They can serve malware only to targeted domains so you may be the only one hit.
Even more targeted and obscured is to include several keywords in an article of interest that lead to a single controlled page optimized for search engines, which again serves targeted malware.
[Citation Needed]
Extraordinary claims require extraordinary evidence, and I find this extremely difficult to believe. No news outlet linked to from Google News is going to send you a "trojan", or any other kind of malware.
You may have misunderstood how the malware described in the article works - simply visiting Ars would not infect you, or anyone.
The first time was in about 2012. There was a news link off of GoogNews (not the site itself obviously, and an outlink as described). The "News" trojan link page seemed to be up for only a short while and then blocked, since later searches for the title were completely missing. I'm guessing Google probably caught it on their end since it was probably infecting everyone who clicked. I only noticed it reasonably quickly due to a rapid change in network activity, but it had already escaped the browser sandbox and was downloading more.
Drive forensics that day didn't show anything obvious on Friday, but the next Monday a trojan was found that had been using a zero-day. Since then I've used a VM for random browsing (it's not a panacea, but it's easy enough to do). If you believe that's ineffective, I'd like to understand more. A couple of times in the 13 years since, the AV in the VM has caught viruses and I don't really browse much except news from Google, Yahoo, HN, Ars, etc in that VM.
https://news.ycombinator.com/item?id=33384236
Unlikely that such an attack would make it far on HN though.
The device would have to be initially compromised by other means (by usb drive in their slides).
Browsing ars did not expose any users.
Did you read, or just writing comments anyway?
I was talking about outlinks anyway.
I'm guessing the only reason it is done this way is to make network activity less suspicious than if the device were to connect to some novel 3rd party domain?
In my days, this was done by connecting to an IRC room and listening for specific messages. I find this way of doing it way more complicated and prone to errors (an IRC client is quite easy to do and there’s no realistic way to prevent anybody to send a strange message in a given room)
Did this really happen? The site seems to be as busy as normal and with the same opinions being expressed everywhere.
Don't get me wrong, I think that was a huge loss and I don't use Reddit anymore as a result.
Like a picture of scantily glad woman on a link (Will you see more if you click it? Who knows but there's one way to find out for sure ... ) the end result if it delivers or not is a vague feeling of being manipulated. That the editors think less of me then I'd like.
But who knows, certainly the political stuff on it usually doesn't appeal to my politics so maybe it's just unhappiness that they don't share my views.
This isn't even very advanced stenography, am I right?
Heck, something like the network buffer datastore seems a lot more advanced.
Maybe they're referring to using a prominent website as a C&C server? Wait... no, they've seen that before when they reported, in 2017, on a:
> "backdoor Trojan used comments posted to Britney Spears's official Instagram account to locate the control server that sends instructions and offloads stolen data to and from infected computers." [0]
So they must be talking about the novel use of an image in the staged delivery? Oh... nevermind, that can't be it either because their reporting on VPNFilter in 2018 mentioned:
> "stage 1 relies on a sophisticated mechanism to locate servers where stage 2 and stage 3 payloads were available. The primary method involved downloading images stored on Photobucket.com and extracting an IP address from six integer values used for GPS latitude and longitude stored in the EXIF field of the image." [1]
So yeah, I guess Ars hasn't seen Base64 before it was embedded on their site.
[0] https://arstechnica.com/information-technology/2017/06/russi...
[1] https://arstechnica.com/information-technology/2018/06/vpnfi...
It seems no different in concept than a spy signaling another spy by leaving something in a public space.
https://bitofhex.com/2020/05/31/youtube-is-my-c2/
Perhaps using the picture of a pizza is novel?
Any time something is actually described as a novel technique: cryptominer. Ugh.
