Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by tyingq | Hacker News Reader

Parent Full thread

tyingq·

The specific js that was hijacked is here: https://aa.econsumer.equifax.com/aad/uib/js/fireclick.js

That page pulls it in.

Edit: maybe a red herring. Sure looks shady though.

View on HN

So was it Equifax that was hacked, or Fireclick?

Equifax. That url is Equifax controlled. It just mentions fireclick in a comment. Click the url for the js and you'll see that it does a document.write to inject a script that's an akamai cached copy from an obscure .cc domain hosted file...this one: https://a248.e.akamai.net/f/248/5462/3h/hints.netflame.cc/se...

Hostname on open threat exchange: https://otx.alienvault.com/indicator/hostname/hints.netflame...

This obscure .cc domain pretty obviously belongs (or used to belong, they let it lapse in 2016 and it was re-registered) to Fireclick.

Update: The whois listing for the cc domain looks pretty odd. It's a person in Thailand, using a personal gmail address. Which would be odd contact details for a California company's domain. Possible of course, but unlikely.

See: $ whois -h whois.dynadot.com netflame.cc | grep Registrant

Hmm. Perhaps not what I thought. Looks hacked and shady, but perhaps this isn't it.

Yeah, looks like a compromised ad/stats provider. That would also explain the intermittent nature of the bad download. I'd hope that the article gets updated with the facts...other companies might be vulnerable to this as well.

Reply on news.ycombinator.com