3 ms·
Yes and no. This issue was perhaps X lines of code away from accidentally transferring the contents of your files (or login email and password!) to Facebook, or
by dannyw 6y ago
Yes and no. This issue was perhaps X lines of code away from accidentally transferring the contents of your files (or login email and password!) to Facebook, or a malicious attacker.
For one, this highlights they don't have automated tests detecting arbitrary/malicious JS injection on their web app. This is a serious security risk: we are talking about your cloud filesystem here, and "spear phish / bribe your marketing intern to adding malicious.js" is a real attack vector.
Alarms should be going off internally whenever a new external JS file gets included in your webapp, either ststically or dynamically. Facebook pixel today, a malicious hacker tomorrow.
I'd expect a private cloud to have better security procedures than "wait till someone on Twitter discovers a bug".
(Personally, I will continue to use Backblaze, but just highlighting why it's a serious security concern.)
- jscheel 6y agoYou should not be backing up plaintext passwords to offsite storage anywhere. Or do you mean malicious JS capturing your form entry at login?
- dannyw 6y agoThat's what I mean. But the specific issue I see is that a piece of external JS got inserted into their web app, and their security team didn't realise it. The fact that its from GTM is no excuse: give me Google tag manager, I'll exfil your users data in an hour ;)
- jscheel 6y agoAhh, fair enough. They definitely snippets to be vetted by their security team. I'm sure they've learned from this mistake though, and I'm not sure I would trust anyone else any more than them.
- magicalhippo 6y agoIt would be far better if they described how they managed to let Google Tag Manager be included for so long, and how they've changed their deployment process to avoid third-party scripts from being included in the future.
- deleted 6y ago[deleted]
- brightball 6y agoOut of curiosity, do you have a recommendation of a tool / structure for an automated test to catch that type of injection? This is something I haven’t considered in my own pipeline that I’d like to address.
- kilburn 6y agoFor external files in particular you can use Content Security Policies [1] in the server configuration. Injecting third-party content then requires editing both your site and the server setup. Of course, you can make the policies more or less strict depending on how much you want to tighten this kind of attack vector. [1] https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
- peteretep 6y ago> This issue was perhaps X lines of code away from This is a weird metric.