Generally not a good idea to link directly to a hacked page.<p>There's a bit of code injected into the page near the bottom:<p><pre><code> document.write("<SCR"+"IPT TYPE='text/javascript' SRC='" + "http" + (window.location.protocol.indexOf('https:')==0?'s':'') + "://js.revsci.net/gateway/gw.js?csid=I07714' CHARSET='ISO-8859-1'"+"><\/SCR"+"IPT>");
</code></pre>
js.revsci.net seems to be redirecting some requests to localhost, so the code isn't loading for everyone. If it loads for you, you get redirected to a big "hacked by the Syrian Electronic Army etc. etc." page.<p>The location of the code doesn't look like it was from a malicious ad or social media thingy. Looks like it's near the bottom of the page template, so that's neat. It's embedded in other unrelated articles too.<p>edit: I was able to retrieve the content from elsewhere. It's up at <a href="http://pastebin.com/rzPeKKMH" rel="nofollow">http://pastebin.com/rzPeKKMH</a> -- it's not just doing a redirect, there's some funky stuff in there.
It wasn't a problem inside reuters, but their 3rd party provider called (Taboola), which injects ads on reuters. So once taboola hacked, the ads system started injecting a script to redirect that page to another one.<p>Source: <a href="https://medium.com/@FredericJacobs/the-reuters-compromise-by-the-syrian-electronic-army-6bf570e1a85b" rel="nofollow">https://medium.com/@FredericJacobs/the-reuters-compromise-by...</a>
It seems that Reuters has rectified the problem now. Previously it was redirecting to a page hosted by the Syrian Electronic Army.<p>Also a reminder to not link directly to hacked pages but to perhaps a screenshot and put the real link in the comments, as we don't know if there could be malicious javascript et al injected into the page.
Anybody have any idea about how they did it? Sorry for the noob question but I can't really figure out how they did it, since the original page loads fine and only after this there's some kind of redirect.<p>And as I can see it only affects certain pages so maybe there's a compromised component that's loaded on those pages?
I wrote a post about what happened: <a href="https://medium.com/@FredericJacobs/the-reuters-compromise-by-the-syrian-electronic-army-6bf570e1a85b" rel="nofollow">https://medium.com/@FredericJacobs/the-reuters-compromise-by...</a>