Top all-time · #2343
Fox-IT International blog
Company blog · blog.fox-it.comsecurity
Fox-IT International blog is the company blog at blog.fox-it.com, writing about security. Since 2011, 33 different Hacker News readers have linked it 38 times, most often “Deep dive into QUANTUM INSERT”. It is still writing: the last post was on 2026-10-13, and you can follow it by feed.
Too few sampled comments (15) to say how often HN recommends it.?
Why HN links it
HN readers cite this Fox-IT security blog as a technical source, mainly its 2015 deep-dive into NSA QUANTUM INSERT attacks, plus posts on malvertising, botnets and the NBC.com Citadel infection.
Summarised by Claude from a sample of 15 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
News and opinions from Fox-IT
Most-linked posts?
- /2015/04/20/deep-dive-into-quantum-insert/4 people · 4 mentions · first linked 2016-09-05
- Deep dive into QUANTUM INSERT3 people · 3 mentions · first linked 2015-04-22
- Malicious advertisements served via Yahoo2 people · 2 mentions · first linked 2014-01-04
- Critical analysis of Microsoft Operation B71 (Zeus Botnet disruption)2 people · 2 mentions · first linked 2012-04-12
- /2014/01/03/malicious-advertisements-served-via-yahoo/2 people · 2 mentions · first linked 2023-02-24
- Identifying Cobalt Strike team servers in the wild2 people · 2 mentions · first linked 2019-02-26
- Large botnet cause of recent Tor network overload2 people · 2 mentions · first linked 2013-09-05
- Heartbleed – test, advice and impact2 people · 2 mentions · first linked 2014-04-08
- CryptoPHP: Analysis of a hidden threat inside popular content management systems2 people · 2 mentions · first linked 2014-11-24
What Hacker News says?
Snort IDS rules to detect abuse can be found here: http://blog.fox-it.com/2014/04/08/openssl-heartbleed-bug-liv...
Comment linking /2014/04/08/openssl-heartbleed-bug-live-blog/
on “The Heartbleed Bug”Submitted Large botnet cause of recent Tor network overload as a story · 79 points
HN discussionFYI: pervasive mass internet surveillance by the US military with the active cooperation of large US telcos AT&T, Verizon, and others already enables this capability in the US and much of the rest of the world. The surveillance allows them to read the TCP sequence numbers or DNS query IDs, and then spoof valid response packets. It’s called QUANTUMINSERT. https://blog.fox-it.com/2015/04/20/deep-dive-into-quantum-in...
Comment linking /2015/04/20/deep-dive-into-quantum-insert/
on “New German law would force ISPs to allow secret service to install trojans”Submitted CryptoPHP: Analysis of a hidden threat inside popular content management systems as a story · 11 points
HN discussionWow, aren't you the fallacy guy. Please, give me more fallacies! I should just change my username to fallaciousgoats. How about this: I didn't use the word "knowingly" anywhere in my statement, and in fact I have no earthly idea whether the countless examples [1][2][3][4] of malware being served via ad networks on major websites was done knowingly. My guess is it wasn't? So you've got the beginnings of a straw man f…
Comment linking /2014/01/03/malicious-advertisements-served-via-yahoo/
on “Netflix: Piracy is difficult to compete against and growing rapidly”Submitted Deep dive into QUANTUM INSERT as a story · 8 points
HN discussionThey used QUANTUM INSERT which is for HTTP not HTTPS. So they just needed to wait until someone accessed HTTP site. Here is more technical description on how QI works: https://blog.fox-it.com/2015/04/20/deep-dive-into-quantum-in...
Comment linking /2015/04/20/deep-dive-into-quantum-insert/
on “NSA Hacked French President’s House”Submitted Detection and recovery of NSA’s covered up tracks as a story · 6 points
HN discussionApparently a lot of systems were backdoored in January (exploits were available before the patches), so even if the patches were installed right away the backdoor is still there [1]. The malware hackers are now slowly processing their long list of compromised systems. [1] https://blog.fox-it.com/2020/07/01/a-second-look-at-cve-2019...
Comment linking /2020/07/01/a-second-look-at-cve-2019-19781-citrix-netscaler-adc/
on “Woman dies during a ransomware attack on a German hospital”Submitted Malvertising on Java.com as a story · 6 points
HN discussionIt wasn't mentioned in the article but there was also a lot of controversy on how Microsoft handled the Operation B71. http://blog.fox-it.com/2012/04/12/critical-analysis-of-micro...
Comment linking /2012/04/12/critical-analysis-of-microsoft-operation-b71/
on “How Microsoft Appointed Itself Sheriff of the Internet”Submitted Compromising IPv4 networks via IPv6 as a story · 4 points
HN discussionYes, but that does not mean it does not happen and when a very large website gets used to deliver malware through advertising it can be very effective. Such as this top10 dutch website: http://blog.fox-it.com/2012/03/16/post-mortem-report-on-the-...
Comment linking /2012/03/16/post-mortem-report-on-the-sinowallnu-nl-incident/
on “No more ads”Submitted Malicious advertisements served via Yahoo as a story · 3 points
HN discussion> They probably have the skills to acquire it without contacting GitHub as well. I'd say they definitely have the skills to acquire it, if QUANTUM {INSERT|DNS}[1] are still operational. As you said, it's probably not worth it. 1. http://blog.fox-it.com/2015/04/20/deep-dive-into-quantum-ins...
Comment linking /2015/04/20/deep-dive-into-quantum-insert/
on “Gaffer: Large-scale graph database by GCHQ”Submitted Large malvertising campaign hits popular Dutch websites as a story · 2 points
HN discussion>> "The usage of HTTPS in combination with HSTS can reduce the effectiveness of QI. Also using a content delivery network (CDN) that offers low latency can make it very difficult for the QI packet to win the race with the real server." Above is from the researchers: https://blog.fox-it.com/2015/04/20/deep-dive-into-quantum-in...
Comment linking /2015/04/20/deep-dive-into-quantum-insert/
on “Time to Encrypt the Cloud”Submitted Website of security certification provider spreading ransomware as a story · 2 points
HN discussionSome more evidence to the botnet theory: http://blog.fox-it.com/2013/09/05/large-botnet-cause-of-rece...
Comment linking /2013/09/05/large-botnet-cause-of-recent-tor-network-overload/
on “How to handle millions of new Tor clients”Submitted Google ads reseller possibly compromised; pushing malware as a story · 2 points
HN discussionThe blog post with all the technical details: http://blog.fox-it.com/2015/04/20/deep-dive-into-quantum-ins... And the Github account with the tools to do this yourself, PCAP and rules for snort, bro and suricata: https://github.com/fox-it/quantuminsert
Comment linking /2015/04/20/deep-dive-into-quantum-insert/
on “How to Detect Sneaky N.S.A. ‘Quantum Insert’ Attacks”Submitted CryptoPHP: Analysis of a hidden threat inside popular content management systems as a story · 2 points
HN discussionWriteup of the network monitoring service that discovered the infection: http://blog.fox-it.com/2013/02/21/writeup-on-nbc-com-distrib...
Comment linking /2013/02/21/writeup-on-nbc-com-distributing-citadel-malware/
on “NBC.com hacked, serving up Citadel malware”Submitted Unencrypted storage of confidential information in Keeper Password & Data Vault as a story · 2 points
HN discussionIt helps against this kind of stuff (2015) https://blog.fox-it.com/2015/04/20/deep-dive-into-quantum-in...
Comment linking /2015/04/20/deep-dive-into-quantum-insert/
on “Does anyone remember websites?”Submitted Demystifying Pobelka; A technical intelligence report on the Pobelka botnet as a story · 2 points
HN discussionSome older articles: https://www.pcworld.com/article/435020/hackers-make-driveby-... https://money.cnn.com/2013/02/22/technology/security/nbc-com... https://blog.fox-it.com/2014/01/03/malicious-advertisements-... https://www.cbsnews.com/news/huffpo-readers-hit-with-ransomw...
Comment linking /2014/01/03/malicious-advertisements-served-via-yahoo/
on “The FBI now recommends using an ad blocker when searching the web”Submitted Critical analysis of Microsoft Operation B71 (Zeus Botnet disruption) as a story · 2 points
HN discussionIt's a little alarming that one of the major online newspapers in the world can reveal such news, yet provide no substantial information on what the malware was, what platforms it infected, and how to detect if it's infiltrated your system, and furthermore remove it. From what I read on the guardian, it seems that it's a Java-based exploit: http://www.theguardian.com/technology/2014/jan/08/yahoo-malw... More info fr…
Comment linking /2014/01/03/malicious-advertisements-served-via-yahoo/
on “Yahoo malware enslaves PCs to Bitcoin mining”Submitted RSA-512 Certificates abused in the wild as a story · 2 points
HN discussion
