17 ms·

Keyloggers Injected in Web Trust Seal Supply Chain Attack

51 points by tastroder 7y ago

theandrewbailey 7y ago
Third-party Javascript considered harmful. Use SRI! https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
ga-vu 7y ago
Only 100 sites impacted: https://publicwww.com/websites/%22d20iczrsxk7wft.cloudfront.net%2Fbotwverified%2Fbadge.js%22/ https://publicwww.com/websites/%22d20iczrsxk7wft.cloudfront.... Appears these seals have died out.
- rtempaccount1 7y ago
  Glad to see they're dying out, they really did seem to me like an example of Security Theatre.
  - tyingq 7y ago
    These particular ones are $29.95/month, and don't appear to include any sort of scanning, verification, etc. So there's not even a "theater level" attempt to relate to security.
runnr_az 7y ago
Isn't it ironic, dontcha think?
rtempaccount1 7y ago
Another in the growing line of supply chain attacks. It's inevitable that as primary sites improve their security, attackers will seek to exploit other elements in the chain that might present easier targets. Given the number of 3rd party JavaScript files that commonly get loaded for things like tracking and analytics, it seems likely we'll see more of these kinds of sites getting targeted.
- good_fuck-em 7y ago
  3rd party JavaScript files that commonly get loaded for things like tracking and analytics Oh no! Not the megabytes upon megabytes of tracking scripts! What will we do without the tracking scripts???
codezero 7y ago
I use dnscrypt and log all my DNS queries, I'm pretty relieved to see that I've never looked up the domain used to exfiltrate the data! Gist of the unobfuscated code is here: https://gist.github.com/gwillem/4403a9caf6877d6276cf6fe834a0b48a https://gist.github.com/gwillem/4403a9caf6877d6276cf6fe834a0...
dontbenebby 7y ago
Trust seals are easily faked and train users to trust in band signaling (eg images of locks etc to mimic HTTPS, logos etc) instead of paying attention to the URL bar. They should be considered harmful with or without malicious javascript.

51 points by tastroder 7y ago

Third-party Javascript considered harmful. Use SRI! https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...

ga-vu 7y ago

Only 100 sites impacted: https://publicwww.com/websites/%22d20iczrsxk7wft.cloudfront.net%2Fbotwverified%2Fbadge.js%22/ https://publicwww.com/websites/%22d20iczrsxk7wft.cloudfront.... Appears these seals have died out.

rtempaccount1 7y ago
Glad to see they're dying out, they really did seem to me like an example of Security Theatre.
- tyingq 7y ago
  These particular ones are $29.95/month, and don't appear to include any sort of scanning, verification, etc. So there's not even a "theater level" attempt to relate to security.

runnr_az 7y ago

Isn't it ironic, dontcha think?

rtempaccount1 7y ago

Another in the growing line of supply chain attacks. It's inevitable that as primary sites improve their security, attackers will seek to exploit other elements in the chain that might present easier targets. Given the number of 3rd party JavaScript files that commonly get loaded for things like tracking and analytics, it seems likely we'll see more of these kinds of sites getting targeted.

good_fuck-em 7y ago
3rd party JavaScript files that commonly get loaded for things like tracking and analytics Oh no! Not the megabytes upon megabytes of tracking scripts! What will we do without the tracking scripts???

codezero 7y ago

I use dnscrypt and log all my DNS queries, I'm pretty relieved to see that I've never looked up the domain used to exfiltrate the data! Gist of the unobfuscated code is here: https://gist.github.com/gwillem/4403a9caf6877d6276cf6fe834a0b48a https://gist.github.com/gwillem/4403a9caf6877d6276cf6fe834a0...

dontbenebby 7y ago

Trust seals are easily faked and train users to trust in band signaling (eg images of locks etc to mimic HTTPS, logos etc) instead of paying attention to the URL bar. They should be considered harmful with or without malicious javascript.