4 ms·
In this specific case the attackers seems to have compromised a CMS which for some reason was used to serve javascript libraries. It’s likely that they did not
by K0nserv 7y ago
In this specific case the attackers seems to have compromised a CMS which for some reason was used to serve javascript libraries. It’s likely that they did not compromise the origin itself, only the CMS. Thus using SRI on the origin would have prevented or at least drastically complicated the attack. As a general pattern CSP and SRI are very effective protection against CDN compromises and XSS. With CSP and SRI the stack surface is reduced significantly.
- zemnmez 7y agothe URI: http://www.britishairways.com/cms/global/scripts/lib/modernizr-2.6.2.min.js http://www.britishairways.com/cms/global/scripts/lib/moderni... doesn't look like its on a CDN
- K0nserv 7y agoIt looks like a CMS that is being repurposed as a CDN. I would bet the path https://www.britishairways.com/cms/ https://www.britishairways.com/cms/ resolves via a gateway to a different set of servers than the main BA site. So for all intents and purposes it’s a CDN