4 ms·

Publishers should use AdSafe[1], which is a system for sandboxing widgets. AdSafe provides widget authors an API for access object properties and the DOM, as we

Publishers should use AdSafe[1], which is a system for sandboxing widgets. AdSafe provides widget authors an API for access object properties and the DOM, as well as a static check to ensure that widgets are using this API properly. Given that the static check passes, and the library implementing the API is correct, then your widget is properly sandboxed and attacks like that can't happen. Check out the AdSafety paper[2] for more details about the extent to which AdSafe has been verified. Disclosure: I'm an author on the paper. EDIT: Here's a great talk by Arjun on AdSafety: https://www.usenix.org/conference/usenix-security-11/adsafety-type-based-verification-javascript-sandboxing https://www.usenix.org/conference/usenix-security-11/adsafet... [1]: http://www.adsafe.org/ http://www.adsafe.org/ [2]: http://cs.brown.edu/research/plt/dl/adsafety/v1 http://cs.brown.edu/research/plt/dl/adsafety/v1

bentlegen 13y ago
AFAIK, there was nothing vulnerable in the widget itself: the hackers accessed Outbrain's admin panel, and changed the content of their recommended links to point to their website instead. The hackers posted screenshots of accessing the admin panel: http://mashable.com/2013/08/15/outbrain-hacked/ http://mashable.com/2013/08/15/outbrain-hacked/
- seliopou 13y ago
  What was reported[1] was that certain stories were redirecting users to the SEA's site. This implies that they weren't just rewriting recommended links, but were changing the code of the widgets, which resulted in that behavior. [1]: http://www.politico.com/blogs/media/2013/08/washington-post-hacked-170594.html http://www.politico.com/blogs/media/2013/08/washington-post-...
  - bentlegen 13y ago
    Ah, you're right. This screenshot actually shows the HTML they injected: http://rack.0.mshcdn.com/media/ZgkyMDEzLzA4LzE1L2E1L3RpbWVzYWZmZWN0Ljg0OWQ0LmpwZwpwCXRodW1iCTEyMDB4OTYwMD4/ac8169ff/d19/times-affected-outbrain-admin-panel.jpg http://rack.0.mshcdn.com/media/ZgkyMDEzLzA4LzE1L2E1L3RpbWVzY...
showerst 13y ago
Are there projects like this that let me embed a third-party URL instead of direct code? So if a publisher provides me with a link to widget.js, I could just run some sort of Adsafe.executeInWrapper(http://example.com/widget.js http://example.com/widget.js) Most providers in my experience don't want you to embed their actual JS code, because then they lose the ability to do updates and fix bugs without contacting every single customer to upgrade.

bentlegen 13y ago

AFAIK, there was nothing vulnerable in the widget itself: the hackers accessed Outbrain's admin panel, and changed the content of their recommended links to point to their website instead. The hackers posted screenshots of accessing the admin panel: http://mashable.com/2013/08/15/outbrain-hacked/ http://mashable.com/2013/08/15/outbrain-hacked/

seliopou 13y ago
What was reported[1] was that certain stories were redirecting users to the SEA's site. This implies that they weren't just rewriting recommended links, but were changing the code of the widgets, which resulted in that behavior. [1]: http://www.politico.com/blogs/media/2013/08/washington-post-hacked-170594.html http://www.politico.com/blogs/media/2013/08/washington-post-...
- bentlegen 13y ago
  Ah, you're right. This screenshot actually shows the HTML they injected: http://rack.0.mshcdn.com/media/ZgkyMDEzLzA4LzE1L2E1L3RpbWVzYWZmZWN0Ljg0OWQ0LmpwZwpwCXRodW1iCTEyMDB4OTYwMD4/ac8169ff/d19/times-affected-outbrain-admin-panel.jpg http://rack.0.mshcdn.com/media/ZgkyMDEzLzA4LzE1L2E1L3RpbWVzY...

showerst 13y ago

Are there projects like this that let me embed a third-party URL instead of direct code? So if a publisher provides me with a link to widget.js, I could just run some sort of Adsafe.executeInWrapper(http://example.com/widget.js http://example.com/widget.js) Most providers in my experience don't want you to embed their actual JS code, because then they lose the ability to do updates and fix bugs without contacting every single customer to upgrade.