3 ms·
For those who are wondering what happened, an attacker loaded malicious JavaScript through some compromised third party library. This isn't unique to cryptocur
by jrpt 7y ago
For those who are wondering what happened, an attacker loaded malicious JavaScript through some compromised third party library.
This isn't unique to cryptocurrency, although the permanence of crypto transactions makes it pretty concerning there. Similar Magecart type attacks have been stealing credit card numbers from websites including British Airways, Ticketmaster, or Macy's, right off the checkout page.
Most sites still would have no idea if this were to happen to them today.
That’s why I’ve developed Enchanted Security (https://enchantedsecurity.com/ https://enchantedsecurity.com/) - a client-side firewall that tracks the network requests and even blocks malicious ones. It’s like a network firewall but running on your users’ browsers. It can run on other JS platforms too, like Electron or React Native, which are commonly used for crypto wallets. Get in touch if you’re interested in learning more.
- bawolff 7y agoBit of an unfair comparison there with csp on your website there. You cite the article that most csp policies are ineffective at preventing xss, but xss and data exfilitration are different things, and csp policies that are ineffective at blocking xss are often effective at blocking data exfiltration.