4 ms·

I fail to see how this attack has anything to do with http? The scripts can be served over https no problem, it’s the host that is compromised. Maybe you’re thi

by jiofih 7y ago

I fail to see how this attack has anything to do with http? The scripts can be served over https no problem, it’s the host that is compromised. Maybe you’re thinking of sub-resource integrity attributes?

RL_Quine 7y ago
The cannon is injected into HTTP resources.
- onesmallcoin 7y ago
  In most javascript sandboxes if you request a domain from an site you are restricted by the same content policy. This makes it harder to do things like make requests to sites for example that don't use https when your on one that does use it. https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy https://developer.mozilla.org/en-US/docs/Web/Security/Same-o...
nihonium 7y ago
It's injecting the malicious script into the source of http pages. With httpS, this is not possible unless you also change the root certificate of the computer.
Ruthalas 7y ago
From the article : "Mitigations These attacks would not be successful if the following resources were served over HTTPS instead of HTTP: http://push.zhanzhang.baidu.com/push.js; http://push.zhanzhang.baidu.com/push.js; orhttp://js.passport.qihucdn.com/11.0.1.js http://js.passport.qihucdn.com/11.0.1.js You may want to consider blocking these URLs when not sent over HTTPS."