3 ms·

It looks like `--script` is just an arbitrary string, it is only executed because a real `<script>` tag retrieves the property and evals it through `(new Functi

• mrtksn 6y ago
  Why there's "new Function()" that looks for CSS computed styles with "--script"? Is this some pattern with a popular JS framework?
  • bawolff 6y ago
    New Function() is just another name for eval(). It has nothing specificly to do with css.
    • mrtksn 6y ago
      Okay but what is the purpose of this code? why would you eval() CSS?
      • ryanlol 6y ago
        The purpose of the code is to steal credit cards. > why would you eval() CSS? It’s really as simple as “because you can”. This is just an obfuscation technique.
        • mrtksn 6y ago
          From my understanding, the code that the devs wrote is not to steal credit cards but to create some UI, however they do it in such a way that JS hidden in CSS that would normally won't run. gets run and which results in credit cards being stolen.
          • ryanlol 6y ago
            You can see the code in the tweet linked earlier. The hackers injected a small JS snippet on the page that fetches the value of —script from the CSS and evals it.b
            • mrtksn 6y ago
              Why would they fetch --script from CSS instead of getting the information from the DOM and sending it to their serves straight away if the can already put a JS on the page that gets executed?
              • ryanlol 6y ago
                This is an obfuscation technique, it’s not supposed to make sense.
                • mrtksn 6y ago
                  Oh O.K, so it's not a CSS hack. I thought it's something smarter like exploiting a JS pattern to trick it to run JS from CSS. So, the hackers need to have access both to CSS and HTML to put the malicious JS that looks innocent in the HTML and load the malicious JS from the CSS. Now it makes sense, thanks.
                  • bawolff 6y ago
                    Which honestly seems like a pretty bad obfuscation technique. Loading a string from a css file and then executing as js is suspicious af. There is literally no reason to ever do that normally.
                    • saagarjha 6y ago
                      Of course, detecting this in general is not easy to do.
    • emnudge 6y ago
      Quick correction: it is not the same as eval. It does not have access to the current scope. It is technically a fair bit safer when trying to run code from a string. It may have access to the window object, however, so if something important is there, if can probably mess with that.
      • bawolff 6y ago
        Its pretty hard to imagine a situation where full access to the global scope (including DOM) is fine as long as the attacker doesn't have access to the current function's scope. Performance difference, sure, but safety difference is pretty far fetched.
  • ryanlol 6y ago
    Because the skimmer developer wanted to obfuscate their code a little?
  • diggan 6y ago
    As I understand it: --script is just the name of the variable. JS has the ability to look up variables from CSS. --script could have been --helloworld, think of it as a selector (if you're more familiar with CSS than JS), which is then grabbed and evaled by the JS code. > Is this some pattern with a popular JS framework? I've never seen this anywhere before, JS grabbing values from CSS, but I mostly done ClojureScript development for the last 2 years.
  • wut42 6y ago
    It doesn't look for `--script`. The hackers just retrieve the value of the `--script` value in JS and pass it to `new Function()`.
• SftwreEngnr 6y ago
  Do you think your severe autism caused you to create your username, or was it sheer arrogance?