4 ms·
The purpose of the code is to steal credit cards. > why would you eval() CSS? It’s really as simple as “because you can”. This is just an obfuscation techniqu
by ryanlol 6y ago
The purpose of the code is to steal credit cards.
> why would you eval() CSS?
It’s really as simple as “because you can”. This is just an obfuscation technique.
- mrtksn 6y agoFrom my understanding, the code that the devs wrote is not to steal credit cards but to create some UI, however they do it in such a way that JS hidden in CSS that would normally won't run. gets run and which results in credit cards being stolen.
- ryanlol 6y agoYou can see the code in the tweet linked earlier. The hackers injected a small JS snippet on the page that fetches the value of —script from the CSS and evals it.b
- mrtksn 6y agoWhy would they fetch --script from CSS instead of getting the information from the DOM and sending it to their serves straight away if the can already put a JS on the page that gets executed?
- ryanlol 6y agoThis is an obfuscation technique, it’s not supposed to make sense.
- mrtksn 6y agoOh O.K, so it's not a CSS hack. I thought it's something smarter like exploiting a JS pattern to trick it to run JS from CSS. So, the hackers need to have access both to CSS and HTML to put the malicious JS that looks innocent in the HTML and load the malicious JS from the CSS. Now it makes sense, thanks.