39 · Score: 1

You mean... jQuery?
(for the record I use it where appropriate, but it's also way over/misused)
1. Re:jQuery.com Compromised To Serve Malware by just_another_sean · 2014-09-23 04:47 · Score: 1
  
  No, their website was compromised, not the library so the headline is valid.
  
  --
  Creationist Textbook Stickers Declared Unconstitutional by CowboyNeal
Re:The key piece of info that you need to know by benjfowler · 2014-09-23 04:39 · Score: 1

Probably not that dumb. If it's a watering-hole attack to go after developers rather than end-users to steal IP or go after high-volume websites in a less-indiscriminate way, then that would make sense.
Noob question: Could a Mac be infected? by NitzJaaron · 2014-09-23 04:59 · Score: 1

Did a little research on the Rig exploit, and I've come away a bit confused: if I hit the exploited site while using a Mac, could the Mac be infected, and if so how could I tell - and how could I remove it if so? Thanks in advance.
1. Re:Noob question: Could a Mac be infected? by Jason+Levine · 2014-09-23 05:15 · Score: 1
  
  I was looking into it also as I went to the jQuery.com site a day after the exploit was detected. (It was detected on September 18th. I visited the site on September 19th.) Apparently, the RIG exploit uses IE, Java, Flash and/or Silverlight. I'm not sure if my loading of the site in Google Chrome means that I'm safe or that I could still be infected.
  
  --
  My sci-fi novel, Ghost Thief, is now available from Amazon.com.
2. Re:Noob question: Could a Mac be infected? by sexconker · 2014-09-23 06:16 · Score: 1
  
  I've been all over their site lately, using FF, NoScript, and ABP. Saw nothing out of the ordinary.
JQuery is a menace anyway by Mister+Liberty · 2014-09-23 06:47 · Score: 1

Browser sniffer par excellence.
1. Re:JQuery is a menace anyway by CrashNBrn · 2014-09-23 08:33 · Score: 1
  
  Yeah it's kinda crap in some ways. It sure is a nicer/cleaner/more readable/less-typing syntax though. Kinda like Groovy v Java.
2. Re:JQuery is a menace anyway by PPH · 2014-09-23 09:27 · Score: 1
  
  It's a fscking bottleneck. Too many times, an otherwise useful page stalls trying to load something from jquery.com.
  
  --
  Have gnu, will travel.
Re:The key piece of info that you need to know by TWX · 2014-09-23 07:02 · Score: 1

Or they wanted to see how quickly a penetration would be noticed, if at all, so that they could build a bigger exploit.

--
Do not look into laser with remaining eye.
Windows malware by manu0601 · 2014-09-23 13:51 · Score: 1

The attack should be a concern because jquery.com visitors are devs and sysadmins. But I understand RIG is a Windows malware. Who trust Windows enough to use the same machine surf the web and to store precious keys?
jQuery confirms compromise by jedinite · 2014-09-24 05:42 · Score: 1

https://twitter.com/jquery/sta...

--

---------
There is no try at jedinite.com