4

First a little bit of background, About two weeks back one of the developers in my team said they were seeing advertisement popups and links appearing all over the web app we were developing, when they were running it on localhost. He is based in another country and I chalked this up to may be a network or machine local infection. They claimed that it went away after sometime but they weren't sure what they did to make it disappear though.

I did deploy the branch we were developing in yesterday, and one of the end users complained of the same thing, advertisement links and popups coming all over the place. When me and a few others tested it we didn't really see anything like that.

So my question is could some malicious javascript code have been injected into the source via the infected dev machine? That might be targeting some specific browser version? If so is there a way to detect it?

EDIT :

One of the original devs who ran into this told me that he tracked it down to google analytics. But I think it's more likely the analytics script was hijacked. Also many of his friends got effected as well, and the friend has no access to our web app. And the end user who got affected told he disabled a plugin he don't remember installing in chrome and it went back to normal. So the chance of this being a localised infection is high. But the coincident is bugging me. :-|

Improve this question
4
  • 1
    It's certainly possible. The question really focuses more on whether or not it is the case. Have you seen anything suspicious in the Network tab of Developer Tools? (Chrome; Firebug offers the same in Firefox) You could also try Privacy Badger from the EFF to see what external domains are called. If each of these look OK then it may be inherent in your code in which case you may need to intercept every function call via the console.
    – Arran Schlosberg
    Apr 15, 2015 at 4:42
  • To be honest, without doing a complete investigation it's hard to tell if it's the case or not, just hire a profesional.
    – Lucas Kauffman
    Apr 15, 2015 at 6:47
  • Any tools capable of doing such a scan on the deployed site?
    – Thihara
    Apr 15, 2015 at 6:51
  • Yes, developers are prime targets and this is an awesome injection point to exploit. Compare against old version copies. If you're not doing source control, or even simply keeping old backup copies as control copies to diff against, you're doing it wrong.
    – Fiasco Labs
    Sep 5, 2015 at 18:40

1 Answer 1

Reset to default
1

This sounds a lot like ad-injection software installed by accident. This could be something like a Chrome extension or something bundled along with a download.

Google recently did a study on the matter, and they state that they "received more than 100,000 user complaints about them in Chrome since the beginning of 2015", making this a realistic scenario for the asker's problem.

I would suggest the people who complain about injected ads to run a malware scan and revise their list of browser plugins.

If, however, the problem persists, I would start checking the source control repository (assuming that you guys actually do source control) to check for changes to files that shouldn't really be changed. Make your infected developer do a clean clone from the repository and keep an close eye on any changes that developer does (or rather, make him keep an close eye on the changes he does!).

Good luck hunting!

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .