Not Just Equifax. Rival Site Transunion Served Malware Too -- and 1,000 More Sites (arstechnica.com)

← Back to Stories (view on slashdot.org)

Not Just Equifax. Rival Site Transunion Served Malware Too -- and 1,000 More Sites (arstechnica.com)

Posted by EditorDavid on Saturday October 14, 2017 @11:34AM from the blaming-JavaScript dept.

An anonymous reader quotes Ars Technica: Equifax isn't the only credit-reporting behemoth with a website redirecting visitors to fake Adobe Flash updates. A security researcher from AV provider Malwarebytes said transunioncentroamerica.com, a TransUnion site serving people in Central America, [was] also sending visitors to the fraudulent updates and other types of malicious pages... Malwarebytes security researcher Jerome Segura says he was able to repeatedly reproduce a similar chain of fraudulent redirects when he pointed his browser to the transunioncentroamerica.com site. On some occasions, the final link in the chain would push a fake Flash update. In other cases, it delivered an exploit kit that tried to infect computers with unpatched browsers or browser plugins... "This is not something users want to have," Segura told Ars...

Equifax on Thursday was quick to say that its systems were never compromised in the attacks. TransUnion said much the same thing. This is an important distinction in some respects because it means that the redirections weren't the result of attackers having access to restricted parts of either company's networks. At the same time, the incidents show that visitors to both sites remain much more vulnerable to malicious content than they should be.
Both sites hosted fireclick.js, an old script from a small web analytics company which pulls pages from sites like Akamai, SiteStats.info, and Ostats.net. "It appears that attackers have compromised the third-party library," writes BankInfoSecurity, adding that Malwarebytes estimates over a 1,000 more sites are using the same library.

39 of 68 comments (clear)

Min score:

Reason:

Sort:

That's it. by jargonburn · 2017-10-14 11:40 · Score: 2

Kill it! Kill it with fire!
Seriously.
1. Re:That's it. by Aighearach · 2017-10-14 16:09 · Score: 2
  
  "Whatever the problem, solve it with fire! ;)" -- Magical Kyoko
Have incompetent security, get hacked by gweihir · 2017-10-14 11:48 · Score: 3, Insightful

Noting surprising here. And unless these people get limited in their greed and stupidity by really unpleasant and, most important, personal consequences for the CEO when that happens, nothing will change. No, I am not talking about firing them. I am talking about them paying for the damage and, depending how extreme their failure, prison time.

--
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
1. Re:Have incompetent security, get hacked by Anonymous Coward · 2017-10-14 12:40 · Score: 1
  
  Yes, it's true, there's no penalty for incompetence, and until people start going to prison for their incompetence, nothing is going to change. But you're missing the bigger problem here, one that is running rampant across the Internet. I predicted this a long time ago.
  The Internet is now filled with thousands of middlemen. Ad networks, ad brokers, analytics companies, etc....... and websites are blindly pulling in Javacript from all these middlemen. All someone has to do is compromise one of these middlemen and they can inflict a lot of damage.
  We've already seen this with ads on high profile "respectable" websites delivering malware. This is just another variation of that same problem. You don't have to hack Equifax or any other website. If you can compromise one of the middlemen it opens up hundreds or even thousands of websites to your malware all at once.
  And its all because of the insane stupidity of websites blindly pulling in third party Javascript from companies with questionable integrity and even more questionable security.
2. Re:Have incompetent security, get hacked by CaptainDork · 2017-10-14 12:47 · Score: 1
  
  This.
  NOTHING will change until litigation kicks in.
  
  --
  It little behooves the best of us to comment on the rest of us.
3. Re:Have incompetent security, get hacked by Billly+Gates · 2017-10-14 13:29 · Score: 2
  
  This.
  NOTHING will change until litigation kicks in.
  HA! Good luck buddy. I read Trans-Union makes $233 million a year from these adnetworks. You think they will sit and take this or fight out tooth and nail!
  We have a political party who feels any regulation === communism and we will turn into Venezuela if we secure people quite literally! Diane Feinstein who is the leader of the other party is based in Silicon Valley.
  You think Silicon Valley who makes up her district which makes money off these slimy ad networks and supplies her with voters and millions of campaign contributions is going to put an end this? Hell no!
  I would not be surprised if the new tax bill includes sections to PREVENT litigation in order to help secure the job creators and Miss Finstein will side with the Republicans on this based on her district and money from the .COMs she has received who do not want to be sued.
  The corruption is so bad it stinks and everyone who is doing the ill deeds are selfish to the nth degree and only care about their own interests.
  
  --
  http://saveie6.com/
4. Re: Have incompetent security, get hacked by Monster_user · 2017-10-14 14:11 · Score: 1
  
  Unfortunate timing?
  
  Hopefully it is fortunate timing. This malvertising is a matter which needs attention, and companies with information that has been considered sensitive, like Trans Union and Equifax, should not be vulnerable to malvertising. Especially if they are so lucrative.
  
  They're not Google, they don't make money from advertising to visitors to their site, right? How many people used their site and clicked on their ads before this incident? This shouldn't have been a problem to begin with. This isn't Facebook or MSN.com, this vulnerability ahouldn't have existed to begin with.
5. Re: Have incompetent security, get hacked by Anonymous Coward · 2017-10-14 14:47 · Score: 1
  
  They can't get prison time because any of their assets becomes evidence since you have to have a trial first. The 1% use credit too, if you catch my meaning. So, they'll just scapegoat until people stop caring instead.
6. Re:Have incompetent security, get hacked by CaptainDork · 2017-10-14 16:22 · Score: 2
  
  Your remarks address issues other than legal.
  "Those who don't learn from history are bound to repeat it. Those who do learn are bound to predict it." ~ © 2017 CaptainDork
  For a template of what's to come, look at fire codes.
  We did not have those until a critical number of people died.
  We are on a similar trajectory for data security.
  "Enough is enough and more than enough is too late." ~ © 2017 CaptainDork
  When "All your base are belong to us," litigation will kick in.
  So it is written, so let it be done.
  
  --
  It little behooves the best of us to comment on the rest of us.
7. Re:Have incompetent security, get hacked by Khyber · 2017-10-14 16:39 · Score: 1
  
  "personal consequences for the CEO "
  Fuck that, personal consequences for all of the shareholders. This is THEIR property. If their property causes damage to other people, they're on the fucking hook.
  
  --
  Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
8. Re: Have incompetent security, get hacked by Brockmire · 2017-10-15 09:48 · Score: 1
  
  Quoting yourself is the first listing in "how to detect a douche"
9. Re:Have incompetent security, get hacked by gweihir · 2017-10-15 11:52 · Score: 1
  
  They chose to embed 3rd party analytics, which then turned out to be insecure. This is either entirely their fault, or they must have a contract in place that applies the consequences I described to the CEO of the company that supplied the analytics. Seriously, people that mess up must feel consequences.
  As long as it is not gross negligence, I have no problem with the CEO actually getting insurance for this, but the damage must be paid for in full and at a realistic rate.
  
  --
  Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
10. Re:Have incompetent security, get hacked by gweihir · 2017-10-15 12:00 · Score: 1
  
  I believe I do see the bigger problem. If you pull in stuff from middlemen, then it is _your_ responsibility to make sure it is safe. I fully agree on your last sentence.
  Of course, this is within reason. A food-store, for example, does not need to test anything it sells for poison. They can reasonably expect the food they get delivered from suppliers is clean, unless they get notified otherwise. The same is currently not true for anything you pull into your site from a 3rd party.
  
  --
  Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
11. Re:Have incompetent security, get hacked by gweihir · 2017-10-15 12:08 · Score: 2
  
  Indeed. People do stupid things until something really important breaks. Then some measures are put in place, these days usually via liability. Then more important things break. Then some better measures are put in place. Repeat until breaking of important things gets rare enough that people forget (Tchernobyl...Fuckushima: 25 years).
  Those who do learn are a small minority and usually ignored, see also the story of Kassandra. All others usually need several catastrophes to get a glimmer of insight that things maybe should be done differently.
  
  --
  Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
12. Re:Have incompetent security, get hacked by gweihir · 2017-10-15 12:09 · Score: 1
  
  Might also work for publicly traded companies. Not all are.
  
  --
  Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
13. Re: Have incompetent security, get hacked by CaptainDork · 2017-10-15 14:19 · Score: 1
  
  Quoting yourself is the first listing in "how to detect a douche"
  Wrong.
  
  1. He Has “Lines”
  
  --
  It little behooves the best of us to comment on the rest of us.
It's not Equifix or TransUnion by Billly+Gates · 2017-10-14 11:58 · Score: 5, Informative

Each site freaking horrible 20+ ad networks, brokers, analytics, and marketing networks middleman who are the ones being compromised. It is the fireclick.js which directs data from somewhere that uses data from somewhere which then piggybacks from somewhere else until BAM the malware JS gets executed and the pop up appears.
This system is totally unacceptable and retarded! All it takes if you use 20 different ad networks with ad brokers gettings things from the highest bidder is JUST ONE compromised or malicious player and the the trust is done.
Looking at the rest of the site (I am not a web architect but others reading this post who are please reply) show some red flags. Curl shows it uses IIS 7.5 which went EOL in 2015! No COR headers so cross domain shit can be run from anywhere from the network of players, and no forcing HTTPS to prevent snooping in a man in the middle attack.
This is why we run adblockers. And website owners have the gullibility to call us thieves for doing so. I mean even the bad SSL certificates have trusts in a chain. There is no trust when anyone can insert themselves in without encryption.
We need a better solution from the IEEE or W3C or something to address the problem.

--
http://saveie6.com/
1. Re:It's not Equifix or TransUnion by Scutter · 2017-10-14 12:21 · Score: 5, Insightful
  
  If it's your website, you are responsible for the ad content you serve on it. This ridiculous "pass the buck" ecosystem that we've allowed to be created is the problem. End users who get infected by a bad site are told "Oh, gee, well I guess you should just use an antivirus. Also, pretty please turn off your ad blocker so we can make a little money to keep the site running for you?". The end user has no way of knowing who the ad network is, nor do they have any way to hold that network responsible.
  No, this is ABSOLUTELY Equifax and Transunion's fault. THEY are serving bad ads on their site. THEY are the ones who contracted with companies with terrible security. THEY are the ones inserting that bad security into their web site. THEY are responsible for any breaches as a result of that negligence. It's time to stop allowing these sites to keep getting away with this behavior over and over.
  
  --
  
  "Tell me doctor, with all of your defenses, are there any provisions for an attack by killer bees?"
2. Re:It's not Equifix or TransUnion by Billly+Gates · 2017-10-14 13:18 · Score: 2
  
  If it's your website, you are responsible for the ad content you serve on it. This ridiculous "pass the buck" ecosystem that we've allowed to be created is the problem. End users who get infected by a bad site are told "Oh, gee, well I guess you should just use an antivirus. Also, pretty please turn off your ad blocker so we can make a little money to keep the site running for you?". The end user has no way of knowing who the ad network is, nor do they have any way to hold that network responsible.
  No, this is ABSOLUTELY Equifax and Transunion's fault. THEY are serving bad ads on their site. THEY are the ones who contracted with companies with terrible security. THEY are the ones inserting that bad security into their web site. THEY are responsible for any breaches as a result of that negligence. It's time to stop allowing these sites to keep getting away with this behavior over and over.
  They are a for profit company. A comment in the parent URL mentioned they make $233,000,000 a year in ads. That is alot of cash. They can't just say no. The shareholders have a right to demand a return and not make their website for free as it costs money to produce and Trans-Union has a fiduciary responsibility .
  Who they outsource with has no control who they outsource with and they bid with another sourcer and so on. It's impossible to keep track and secure.
  
  --
  http://saveie6.com/
3. Re:It's not Equifix or TransUnion by Scutter · 2017-10-14 13:23 · Score: 1
  
  Are you actually saying that it's not their fault because A) the ads make them money, and B) the contracts are too hard to understand? Is that really what you are claiming? Because that is laughable at best and moronically idiotic at worst.
  
  --
  
  "Tell me doctor, with all of your defenses, are there any provisions for an attack by killer bees?"
4. Re:It's not Equifix or TransUnion by Billly+Gates · 2017-10-14 13:45 · Score: 1
  
  Are you actually saying that it's not their fault because A) the ads make them money, and B) the contracts are too hard to understand? Is that really what you are claiming? Because that is laughable at best and moronically idiotic at worst.
  No. What I am saying basically is the CEO can't turn off the adnetworks as he would be fired immediately. What we have in my other post is a broken system that even if you sign such a contract with an ad network it is still out of their control as they outsource to someone and so forth. I am sure they have clauses in these to prevent them from being sued due to incompetence down the chain.
  We need to verify the identity similar to how DNS is being used to prevent spam/phising in Email with DKIM keys in the DNS records. Even then all someone has to do is hack one of the *trusted* partners or channels to infect the whole chain.
  I would be in favor of the government forcing insurance on websites for liability. This would force auditors to put in security but it won't happen as the US government is way too far to the right now to believe in regulation not to mention Silicon Valley is in the district of the top Democrat Miss Finstein who also don't want to be sued or pay for insurance and will fight tooth and nail via campaign contributions.
  We need a solution to keep the ads in (as sorry but you will never see anyone say no to money), but verify content has not been altered via a man in the middle and to verify the identity of each player and a trust needs to be setup similar how we use certificates for websites today. Just a few ideas.
  
  --
  http://saveie6.com/
5. Re: It's not Equifix or TransUnion by Monster_user · 2017-10-14 14:18 · Score: 2
  
  No. The solution is that there should be such backlash and such bad press from advertising on sites for high profit companies centered around highly sensitive information, like Equifax and Transunion, or sites which contain HIPAA protected information, etc., that risking malvertising should result in the immediate firing of a CEO, CIO and CTO.
  
  They should not be forgiven for this. Forgiving them only encourages negligence in the name of profit. What benefit is it to the consumer to have their data and personal computer put at unnecessary risk? What benefit is there to the economy to increase the amount of micromanagement required of every citizen?
6. Re: It's not Equifix or TransUnion by Billly+Gates · 2017-10-14 15:55 · Score: 1
  
  No. The solution is that there should be such backlash and such bad press from advertising on sites for high profit companies centered around highly sensitive information, like Equifax and Transunion, or sites which contain HIPAA protected information, etc., that risking malvertising should result in the immediate firing of a CEO, CIO and CTO.
  They should not be forgiven for this. Forgiving them only encourages negligence in the name of profit. What benefit is it to the consumer to have their data and personal computer put at unnecessary risk? What benefit is there to the economy to increase the amount of micromanagement required of every citizen?
  You can't change human nature my friend. Money talks shit walks is an old 1980s saying that rings so true. Greed wins everytime throughout history and is part of our human psyche. Even if you make a new HIPAA act you still have the problem of the rest of the web including the 1,000 other sites.
  Website owners have a right to want to be paid and not host things for free. The solution should be a safe way to do this and an organization like we do with SSL certificates monitor it. I still will use an ad blocker, but am not opposed for ethical safe ads to help out sites like slashdot.org who I want to help. I can't because before I used Adblock my AV scanner caught a malvertisement with a banking trojan here on www.slashdot.org in 2011!
  I am not opposed to more regulation. I think using old browsers, unpatched WWW software, and not using standard good security practices should be a hefty penalty with HIPPA or PCI (credit cards). But that is not going to happen with the Trump Whitehouse and Republicans owning both houses.
  
  --
  http://saveie6.com/
7. Re:It's not Equifix or TransUnion by Aighearach · 2017-10-14 16:11 · Score: 1
  
  If it's your website, you are responsible for the ad content you serve on it.
  Instant google monopoly. Who else can you trust to serve ads?
8. Re:It's not Equifix or TransUnion by Billly+Gates · 2017-10-14 18:35 · Score: 3, Informative
  
  Looking at the rest of the site (I am not a web architect but others reading this post who are please reply) show some red flags. Curl shows it uses IIS 7.5 which went EOL in 2015!
  Not sure what you're talking about - IIS 7.5 is win2008R2, and Microsoft will be releasing patches for that for many years to come:
  https://blogs.technet.microsof...
  win2008R2 is out of "mainstream" support, but is in "extended" support.
  Not that Equifax & Transunion don't have lots of other flaws...
  Server 2008 R2 is, but IIS 7.5 is not.
  
  --
  http://saveie6.com/
9. Re: It's not Equifix or TransUnion by Brockmire · 2017-10-15 09:50 · Score: 1
  
  Were you born yesterday?
Third-party javascript includes are EVIL by Anonymous Coward · 2017-10-14 12:07 · Score: 1

You should never do that on your website.
By using third-party javascript, you are giving control of your users' web browsing to that third party.
If any of those third parties are compromised, your users suffer.
Not to mention it's slow and annoying for all those scripts to run.
1. Re: Third-party javascript includes are EVIL by Billly+Gates · 2017-10-14 13:32 · Score: 1, Troll
  
  We need to get rid of JavaScript. We need to use a more secure language in our web sites: Rust. Web browsers should only support running Rust scripts, and only Rust scripts from the same origin as the web page that refers to them. That would avoid a lot of these problems.
  Rust can just as easily display a page asking to install something. A language by default is designed to execute code.
  
  --
  http://saveie6.com/
Re:It's not Equifix or TransUnion - YES IT IS by Fly+Swatter · 2017-10-14 12:22 · Score: 3, Insightful

Companies whose job is to secure the data of an entire nation should have an extreme case of NIH Syndrome. Sadly now its all copy-paste third party junk that no one can really trust.
Easy to stop using hosts file (just like coinhive) by Anonymous Coward · 2017-10-14 12:29 · Score: 1

Put these in hosts as blocked:
0.0.0.0 aa.econsumer.equifax.com
0.0.0.0 econsumer.equifax.com
0.0.0.0 equifax.com
0.0.0.0 ostats.net
0.0.0.0 webhostinghub.com
0.0.0.0 usa.quebec-lea.com
0.0.0.0 usa.zerodirect6.com
0.0.0.0 cdn.centerbluray.info
0.0.0.0 quebec-lea.com
0.0.0.0 zerodirect6.com
0.0.0.0 centerbluray.info
0.0.0.0 transunioncentroamerica.com
0.0.0.0 a248.e.akamai.net
0.0.0.0 e.akamai.net
0.0.0.0 akamai.net
0.0.0.0 snap.sitestats.info
0.0.0.0 itechnews.org
0.0.0.0 usd.quebec-lea.com
0.0.0.0 usd.zerodirect6.com
0.0.0.0 www.temocycle.site
0.0.0.0 temocycle.site
0.0.0.0 www.theapplicationappm23.download
0.0.0.0 theapplicationappm23.download
0.0.0.0 www.bestapps4ever161.download
0.0.0.0 bestapps4ever161.download
0.0.0.0 beta.sitestats.info
0.0.0.0 1freewebhosting.org
* To block coinhive https://news.slashdot.org/comments.pl?sid=11233583&cid=55368753/
APK
P.S.=> Enjoy (list is from malwarebytes source articles)
You leak my data when I don't have a reltionship? by Snotnose · 2017-10-14 12:43 · Score: 1

Fuck you. You get sued out of existence. Your CXX suite gets sued out of existence (that is, everything you have. Houses, 401ks, whatever). Your board of directors gets sued out of existence.

. Lets be honest. These hacks happen because Those In Charge can't be bothered with security. So, if their lack of attention can throw the rest of my life into the shitter, then their lives also go into the shitter.
Re:You leak my data when I don't have a reltionshi by CaptainDork · 2017-10-14 12:52 · Score: 2

Sorry to inform, but size matters.
You lose the bankroll battle.

--
It little behooves the best of us to comment on the rest of us.
When will these IDIOTS learn by chromaexcursion · 2017-10-14 13:05 · Score: 4, Insightful

If you need to have a secure site you can't use cross links.
Anything financial needs to have a secure site.
These "business" decisions are penny wise, pound foolish.
How many more CEOs have to resign in disgrace for the idiots to catch on?
1. Re:When will these IDIOTS learn by bill_mcgonigle · 2017-10-14 21:13 · Score: 1
  
  Golden Parachutes and old-boy networks ensure that occasional resignations are irrelevant.
  Get credit on a blockchain if you want to get on with things - otherwise these people will just take a stock beating and get propped up with government bailouts (courtesy of the very people they have harmed). The whole thing is a systematic abusive relationship.
  
  --
  My God, it's Full of Source!
  OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
2. Re:When will these IDIOTS learn by Bryansix · 2017-10-15 05:16 · Score: 1
  
  Have you seen Mr. Robot where the banks control the blockchains?
3. Re:When will these IDIOTS learn by Mitreya · 2017-10-15 05:45 · Score: 1
  
  How many more CEOs have to resign in disgrace for the idiots to catch on?
  At least one -- but that CEO has to not get a large bonus + severance package on the way out.
Re:no scripts by Billly+Gates · 2017-10-14 13:36 · Score: 1

Scripts are completely unnecessary. The web worked perfectly fine back before all these bells and whistles were added. Things loaded fast, they didn't need so much bandwidth, and things were much more stable - I still have sites where I see the unresponsive script error.
Some sites have so much crap that they are just unusable. The web is becoming this big fat slow thing that I find myself spending less and less time on.
... yeah as you type this comment with a reply button using logic run in JavaScript. :-)
That is unrealistic. Slashdot as an example can't sort through thousands of comments, let you post, filter by score, etc without Javascript. People keep saying this over and over again but I do not want a 1996 Mindspring page with sparkly jpegs in the background with just colored text.
The web is a platfrom and has been since the late 1990s when Javascript took off. It will not be usable without and not to mention how can you tell a CEO he has to say no to $100,000,000 a year in from the ad networks on a site that costs money to produce?? It ain't gonna happen even if the CEO is not a moron who understands a little about security. You can't say no to money when you are publicly traded company.

--
http://saveie6.com/
Re:It's not Equifix or TransUnion - YES IT IS by Fly+Swatter · 2017-10-15 03:48 · Score: 1

Share the code, share the bugs, and share the attack vectors.
In a round a bout way, I guess you are right. However in a world where there is a new exploit in a random third party package every day, its not looking too bad these days. Weren't both of their failures through known third party exploits?
Re: Easy to stop using hosts file (just like coinh by Brockmire · 2017-10-15 09:52 · Score: 1

Your subject says it's easy to stop using hosts file, and then you instruct them to use the hosts file. Make up your fucking mind!