TL;DR: Internet Archive JavaScript compromise
- A browser-layer breach: The story got framed as a backend breach, but the visible payload was a taunting JavaScript popup running inside the browser, which is exactly the layer most security programs still have zero real visibility into today.
- Free for non-profits: The breach exposed data for 31 million unique email addresses on Have I Been Pwned, and cside is offering its client-side monitoring free of charge to any non-profit organization that wants runtime browser protection.
- Your evidence trail: If the archive researchers rely on to investigate other attacks can be defaced in-browser by attackers, your own evidence trail is not as solid as it looks, so decide who actually monitors your client-side layer today.
Short on time? See cside's in-browser Magecart and skimmer blocking. It covers everything below in one deployment.
What happened at the Internet Archive
The Internet Archive, known best for The Wayback Machine, experienced a security breach yesterday. This was not the first time it had been targeted.
A mocking JavaScript popup appeared, stating:
Have you ever felt like the Internet Archive runs on sticks and is constantly on the verge of suffering a catastrophic security breach? It just happened. See 31 million of you on HIBP!
HIBP, short for Have I Been Pwned?, is a site where users can check if their personal information has been compromised in a data breach. Troy Hunt, who runs HIBP, told BleepingComputer that he received a file days ago containing internal data for 31 million unique email addresses. He verified the data's authenticity by comparing it with a user's account details.
The Internet Archive is an invaluable resource when researching cyberattacks. During our investigation into the Polyfill attack, we used it to uncover a fraudulent "Cloudflare Security Protection" tag.
It's disheartening to see non-profit organizations targeted by cybercriminals. While this incident involved a backend breach, no website is fully protected from the client-side attacks that we defend against.
As a result, we have decided to offer our services free of charge to any non-profit organization. Those that wish to use cside for their non-profit organizations will gain access to our advanced tools at no cost.
