3 ms·

i cant find any hits for "origin" or "CDN" on the original RiskIQ article: https://www.riskiq.com/blog/labs/magecart-british-airways-breach/ https://www.riskiq.

i cant find any hits for "origin" or "CDN" on the original RiskIQ article: https://www.riskiq.com/blog/labs/magecart-british-airways-breach/ https://www.riskiq.com/blog/labs/magecart-british-airways-br... the RiskIQ article identifies the location of the script as "the main website" additionally, I'm not sure how this would solve the problem. If BA went to all the effort of putting their frontend assets on a CDN, why wouldn't their HTML, with the hashes also be on the CDN? and if the hashes are not generated by the CDN, how does the server generate the hashes without being affected by changes on the CDN? regardless of outcome, if the process is automated, does a human being need to read a diff every time any file on any CDN changes? Can't an attacker then just wait until the hashes are automatically updated?

K0nserv 7y ago
Sorry I should have been clearer here. RiskIQ doesn't distinguish between the CDN and origin in their write up. That's an assumption on my part, I believe it be the case that the CMS that serves the JS file is different from the origin server that would be serving the checkout pages and other parts of the BA website. From a quick Google it looks like the CMS path on BA is just a file storage server of some kind. Most likely the origin server had a hardcoded reference to the CMS path(https://www.britishairways.com/cms/global/scripts/lib/modernizr-2.6.2.min.js https://www.britishairways.com/cms/global/scripts/lib/modern...) and if that had been done as <script type="text/javascript" src="https://www.britishairways.com/cms/global/scripts/lib/modernizr-2.6.2.min.js" integrity="sha384-5XrDTQbmmgpJKmfKW8outDDdYpRCnIf+nxX2nVR10NyWby6pPcujAELgWVmCu2P/"></script> I speculate the attack would not have been successful. For an extremely static resource like this it wouldn't have been complex to adopt SRI.

K0nserv 7y ago

Sorry I should have been clearer here. RiskIQ doesn't distinguish between the CDN and origin in their write up. That's an assumption on my part, I believe it be the case that the CMS that serves the JS file is different from the origin server that would be serving the checkout pages and other parts of the BA website. From a quick Google it looks like the CMS path on BA is just a file storage server of some kind. Most likely the origin server had a hardcoded reference to the CMS path(https://www.britishairways.com/cms/global/scripts/lib/modernizr-2.6.2.min.js https://www.britishairways.com/cms/global/scripts/lib/modern...) and if that had been done as <script type="text/javascript" src="https://www.britishairways.com/cms/global/scripts/lib/modernizr-2.6.2.min.js" integrity="sha384-5XrDTQbmmgpJKmfKW8outDDdYpRCnIf+nxX2nVR10NyWby6pPcujAELgWVmCu2P/"></script> I speculate the attack would not have been successful. For an extremely static resource like this it wouldn't have been complex to adopt SRI.