The Los Angeles Times Website Is Unintentionally Serving a Cryptocurrency Mining Script (itwire.com) 58
troublemaker_23 shares a report from iTWire: The Los Angeles Times website is serving a cryptocurrency mining script which appears to have been placed there by malicious attackers, according to a well-known security expert. British infosec researcher Kevin Beaumont, who has warned that Amazon AWS servers could be held to ransom due to lax security, tweeted that the newspaper's site was serving a script created by Coinhive. The Coinhive script mines for the monero cryptocurrency. The S3 bucket used by the LA Times is apparently world-writable and an ethical hacker appears to have left a warning in the repository, warning of possible misuse and asking the owner to secure the bucket.
Who did they hire to do this? (Score:1)
Not me, that's who.
"Unintentionally" (Score:5, Insightful)
Like how they "unintentionally" point visitors to ads and scripts created by third parties.
If you're going to serve ads on your site, at least:
1 - Be responsible for them.
2 - Host them on your own domain.
Does that break the current webvertising model? GOOD!
Re:"Unintentionally" (Score:5, Interesting)
I didn't read TFS. This appears to not be caused by ads, but by the LA Times serving content from a fucking publicly-writable storage source. Wooooooooooooooooooooo oooooooooooooooooooooooooooooooooo oooooooooooooo oooooooooooooooooooooooooo oooooooooooooooooow.
Re: (Score:2)
Point 1 and 2 both stand. They just don't directly apply to the context of ads and this story (which didn't involve ads, but utter stupidity).
Re: (Score:1)
In the summary, it says they had a -rw-rw-rw- AWS S3 bucket. Who am I kidding, you probably read the summary, but don't grasp what that means. SAD!
Re: (Score:2)
Guess who else didn't grasp what it means. The person they hired to set it up! Whew good thing you saved money on that hire, hey guys?
Re: "Unintentionally" (Score:2)
Upwork FTW!
Re: (Score:1)
Think of it like a windows file share only more easy to access and (at least in this configuration) less secure.
Re: (Score:3)
If you're going to serve ads on your site, at least:
1 - Be responsible for them.
2 - Host them on your own domain.
The corollary being that if sites host ads on another domain they're not responsible for them and so you a) shouldn't trust they're not malicious code and b) should block them.
Re: (Score:2)
He's a good boy. He was probably just taking care of those drugs and firearms for one of the older boys.
This is why. (Score:5, Insightful)
Dear every site that demands that I disable my ad blocker:
This is why is respectfully request that you get bent.
Love,
Scut
Re: (Score:2)
Re: (Score:2)
You might not be aware of the fact that Coinhive scripts can run in your browser even if you have AdBlock - because they are not ads.
Disabling JS will help though.
Always (Score:2)
Ad blocker
Good quality AV for your OS.
The trust in any site as a brand and their
Corporate Main Stream Media (Score:2)
Just another collection of bloggers with delusions of grandeur, still thinking they are what they were last millennium, gate keepers and controllers of the public mind state and in reality nothing but yesteryears corporate propagandists and corrupters of democracy. I find it hardly surprising they are running crypto miners and it probably isn't as accidental as they are trying to pretend it is. Corporations are waking up to the reality of the great election blowout, where corporate main stream media, the ma