Hacker News Reader

Parent Full thread

benp84

Yes, sitewide SSL. The site is [redacted].

Affected files are:

https://[redacted].s3.amazonaws.com/js/scripts_2017-05-28-17...

https://[redacted].s3.amazonaws.com/js/scripts_2017-05-28-18...

According to "last modified" timestamps, the first was modified 7 minutes after upload, the second 2.4 days later.

View on HN

It sounds like something automated broke into your s3 account, added it mindlessly to .js files, and moved on.

That's my impression too, because no one would manually add plain text JS to a .gz file, but wouldn't that imply that someone has broken into so many AWS accounts that they needed a script to hack them all!?

I hope not, but that may be occurring. I would check your access history/see what users have touched it, and I would certainly contact Amazon.

Reply on news.ycombinator.com