This script, from Fireclick Web Analytics, then loaded a script via Akami CDN that was hosted for a Fireclick domain, netflame.cc: a248.e.akamai.net/f/248/5462/3h/hints.netflame.cc/service/script/www.annualcreditreport.com
So this package was not coming from Equifax, but was being injected by a compromised analytics provider.
The vulnerability might be the same, but the danger to users is not.
Excerpt for reference:
This is a problem because the CircleCI browser context has full access to the CircleCI API, which is hosted on the same domain, so all eight of those companies' scripts can make requests to CircleCI API endpoints. Furthermore CircleCI customers frequently either include credentials in source code or as environment variables in CircleCI. Set these, and you are trusting that CircleCI won't get compromised, or at least, your application is at most as secure as CircleCI is.
I think that is a reasonable decision.
What would be the most effective way to protect against this vulnerability?
1. Ask the authors of the major browser you use to please change their software to your benefit instead of the advertisers who pay millions every quarter and finance the authors' salary.
Right now, all major browsers load scripts automatically. No user input required.
What gets loaded is determined by the website, not the user.
2. Turn off Javascript.
3. Use a browser that does not load scripts automatically.
Or use one program to retrieve the stuff you want from the web, e.g., an http client, and another program or programs to read/view/play it, offline. Only the http client needs an internet conection.
4. Stop using the web. (Not meant to be flippant.) The web is but one part of the internet. Alas, it has been largely "taken over" by the lure of the sale of personal information about consumers and advertising.
Look for existing or new internet protocols that do not use the web but which can provide the same things that the web does.
The software to access these protocols does not have to be written by organizations with interests in data collection and advertising.
It may be possible to have a segment of the network that is noncommercial. Free from ad delivery.
It used to be a Fireclick owned domain, but the current ownership might not be Fireclick.
Try: whois -h whois.dynadot.com netflame.cc | grep Registrant
The results don't really look like what they would be if Fireclick owned it. It's registered to a Thailand national using a personal gmail account.
Can't prove it, but I have a suspicion Fireclick let the domain lapse/expire, and some bad actor registered it, then figured out what content to post where, or got hacked themselves.
Registrant Name: Digital River, Inc.
Registrant Organization: Digital River, Inc.
Registrant Street: 10380 Bren Road West
Registrant City: Minnetonka
Registrant State/Province: MN
Registrant Postal Code: 55343
Registrant Country: US
Registrant Phone: +1.9522531234
Registrant Email: hostmaster@digitalriver.com
They were probably the legitimate owners. The domain registration expiration date at that time was set for 2017, so it doesn't look like a registration lapse. It's unclear how and why the ownership was transferred.
> It's unclear how and why the ownership was transferred
Yes, it's curious.