Fox-IT Blog
blog.fox-it.com · Company blog · on HN since 2011
Fox-IT's blog publishes security research from a Dutch security firm, covering malware, botnets, and network attacks.
What HN saysHN commenters link its deep dive into the QUANTUM INSERT attack technique and its other older analyses of malware and compromised systems.
33HN people shared it
14linked it in comments
23stories submitted
141story points
1 year agolast shared
2011people per year2026
Most-shared posts
- 1Deep dive into QUANTUM INSERT7 people · 8 points · first shared 2015 · discussion on HN
- 2Malicious advertisements served via Yahoo4 people · 3 points · first shared 2014 · discussion on HN
- 3Large botnet cause of recent Tor network overload2 people · 79 points · first shared 2013 · 16 comments on HN
- 4CryptoPHP: Analysis of a hidden threat inside popular content management systems2 people · 13 points · first shared 2014 · 1 comments on HN
- 5Critical analysis of Microsoft Operation B71 (Zeus Botnet disruption)2 people · 2 points · first shared 2012 · discussion on HN
- 6Identifying Cobalt Strike team servers in the wild2 people · 2 points · first shared 2019 · discussion on HN
- 7Heartbleed – test, advice and impact2 people · 1 points · first shared 2014 · discussion on HN
- 8Detection and recovery of NSA’s covered up tracks1 people · 6 points · first shared 2017 · discussion on HN
- 9Malvertising on Java.com1 people · 6 points · first shared 2014 · discussion on HN
- 10Compromising IPv4 networks via IPv61 people · 4 points · first shared 2018 · discussion on HN
- 11RSA-512 Certificates abused in the wild1 people · 2 points · first shared 2011 · discussion on HN
- 12Demystifying Pobelka; A technical intelligence report on the Pobelka botnet1 people · 2 points · first shared 2013 · discussion on HN
- 13Google ads reseller possibly compromised; pushing malware1 people · 2 points · first shared 2015 · discussion on HN
- 14Large malvertising campaign hits popular Dutch websites1 people · 2 points · first shared 2016 · discussion on HN
- 15Unencrypted storage of confidential information in Keeper Password & Data Vault1 people · 2 points · first shared 2013 · discussion on HN
What HN people wrote when they linked it
sangnoir · 2015-12-15
> They probably have the skills to acquire it without contacting GitHub as well.
I'd say they definitely have the skills to acquire it, if QUANTUM {INSERT|DNS}[1] are still operational. As you said, it's probably not worth it.
1. http://blog.fox-it.com/2015/04/20/deep-dive-into-quantum-insert/
cpa · 2025-10-11
It helps against this kind of stuff (2015) https://blog.fox-it.com/2015/04/20/deep-dive-into-quantum-insert/
autoexec · 2023-02-24
Some older articles:
https://www.pcworld.com/article/435020/hackers-make-driveby-download-a…
https://money.cnn.com/2013/02/22/technology/security/nbc-com-hacked-ma…
https://blog.fox-it.com/2014/01/03/malicious-advertisements-served-via…
https://www.cbsnews.com/news/huffpo-readers-hit-with-ransomware-infect…
sitic · 2020-09-18
Apparently a lot of systems were backdoored in January (exploits were available before the patches), so even if the patches were installed right away the backdoor is still there [1]. The malware hackers are now slowly processing their long list of compromised systems.
[1] https://blog.fox-it.com/2020/07/01/a-second-look-at-cve-2019-19781-cit…
sneak · 2020-07-09
FYI: pervasive mass internet surveillance by the US military with the active cooperation of large US telcos AT&T, Verizon, and others already enables this capability in the US and much of the rest of the world.
The surveillance allows them to read the TCP sequence numbers or DNS query IDs, and then spoof valid response packets.
It’s called QUANTUMINSERT.
https://blog.fox-it.com/2015/04/20/deep-dive-into-quantum-insert/
saycheese · 2017-02-21
>> "The usage of HTTPS in combination with HSTS can reduce the effectiveness of QI. Also using a content delivery network (CDN) that offers low latency can make it very difficult for the QI packet to win the race with the real server."
Above is from the researchers:
https://blog.fox-it.com/2015/04/20/deep-dive-into-quantum-insert/
kbart · 2016-09-05
They used QUANTUM INSERT which is for HTTP not HTTPS. So they just needed to wait until someone accessed HTTP site. Here is more technical description on how QI works:
https://blog.fox-it.com/2015/04/20/deep-dive-into-quantum-insert/
4096 · 2015-04-23
The blog post with all the technical details: http://blog.fox-it.com/2015/04/20/deep-dive-into-quantum-insert/
And the Github account with the tools to do this yourself, PCAP and rules for snort, bro and suricata:
https://github.com/fox-it/quantuminsert
_nullandnull_ · 2014-10-16
It wasn't mentioned in the article but there was also a lot of controversy on how Microsoft handled the Operation B71.
http://blog.fox-it.com/2012/04/12/critical-analysis-of-microsoft-opera…
jacquesm · 2014-05-30
Yes, but that does not mean it does not happen and when a very large website gets used to deliver malware through advertising it can be very effective. Such as this top10 dutch website:
http://blog.fox-it.com/2012/03/16/post-mortem-report-on-the-sinowallnu…
thursley · 2014-04-08
Snort IDS rules to detect abuse can be found here:
http://blog.fox-it.com/2014/04/08/openssl-heartbleed-bug-live-blog/
deanclatworthy · 2014-01-08
It's a little alarming that one of the major online newspapers in the world can reveal such news, yet provide no substantial information on what the malware was, what platforms it infected, and how to detect if it's infiltrated your system, and furthermore remove it.
From what I read on the guardian, it seems that it's a Java-based exploit:
http://www.theguardian.com/technology/2014/jan/08/yahoo-malware-turned…
More info from the original source:
http://blog.fox-it.com/2014/01/03/malicious-advertisements-served-via-…
lelf · 2013-09-06
Some more evidence to the botnet theory: http://blog.fox-it.com/2013/09/05/large-botnet-cause-of-recent-tor-net…
angoragoats · 2024-02-05
Wow, aren't you the fallacy guy. Please, give me more fallacies! I should just change my username to fallaciousgoats.
How about this: I didn't use the word "knowingly" anywhere in my statement, and in fact I have no earthly idea whether the countless examples [1][2][3][4] of malware being served via ad networks on major websites was done knowingly. My guess is it wasn't?
So you've got the beginnings of a straw man fallacy here, questioning an argument that I never actually made.
If you'd like to learn more about why malware shows up on cross-site ad networks, there's a good quick read available at [5].
[1] https://news.ycombinator.com/item?id=17550808
[2] https://www.bleepingcomputer.com/news/security/hackers-abuse-google-ad…
[3] https://www.helpnetsecurity.com/2023/01/18/google-ads-increasingly-poi…
[4] https://blog.fox-it.com/2014/01/03/malicious-advertisements-served-via…
[5] https://theconversation.com/why-bad-ads-appear-on-good-websites-a-comp…