4 ms·
It looks like someone has compromised one of their subdomains for Polyfill Update: Subdomain seems to be returning normal responses again now.
by EKSolutions 2y ago
It looks like someone has compromised one of their subdomains for Polyfill
Update: Subdomain seems to be returning normal responses again now.
- Aachen 2y agoYou mean the IA included some JS polyfill from a subdomain and that's what's compromised / where the alert is coming from?
- mendym 2y agoYup. https://news.ycombinator.com/item?id=41792651 https://news.ycombinator.com/item?id=41792651
- EKSolutions 2y agoCorrect. The source subdomain of the popup seems to be hxxps[:]//polyfill[.]archive[.]org
- qnsc 2y agoyes, "https://polyfill.archive.org/v3/polyfill.min.js?features=fetch,IntersectionObserver,ResizeObserver,globalThis,Element.prototype.getAttributeNames,String.prototype.startsWith,Array.prototype.flat,Element.prototype.closest,Element.prototype.scroll,Element.prototype.remove,Object.entries,Object.values,Object.fromEntries https://polyfill.archive.org/v3/polyfill.min.js?features=fet..." is the URL with the malicious code
- Shadow1337 2y agoIt looks like it is running the service that was part of the supply chain attacker earlier this year. https://github.com/polyfillpolyfill/polyfill-service/issues/2890 https://github.com/polyfillpolyfill/polyfill-service/issues/...
- abracadaniel 2y agoThat was a DNS hack of polyfill.io though right? This looks like it was/is self hosted.
- jsheard 2y agoThe service was fine, it was the "official" hosted instance of the service which was compromised. IA appears to be running their own instance.
- __jonas 2y agoYeah I'm getting this exact response from the above URL now: https://sourcegraph.com/github.com/polyfillpolyfill/polyfill-service/-/blob/library/src/get_polyfill_string.rs?L415 https://sourcegraph.com/github.com/polyfillpolyfill/polyfill... Seems like they self hosted that service
- jrochkind1 2y agoThat would perhaps explain how they managed to inject the JS alert popup, right?
- TZubiri 2y agoYeah, but the leak has been confirmed by HIBP, I found my address in there.
- jrochkind1 2y agoDOH. I hadn't heard this.