Google.ps domain was hacked

Post by pearjuice » Tue, Aug 27, 2013, 6:21 AM UTC

eli_gottlieb wrote: post #79

jbooth wrote: post #60

Earlier quoted context omitted.

And if this were done by jews being oppressed somewhere, your reaction would be the same? Not that you'll take this advice, but I'd really recommend spending a little time thinking about what if you were born with a different last name. Would you be a butthurt loser then, by dint of that last name?

I'm congratulating them; hence the winking smiley-face. What the hell? This is an online prank. Have you actually decided to treat it as a serious political protest?

Congratulating someone by calling them "butthurt" and "losers" doesn't work. Your post is rather offending and your last name does indeed spoil your stance in the Israeli-Palestinian conflict but nevertheless your comment is inappropriate and was uncalled for.

Post by s_q_b » Tue, Aug 27, 2013, 10:41 AM UTC

magicalist wrote: post #80

s_q_b wrote: post #43

Earlier quoted context omitted.

I agree with your point, but 0-day exploits aren't tossed around like candy corn. They're multi-million dollar munitions.

> 0-day exploits aren't tossed around like candy corn They are if the zero-day isn't what you're after. Something like this is like candy corn to a site like HN. You need an exploit and a reason to get your targets to visit your hacked site. When something like this hits HN's front page, if your target is in the tech world, odds are very good that you'll catch someone in the company/companies you're after. This is no…

These are both really excellent points.

While DNS-hijacking Google.ps as a watering hole for HN seems like a bit of a long shot of a vector to get access to HN users, it would be a pretty logical vector for Palestinian Authority systems. And is likely a lot of other users would get unintentionally caught in the net.

Flash/Java vulnerabilities are also quite a bit cheaper (100k range), and well within the price range of most criminal APTs, let alone nation-states. But I imagine most, if not all, HN users have those extensions disabled by default.

So the only way to compromise the systems of most users here would be a 0-day javascript vulnerability in Chrome/Firefox. These are the 0-days to which I was referring, which are massively expensive.

But overall the point is valid. The risk, even if not that large that anyone here would be targeted, makes it a good idea not to post directly to compromised websites. I'm not exactly wild about a random workstation at any US company being compromised, even though they weren't explicitly targeted, by random Israeli hackers or even Unit 8200.

Re: Google.ps domain was hacked

Re: Google.ps domain was hacked