Fox-IT's blog publishes security research from a Dutch security firm, covering malware, botnets, and network attacks.
HN commenters link its deep dive into the QUANTUM INSERT attack technique and its other older analyses of malware and compromised systems.
Wow, aren't you the fallacy guy. Please, give me more fallacies! I should just change my username to fallaciousgoats.
How about this: I didn't use the word "knowingly" anywhere in my statement, and in fact I have no earthly idea whether the countless examples [1][2][3][4] of malware being served via ad networks on major websites was done knowingly. My guess is it wasn't?
So you've got the beginnings of a straw man fallacy here, questioning an argument that I never actually made.
If you'd like to learn more about why malware shows up on cross-site ad networks, there's a good quick read available at [5].
[1] https://news.ycombinator.com/item?id=17550808
[2] https://www.bleepingcomputer.com/news/security/hackers-abuse-google-ads-to-spread-malware-in-legit-software/
[3] https://www.helpnetsecurity.com/2023/01/18/google-ads-increasingly-pointing-to-malware/
[4] https://blog.fox-it.com/2014/01/03/malicious-advertisements-served-via-yahoo/
[5] https://theconversation.com/why-bad-ads-appear-on-good-websites-a-computer-scientist-explains-178268
It's a little alarming that one of the major online newspapers in the world can reveal such news, yet provide no substantial information on what the malware was, what platforms it infected, and how to detect if it's infiltrated your system, and furthermore remove it.
From what I read on the guardian, it seems that it's a Java-based exploit:
http://www.theguardian.com/technology/2014/jan/08/yahoo-malware-turned-europeans-computers-into-bitcoin-slaves
More info from the original source:
http://blog.fox-it.com/2014/01/03/malicious-advertisements-served-via-yahoo/
FYI: pervasive mass internet surveillance by the US military with the active cooperation of large US telcos AT&T, Verizon, and others already enables this capability in the US and much of the rest of the world.
The surveillance allows them to read the TCP sequence numbers or DNS query IDs, and then spoof valid response packets.
It’s called QUANTUMINSERT.
https://blog.fox-it.com/2015/04/20/deep-dive-into-quantum-insert/
Some older articles:
https://www.pcworld.com/article/435020/hackers-make-driveby-download-attacks-stealthier-with-fileless-infections.html
https://money.cnn.com/2013/02/22/technology/security/nbc-com-hacked-malware/index.html
https://blog.fox-it.com/2014/01/03/malicious-advertisements-served-via-yahoo/
https://www.cbsnews.com/news/huffpo-readers-hit-with-ransomware-infected-ads/
Apparently a lot of systems were backdoored in January (exploits were available before the patches), so even if the patches were installed right away the backdoor is still there [1]. The malware hackers are now slowly processing their long list of compromised systems.
[1] https://blog.fox-it.com/2020/07/01/a-second-look-at-cve-2019-19781-citrix-netscaler-adc/
>> "The usage of HTTPS in combination with HSTS can reduce the effectiveness of QI. Also using a content delivery network (CDN) that offers low latency can make it very difficult for the QI packet to win the race with the real server."
Above is from the researchers:
https://blog.fox-it.com/2015/04/20/deep-dive-into-quantum-insert/