########################################################################################## ADBLK-14: Block all other known DataSpii associated domains ########################################################################################## Issue Type: Task ----------------------------------------------------------------------------------------- Issue Information ==================== Priority: Major Status: Closed Resolution: Done (2019-07-19 15:13:05) Project: Adblock Lists (ADBLK) Reported By: btasker Assigned To: btasker Time Estimate: 0 minutes Time Logged: 0 minutes ----------------------------------------------------------------------------------------- Issue Description ================== Yesterday, two zones were quickly blocked as a result of being related to the DataSpii case. The commit (https://github.com/bentasker/adblocklists/commit/5a90d2cf4e40eaba383e0d8a0c17b6e7b0618268) blocked - adclarity.com - adcint.net (the commit also accidentally picked up a previously uncommitted change. oops). The second zone was blocked because the former CNAME's into it -- BEGIN SNIPPET -- $ host pnldsk.adclarity.com pnldsk.adclarity.com is an alias for pnldsk.adcint.net. pnldsk.adcint.net has address 209.126.124.242 -- END SNIPPET -- Both domains are associated with the company Adclarity - an Israeli marketing intelligence (read tracking) company. They, however, were just a conduit for the DataSpii issue, and many more domains were involved. DataSpii is described as -- BEGIN QUOTE -- DataSpii is the catastrophic data leak that occurred when any one of eight browser extensions collects browsing activity data — including personally identifiable information (PII) and corporate information (CI) — from unwitting Chrome and Firefox users. This data was then disseminated to members of an online service, where it may have been appropriated or exploited by any member. -- END QUOTE -- Extensions known to be involved (i.e. sending data) are - Hover Zoom - SpeakIt! - SuperZoom - SaveFrom.net Helper - Fairshare Unlock - PanelMeasurement - Branded Surveys - Panel Community Surveys Extensions have been observed surreptiously submitting all visited URLs (and in some cases, all URLs visible *within* pages visited), ultimately resulting in those URLs being processed by Nacho Analytics. Some of the extensions listed deployed measures to try and evade detection, including waiting (on average) 24 days after install to start submitting browsing data. URL strings have been found, in some cases, to contain PII. An indicator file has been made available here - https://securitywithsam.com/dataspii-latest.ioc - containing all the currently known hostnames associated with this serious data leak. This issue is being raised to track taking that file, extracting the domains and adding them into the blocking list. ----------------------------------------------------------------------------------------- Issue Relations ================ - DataSpii Report (https://securitywithsam.com/2019/07/dataspii-leak-via-browser-extensions/) - DataSpii.com (https://dataspii.com/) - Ars Technica Coverage (https://arstechnica.com/information-technology/2019/07/dataspii-inside-the-debacle-that-dished-private-data-from-apple-tesla-blue-origin-and-4m-people/) - Ars Technica Technical Writeup (https://arstechnica.com/information-technology/2019/07/dataspii-technical-deep-dive/) ----------------------------------------------------------------------------------------- Activity ========== ----------------------------------------------------------------------------------------- 2019-07-19 13:56:39 btasker ----------------------------------------------------------------------------------------- Ok, domains are -- BEGIN SNIPPET -- ben@thor:/tmp$ grep -A 1 "Network/Network/DNS" dataspii-latest.ioc | grep "type='string'" | grep -o -P ">[^<]+" | sed 's/>//g' cr-input.hvrzm.com cr-input.ebehaviors.com cr-input.panelmeasurement.com cr-input.superzoom.net cr-input.getspeakit.com cr-input.mxpnl.net ff-input.mxpnl.net ff-input.ebehaviors.com ff-input.superzoom.net p.ymnx.co pnldsk.adclarity.com -- END SNIPPET -- Current resolution results are as follows -- BEGIN SNIPPET -- ben@thor:/tmp$ for i in `grep -A 1 "Network/Network/DNS" dataspii-latest.ioc | grep "type='string'" | grep -o -P ">[^<]+" | sed 's/>//g'`; do host $i; done cr-input.hvrzm.com has address 52.54.192.223 cr-input.hvrzm.com has address 52.54.15.252 cr-input.ebehaviors.com has address 52.54.192.223 cr-input.ebehaviors.com has address 52.54.15.252 cr-input.panelmeasurement.com has address 52.54.192.223 cr-input.panelmeasurement.com has address 52.54.15.252 cr-input.superzoom.net has address 52.54.15.252 cr-input.superzoom.net has address 52.54.192.223 cr-input.getspeakit.com has address 52.54.192.223 cr-input.getspeakit.com has address 52.54.15.252 cr-input.mxpnl.net has address 52.54.15.252 cr-input.mxpnl.net has address 52.54.192.223 ff-input.mxpnl.net has address 52.54.15.252 ff-input.mxpnl.net has address 52.54.192.223 ff-input.ebehaviors.com has address 52.54.192.223 ff-input.ebehaviors.com has address 52.54.15.252 ff-input.superzoom.net has address 52.54.192.223 ff-input.superzoom.net has address 52.54.15.252 p.ymnx.co is an alias for p.qljx.co. p.qljx.co is an alias for panelendpoint-1375964790.us-east-1.elb.amazonaws.com. panelendpoint-1375964790.us-east-1.elb.amazonaws.com has address 52.1.127.70 panelendpoint-1375964790.us-east-1.elb.amazonaws.com has address 50.16.68.239 pnldsk.adclarity.com is an alias for pnldsk.adcint.net. pnldsk.adcint.net has address 209.126.103.247 -- END SNIPPET -- ----------------------------------------------------------------------------------------- 2019-07-19 13:59:47 git ----------------------------------------------------------------------------------------- -- BEGIN QUOTE -- Repo: adblocklists Commit: 7b588cca8ae5b65c92462c2fa6ff26d14c9bd264 Author: B Tasker