Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Harvesting credit card numbers and passwords from websites

medium.com

Post reply on HN
Print view View original

21–30 of 128 posts

Re: Harvesting credit card numbers and passwords from websites

#21

Post by jarofgreen »

nikanj wrote: post #17
jarofgreen wrote: post #14

> Our penetration testers would see it in their HTTP request monitoring tools! > What hours do they work? My code doesn’t send anything between 7am and 7pm. Which Time Zone? Hah! (Not that this one nit pick takes away from the general very well made point of the article, I just love how TimeZone problems infect everything )

The browser’s? People do tend to keep their PC in the local timezone.

I wonder how much pen testing is done by hand and how much by automatic tools?

Anyway, I'm being pedantic. There are a lot of great points in this article.

Re: Harvesting credit card numbers and passwords from websites

#22

Post by saryant »

fny wrote: post #16

Couldn't one circumvent CSP by sending the data to a legitimate analytics service that everyone uses like Google Analytics?

This is why, when I recently built a credit card form, we didn't include any trackers or third-party code (beyond our vendor's). No dependencies at all—our vendor also has no dependencies in the JS we use to implement the CC form.

That did mean no jQuery, no Google Analytics, no NPM modules and we had to build it as a standalone page outside our React setup, but it's worth it to be able to definitively inspect every line of code and provide a CSP that locks that page down tight to just our subdomain and our vendor's.

Re: Harvesting credit card numbers and passwords from websites

#24

Post by danschumann »

jarofgreen wrote: post #14

> Our penetration testers would see it in their HTTP request monitoring tools! > What hours do they work? My code doesn’t send anything between 7am and 7pm. Which Time Zone? Hah! (Not that this one nit pick takes away from the general very well made point of the article, I just love how TimeZone problems infect everything )

I would think a good tool for pen testers could be one that runs all day, refreshing the same page occassionaly, after clearing everything, and reports any requests that differ from request to request.

Re: Harvesting credit card numbers and passwords from websites

#26

Post by danschumann »

What if the author snuck his code into frontend modules, and also snuck his code into backend modules?

If CSP is enabled, the frontend checks to see if the backend code has opened up the particular port or route on the backend.

The back-end code could sniff through require.cache to see if he could hook into the existing server instance ( same port ), or open a new port ( depending on CSP ).

I suppose the CSP equivalent on the backend is some sort of firewall. I also suppose servers have better monitoring of requests. Still, this method would circumvent CSP!!!

Also, hooking into the existing server instance would throw red flags if the instance was ever console.logged. You might also do an audit of your ports and see a suspicious one opened in that method. And a firewall likely would block other ports. But, still, it's feasible even with a CSP, until discovered.

Re: Harvesting credit card numbers and passwords from websites

#27

Post by danschumann »

danschumann wrote: post #26

What if the author snuck his code into frontend modules, and also snuck his code into backend modules? If CSP is enabled, the frontend checks to see if the backend code has opened up the particular port or route on the backend. The back-end code could sniff through require.cache to see if he could hook into the existing server instance ( same port ), or open a new port ( depending on CSP ). I suppose the CSP equivale…

Actually, a main question is this: can npm modules read require.cache? If so, why? Can they require code outside of the npm modules folder. Again, why? Couldn't any npm module steal your credentials, and suffer from the same source minification/github custody stuff?

Take an npm module. It does setInterval and every minute, it checks require.cache for any file with 'config' in it, and sends it to the crook. Is this possible currently?

I would think npm modules should be require-sandboxed to their own directory. Even then, there is compiled code, etc. Oy vey.

Re: Harvesting credit card numbers and passwords from websites

#28

Post by saryant »

danschumann wrote: post #26

What if the author snuck his code into frontend modules, and also snuck his code into backend modules? If CSP is enabled, the frontend checks to see if the backend code has opened up the particular port or route on the backend. The back-end code could sniff through require.cache to see if he could hook into the existing server instance ( same port ), or open a new port ( depending on CSP ). I suppose the CSP equivale…

He'd have to somehow make outbound requests from the server. IIRC, the default AWS VPC config would prevent this. Not sure about other cloud environments.

Where I work, outbound requests must be made through proxy servers which have a whitelisted set of allowed domains, which is only allowed after a security review.

Re: Harvesting credit card numbers and passwords from websites

#30

Post by vjeux »

danschumann wrote: post #27
danschumann wrote: post #26

What if the author snuck his code into frontend modules, and also snuck his code into backend modules? If CSP is enabled, the frontend checks to see if the backend code has opened up the particular port or route on the backend. The back-end code could sniff through require.cache to see if he could hook into the existing server instance ( same port ), or open a new port ( depending on CSP ). I suppose the CSP equivale…

Actually, a main question is this: can npm modules read require.cache? If so, why? Can they require code outside of the npm modules folder. Again, why? Couldn't any npm module steal your credentials, and suffer from the same source minification/github custody stuff? Take an npm module. It does setInterval and every minute, it checks require.cache for any file with 'config' in it, and sends it to the crook. Is this po…

You don’t need to do such complex things. You can just require(‘child_process’).execSync(‘any shell command’) with all the user credentials.
Post reply on HN