Slashdot Mirror

← Back to Stories (view on slashdot.org)

jQuery.com Compromised To Serve Malware

Posted by timothy on from the send-you-this-query-to-have-your-advice dept.

An anonymous reader writes jQuery.com, the official website of the popular cross-platform JavaScript library of the same name, had been compromised and had been redirecting visitors to a website hosting the RIG exploit kit and, ultimately, delivering information-stealing malware. While any website compromise is dangerous for users, this one is particularly disconcerting because of the demographic of its users, says James Pleger, Director of Research at RiskIQ.

10 of 103 comments (clear)

  1. They will never learn by drinkypoo · · Score: 4, Interesting

    People get upset when you call them incompetent for sourcing stuff out to foreign CDNs, but stuff like this happens all the time. It's not safe to pull stuff in from other sites for reasons which are obvious to anyone competent.

    --
    "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    1. Re:They will never learn by _xeno_ · · Score: 5, Informative

      According to the article, the library itself wasn't affected.

      Plus most people don't use jQuery.com as a CDN. Instead jQuery recommends you use Google's CDN if you want to use a CDN for jQuery.

      Of course, this is still bad - I visit jQuery.com fairly frequently to check the documentation. The article doesn't say what was required for the malware to run so I have no idea if I was vulnerable to it or not, but if it was dropped on all pages and not just the home page, I definitely could have been hit by it.

      --
      You are in a maze of twisty little relative jumps, all alike.
    2. Re:They will never learn by Dracos · · Score: 4, Informative

      You're speaking of the wrong "they". jQuery.com runs WordPress: that's the incompetence. If I had a nickel for every WP-based exploit or compromise, I'd have about $50, and I'm pretty sure this is another one.

    3. Re:They will never learn by gandhi_2 · · Score: 3, Interesting

      Every mass-use CMS has had exploits. Even wtihout the plugin exploit problems.

      --
      THL phish sticks
    4. Re:They will never learn by pooh666 · · Score: 3, Insightful

      What makes YOUR site so safe?

    5. Re:They will never learn by Just+Some+Guy · · Score: 3, Informative

      The purpose for parking JavaScript on a CDN is so that your visitors are likely to already have it in their cache. A million sites referring to the same URL is far more resource friendly than 10,000 sites hosting their own copy.

      --
      Dewey, what part of this looks like authorities should be involved?
  2. wow.... by gandhi_2 · · Score: 4, Funny

    did I just hear some relevent news on slashdot before i saw it on twitter?

    today is a bright, shiney day!

    --
    THL phish sticks
  3. The key piece of info that you need to know by Fnord666 · · Score: 4, Informative
    The key piece of info that you need to know is this:

    The only good news in all of this is that there is no indication that the jQuery library was affected.

    --
    'The tyrant will always find pretext for his tyranny.' - Aesop's Fables
  4. Re:Thats not good. by Jason+Levine · · Score: 3, Interesting

    Except they've said that the library wasn't affected. So it would just be people who went to the jQuery website... like I did a couple of days ago. :-O

    --
    My sci-fi novel, Ghost Thief, is now available from Amazon.com.
  5. Re:More reason for Requestpolicy by pjt33 · · Score: 4, Informative

    If you're that worried about it, why don't you run a local mirror and point your hosts file at it?