andy112
Joined 14 years ago
Karma
64
Submissions
30
Member since
Dec 20
Recent submissions
Comment · 5 years ago
Manually removing the duplicates seemed to work fine until yesterday when I noticed everything except for a newly-added account is now gone
Comment · 7 years ago
we got 503s in multiple AZs in us-east-1 and are still unable to start a specific instance in us-east-1b :(
Comment · 7 years ago
we are still seeing issues here
Comment · 11 years ago
Which article were you reading?
You can actually see a list of all resources served from scriptobservatory.org for the last 6 months here: https://scriptobservatory.org/webpage/b0852f543b380fd1515112...
There are no ads, popups, etc.
Comment · 11 years ago
Yes, the two are considered as if they were completely separate sites.
Comment · 11 years ago
Yep that looks like a good string to key off of.
The results for the site you mentioned are here - https://scriptobservatory.org/webpage/543677125f1bea8226ba7c... - but I don't see anything that looks like a clear match.
Comment · 11 years ago
Hmm, that sounds strange.
If you were only able to reproduce it on a Nexus 5, I don't think analysis with ScriptObservatory will be easy. I'd still suggest submitting the URLs to be scanned by the robo-browser and then looking to see if what gets reported looks similar to what you saw before.
Also, if you write a Yara rule that matches on some of the unique features in the JS/iframes you saw, you could run a search through what's been seen. You can use that to also be alerted when new matches are reported. If something similar has been seen elsewhere, you might be able to tie it to a specific ad network.
Comment · 11 years ago
Hi all. This is a side-project I've been working on for a while now. From the FAQs page:
Why is something like this a good idea?
JavaScript, iframes, and other embedded web content have the potential to cause your browser to take unwanted and even harmful actions on your behalf, however visibility into what you're running as you browse is very limited. After-the-fact analysis of what you were sent is (in nearly all cases) outright impossible.
If you have any thoughts or want a few interesting queries to get started, get in touch. Feedback is welcome!
Comment · 11 years ago
Hi all. This is a side-project I've been working on for a while now. From the FAQs page:
Why is something like this a good idea?
JavaScript, iframes, and other embedded web content have the potential to cause your browser to take unwanted and even harmful actions on your behalf, however visibility into what you're running as you browse is very limited. After-the-fact analysis of what you were sent is (in nearly all cases) outright impossible.
If you have any thoughts or want a few interesting queries to get started, get in touch. Feedback is welcome!
Comment · 11 years ago
Got it. Thanks very much!
Comment · 11 years ago
Hi, I run the site https://scriptobservatory.org, which scans the internet and keeps track of what JavaScript people are sent as they browse the internet. Could you drop me an email with a copy of the exploit script (OR a list of a few unique strings found in the exploit script)?
With that, I can search the history of what we've been sent to get a list of all webpages that this exploit has been seen on.
Email is scriptobservatory -at- gmail -dot- com or you can input it in the "Do you have a list of websites you want to be scanned regularly?" text box.
Comment · 12 years ago
Very cool way of thinking about it! Thanks for that elaboration.
Re: SoftwareMaven's "why is the 'player character' so important?", I don't think the player character we follow is necessarily any more important than the other player characters. You can say every individual character (or particle in the real-world side of the analogy) has an importance only within its own reference frame and I think it still works.
Just like you can have many players playing the MMO game and "collapsing the state" of different things from their own reference frames at different times, you can have the same be true for the particles in the real-world analogy. No one player of the game is more "important" than any others. The only requirement is that it all stays self-consistent in the backend and across everyone's individual points of view at all times.
But (for better or worse) I don't think what we're talking about now is science, really, unless there's some way to test it.
Maybe you could try to detect a "lag" by doing something that causes an especially large number of states to collapse across an especially large number of frames of references all at once, but I'm not sure if you could do anything that would detect this lag because all of our ways of detecting would be lagging too. (This goes along the same lines as trying to tell if the computer you're using is running within a VM or running natively.)
Any ideas?