3 ms·

Polykill Sites reported to be using cdn.polyfill.io (as of Feb 27,2024)

2 points by rolph 2y ago

rolph 2y ago
alitonium commented Jun 21, 2024 {For specific details: The compromised url is: https://cdn.polyfill.io/v2/polyfill.min.js Behavior: The first time a user, who uses a phone, open a website through an ads ( google ads or facebook ) with this link, it will redirect user to a malicious website. How it works: The request send to https://cdn.polyfill.io/v2/polyfill.min.js needs to match the following format: Request for the first time from a unique IP, with a unique User-Agent. User-Agent match that of a phone, we used an iphone's user agent ( Mozilla/5.0 (iPhone14,2; U; CPU iPhone OS 14_0 like Mac OS X) AppleWebKit/602.1.50 (KHTML, like Gecko) Version/10.0 Mobile/15E148 Safari/602.1 ). Referer from a reputable website that installed polyfill. Accept / Accept-Encoding gzip, deflate, br, zstd Delete all cookies The request will return the original polyfill code, appended with a piece of malicious code. This code will make a run javascript from https://www.googie-anaiytics.com/ga.js https://www.googie-anaiytics.com/ga.js , if the device is not a laptop. You can reproduce this multiple time on the same machine by changing User agent gently, (ex: change Mozilla/5.0 to Mozilla/6.0). Sometimes the server will just timeout or return code without the injection, but it should work most of the time. {malignant code as per comments https://github.com/alitonium https://github.com/alitonium} The javascript on https://www.googie-anaiytics.com/ga.js https://www.googie-anaiytics.com/ga.js will redirect users to a malicious website based on some condition. I cannot check this further due to the lack of time. The content of gooie is here https://pastebin.com/hAgtHd70 https://pastebin.com/hAgtHd70 in case they delete it. The code check for a number of conditions before running ( useragent, screen width, ...) to ensure it is a phone, the entry point is at the end: bdtjfg||cnzfg||wolafg||mattoo||aanaly||ggmana||aplausix||statcct?setTimeout(check_tiaozhuan,-0x4*0x922+0x1ebd+0xd9b):check_tiaozhuan(); The code has some protection built-in, so if it is run on a non-suitable environment, it will attempt to relocate a lot of memory to freeze the current devices. It also re-translate all attribute name access with _0x42bcd7 . At this point I think we can definitely conclude that the is a compromised CDN without having to further dig into the remaining obfuscated code.} https://github.com/polyfillpolyfill/polyfill-service/issues/2873 https://github.com/polyfillpolyfill/polyfill-service/issues/...
ssahoo 2y ago
DHS is trying to fight Chinese infiltration. https://www.theverge.com/2024/6/24/24185013/homeland-security-china-artificial-intelligence-priorities-memo-mayorkas https://www.theverge.com/2024/6/24/24185013/homeland-securit...
- deleted 2y ago
  [deleted]

2 points by rolph 2y ago

alitonium commented Jun 21, 2024 {For specific details: The compromised url is: https://cdn.polyfill.io/v2/polyfill.min.js Behavior: The first time a user, who uses a phone, open a website through an ads ( google ads or facebook ) with this link, it will redirect user to a malicious website. How it works: The request send to https://cdn.polyfill.io/v2/polyfill.min.js needs to match the following format: Request for the first time from a unique IP, with a unique User-Agent. User-Agent match that of a phone, we used an iphone's user agent ( Mozilla/5.0 (iPhone14,2; U; CPU iPhone OS 14_0 like Mac OS X) AppleWebKit/602.1.50 (KHTML, like Gecko) Version/10.0 Mobile/15E148 Safari/602.1 ). Referer from a reputable website that installed polyfill. Accept / Accept-Encoding gzip, deflate, br, zstd Delete all cookies The request will return the original polyfill code, appended with a piece of malicious code. This code will make a run javascript from https://www.googie-anaiytics.com/ga.js https://www.googie-anaiytics.com/ga.js , if the device is not a laptop. You can reproduce this multiple time on the same machine by changing User agent gently, (ex: change Mozilla/5.0 to Mozilla/6.0). Sometimes the server will just timeout or return code without the injection, but it should work most of the time. {malignant code as per comments https://github.com/alitonium https://github.com/alitonium} The javascript on https://www.googie-anaiytics.com/ga.js https://www.googie-anaiytics.com/ga.js will redirect users to a malicious website based on some condition. I cannot check this further due to the lack of time. The content of gooie is here https://pastebin.com/hAgtHd70 https://pastebin.com/hAgtHd70 in case they delete it. The code check for a number of conditions before running ( useragent, screen width, ...) to ensure it is a phone, the entry point is at the end: bdtjfg||cnzfg||wolafg||mattoo||aanaly||ggmana||aplausix||statcct?setTimeout(check_tiaozhuan,-0x4*0x922+0x1ebd+0xd9b):check_tiaozhuan(); The code has some protection built-in, so if it is run on a non-suitable environment, it will attempt to relocate a lot of memory to freeze the current devices. It also re-translate all attribute name access with _0x42bcd7 . At this point I think we can definitely conclude that the is a compromised CDN without having to further dig into the remaining obfuscated code.} https://github.com/polyfillpolyfill/polyfill-service/issues/2873 https://github.com/polyfillpolyfill/polyfill-service/issues/...

ssahoo 2y ago

DHS is trying to fight Chinese infiltration. https://www.theverge.com/2024/6/24/24185013/homeland-security-china-artificial-intelligence-priorities-memo-mayorkas https://www.theverge.com/2024/6/24/24185013/homeland-securit...

deleted 2y ago
[deleted]