Hacker News Reader

I loved this article, but I'm confused about one thing – if I read it correctly, it seems to connect hacked routers inserting tokens into traffic, and tokens found on hundreds of pages (discovered with a script run by the author). But he wouldn't see these at all, so the same token found by him on many hosts is caused by something different, isn't it?

View on HN

I think you misunderstood about his scripts; his primary source of data is from acquiring the domain the malicious scripts were hosted on and he wrote scripts to summarize the server logs of his previously malicious CDN.

He knows the script URL and referrer URL of each attempt to invoke the malicious scripts. The URLs of the scripts seem to include the token to configure them to the attacker.

He visited sites in the referrers and looked them up in search only to do tests to convince himself that the pages are clean and the servers aren't conditionally returning the malicious content, etc.

Reply on news.ycombinator.com