jQuery hacked: Site was hit, but not the library

While there is no evidence yet if the server (code.jquery.com) that host jQuery file was also compromised, The Hacker News took a screenshot (as shown above) and can confirm that the hackers merely published a simple blog post to deface the website.

The defaced blog post URL — http://blog.jquery.com/2017/10/26/hacked/ (now removed).

Since the above-mentioned blog post was published under the name of Leah Silber, a core member of jQuery team, it seems hackers were able to make their post live by compromising Silber’s account—probably by reusing her password leaked in a previous data breach.

If not, the hackers might have gained unauthorized access to the website either by exploiting a (known or zero-day) vulnerability in WordPress script or the server.

jQuery team has immediately removed the post created by the hackers as soon as they realized there was a compromise, but so far the organisation has not released any official statement about the incident.

This is not the first time when jQuery’s website has been compromised. In 2014, the main domain (jQuery.com) was reportedly compromised, redirecting the site’s visitors to a page hosting an exploit kit.

Since millions of websites directly use jQuery script hosted by jQuery server, today’s attack could be worse if the hackers would have been able to compromised code.jquery.com in an attempt to replace the official jQuery file with the malicious one, putting billions of visitors of millions of websites at risk of malware attacks.

A similar incident took place yesterday, when a hacker managed to replace official JavaScript file hosted by Coinhive—a popular browser-based cryptocurrency miner—with a modified version that eventually tricked CPUs of millions of visitors of thousands of websites to mine cryptocurrencies for the hacker unknowingly.

Interestingly, Coinhive was also hacked via password reuse attack, allowing the attacker to gain its CloudFlare account and change DNS settings unauthorizedly.