r/Seattle Mods Ban archive.today After Finding Malware Links Injected Into Archived Articles
r/Seattle mods discover malware injection by archive.today, ban site
A moderator on r/Seattle discovered that an article archived by archive.today had malware links injected into it. To protect the community, the mod team is now using AutoModerator to automatically remove posts that link to the service, including its archive.is and other domains. The team says it won't purge every existing archive.today link but urges caution, and will expand the block list if other archive sites show the same behavior.
It wasn't flagged by a service. Multiple mods were sent to a malware site. One of them is in the cyber security business.
- consumer451
Archive.today = archive.is - which is added via comment on a huge percentage of posts on HN.
Link to comment explaining the discovery:
https://old.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...
edit: Maybe I should have titled this "claim to have discovered" as there is no external verification, and no write up. I thought I should post this in any case.
- lxe
Again? This happened before, if you remember this: https://www.tomshardware.com/software/search-engines/archive...
Previous HN thread:
- surround
If you're brave enough to want to see it yourself, visit https://archive.ph/jXv3A#:~:text=filed%20on%20Tuesday then click on the "Filed on Tuesday" link.
It redirected me to https://stolidityseashellshotter[.]com/ezrsb5dd1268e6f6ebaad... which then redirected me to a fake clone of RT news: https://rurtnews[.]com/
Unlike the Reddit mods, I'm not getting redirected to the malware site, just the fake RT site.
Edit: I clicked it a few more times and its redirecting me to either the fake RT or https://gullible-thanks[.]com/w5FDGi, which redirects to either https://sportshard[.]com/ or https://eatcells[.]com/land/?token=[a random string]
I had to disable uBlock Origin, since it does something to block many of these redirects.
- whalesalad
Is there an alternative service people like?
- avidruntime
Not sure what to believe here. Wouldn't it be possible to create a site that has some js embedded that is able to be aware of archive's process so that the archived page renders a different page than the original? Could that secondary page be what is trying to deliver the malware, using archive as an unwitting laundry? That matches the MO of malware delivery via other services, no? I'm baffled as to why the mods don't provide any details whatsoever. There are more links to the controversy between the blogger who sought archive's webmasters identity than details of this incident. The mods in this subreddit are doubling down on not sharing details under the guise of "not our job to be infosec". Perhaps a write up is in due time but at the moment this feels like a sketchy extension of the aforementioned drama
Edit: Another r/seattle moderator (not the OP of the original post) has posted their technical writeup of the malware, which is detailed and definitely more in line with what we'd expect with this kind of PSA. While I stand by all criticisms of the OP moderator and their initial handling of the disclosure, you can find the details of the incident in this excellent write up: https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...
- efficax
They really need to show some evidence for this! Just this suggestion means I won't ever use it again
- mahboi
I read through the comment thread there. There's almost no explanation of what's going on, not even the offending URL. When someone asked, he got downvoted a bunch and ridiculed, which reminds me of why I don't have a Reddit account. I don't trust archive.today because of its track record but don't trust this particular allegation either. The news is simply that a subreddit moderator blacklisted archive.today.
- Permik
The writing had been on the wall for a while.
Hopefully this'll finally drive the usage of the site down.