News for hackers. Stuff that matters.

Tell HN: Exercise caution with links to archive sites

Posted by hericium on Monday March 14, 2022 @05:42AM
from the self-post dept.
Some users comment on posts with links to various archiving sites containing copies of linked article. This is obviously welcome when linked article is a garden / behind paywall but often the article is perfectly readable with JS disabled and archive site requires running Google's, Cloudflare's JS code or worse.

Some archive sites - like archive.ph - attempt to run malicious code on viewers' devices. It seems that archive.ph's copies of various articles[1] all attempt to run at least a script from mail.ru domain that appears[2] to "harvest data from the page (references to "gender", "age", etc) and some shady-named variables like "bait". Also a function that fetches data from top-fwz1.mail.ru and then tries to submit a hidden 1px*1px form created in an iframe using this data (...)"

[1] https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...

[2] https://news.ycombinator.com/item?id=30669851

( 9 comments | 29 points | on HN )
Re:Tell HN: Exercise caution with links to archive sites by perihelions on Monday March 14, 2022 @06:11AM (#30670526)
Archive.is mirrors have been linked north of 15,000 times on HN over 9 years [0]. (Archive.is is the more popular URL for the same [1] service). I'm skeptical that actually-malicious behavior would have gone unnoticed for so long, on this site of all places.

Unless your position is all intrusive analytics scripts are "malware" -- in which case I philosophically agree, but it's futile.

[0] https://hn.algolia.com/?query=archive.is&type=comment (note Algolia's exact # is nondeterministic and changes on refresh)

[1] https://en.wikipedia.org/wiki/Archive.today

(Full disclosure: I've linked many of these myself).

[ Parent | on HN ]
Re:Tell HN: Exercise caution with links to archive sites by hericium on Monday March 14, 2022 @06:22AM (#30670608)
Last time I checked, archive.is required JS and was showing a page imitating Cloudflare's but using reCaptcha. I actually got downvoted after pointing out that archive.is requires JS when linked article can be read with no JS.
[ Parent | on HN ]
Re:Tell HN: Exercise caution with links to archive sites by jitl on Monday March 14, 2022 @07:49AM (#30671271)
Wowee, Websites on the Internet using JavaScript and Tracking Pixels to Record Everything We Do! This is the first time I’m hearing about it (https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...). I certainly don’t have any counter measures available to block these activities from happening on my computer (uBlock Origin and similar tools can block these requests). I wonder how common this is (An estimated 55% of all sites on the internet use Google Analytics)?
[ Parent | on HN ]
Re:Tell HN: Exercise caution with links to archive sites by uwu on Monday March 14, 2022 @06:16AM (#30670562)
the top-fwz1 script is mail.ru's statistics counter

https://top.mail.ru/help/en/rating

> Top Mail.Ru is a statistics system for site owners. You need to get and install the counter code on the pages of your site to collect data.

you can see the same code snippet that's on archive.ph here: https://top.mail.ru/help/en/code/receive

[ Parent | on HN ]
Re:Tell HN: Exercise caution with links to archive sites by jacquesm on Monday March 14, 2022 @05:54AM (#30670411)
Indeed. There are a couple of users that provide these as a service to the community but there are also users who seem to be pushing predominantly malicious sites without ever contributing in any other way.

Personally I would rather see all those archive links gone because they have the exact same problems that link shorteners did, even if they are benign today they could easily turn malicious tomorrow.

[ Parent | on HN ]
Re:Tell HN: Exercise caution with links to archive sites by forgotpwd16 on Monday March 14, 2022 @06:03AM (#30670471)
That's strange. The archive.ph is another URL for archive.today, a well-known archive service[0]. Could it be it has been compromised?

[0]: https://en.wikipedia.org/wiki/Archive.today

[ Parent | on HN ]
Re:Tell HN: Exercise caution with links to archive sites by perihelions on Monday March 14, 2022 @06:23AM (#30670619)
It's been affiliated with mail.ru analytics for years:

https://news.ycombinator.com/item?id=23316085 ("Ask HN: Who owns archive.is, and why are they trustworthy?") (2020)

[ Parent | on HN ]
Re:Tell HN: Exercise caution with links to archive sites by forgotpwd16 on Monday March 14, 2022 @06:37AM (#30670712)
What found strange is the malicious part as thought to mean some exploiting code exists. Is it that or just analytics?
[ Parent | on HN ]
Re:Tell HN: Exercise caution with links to archive sites by rosndo on Wednesday March 16, 2022 @03:03AM (#30696069)
It’s just regular analytics, not different than Google Analytics.

OP is just a russophobic asshole.

[ Parent | on HN ]