Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I got XSS’d by my ad network

troyhunt.com

Post reply on HN
Print view View original

11–20 of 62 posts

Re: How I got XSS’d by my ad network

#11

Post by mayrun »

leni536 wrote: post #7
proactivesvcs wrote: post #4

"When you allow third parties to run script on your site, you’re entirely beholden to them; they can run anything they like in the context of your site" I've seen a fair few Internet banking web sites pulling scripts from over a dozen third parties, mostly for tracking and advertising, but even for trivial things like social media. On their customer login pages. It's beyond me how they can consider this to be an acce…

I wonder how many websites' users would be compromised if code.jquery.com got hacked.

doesnt have to be literally "hacked", just a change of the dns records is enough.

Re: How I got XSS’d by my ad network

#12

Post by leni536 »

mayrun wrote: post #11
leni536 wrote: post #7

Earlier quoted context omitted.

I wonder how many websites' users would be compromised if code.jquery.com got hacked.

doesnt have to be literally "hacked", just a change of the dns records is enough.

Well, once you hotlink jquery in your website at least use the https link (assuming your site is on https too).

Re: How I got XSS’d by my ad network

#13

Post by RossM »

cm2187 wrote: post #5

This is why browsers should have an option "Block third party javascript" similar to "Block third party cookies". With http2, relevant javascript files will be increasingly hosted on the same domain anyway and that option would become increasingly relevant.

I see the need, but fear that if this became a common thing, you'd end up with websites proxying external scripts through their own domain.

Re: How I got XSS’d by my ad network

#14

Post by Conlectus »

MatthewMcDonald wrote: post #8
hxn wrote: post #6

Earlier quoted context omitted.

With http2, relevant javascript files will be increasingly hosted on the same domain Why is that?

There's a limit on the number of simultaneous requests per domain with http1, which will not be present in http2 [0]. This limit meant that for best performance, static files should be served from multiple (sub)domains. [0] https://mattwilcox.net/web-development/http2-for-front-end-w...

The way this is phrased sounds backwards to what you actually mean.

HTTP/2.0 supports _single connection multiplexing_, which means that domain sharding (splitting into different domains) is a _bad practice_.

Re: How I got XSS’d by my ad network

#15

Post by cm2187 »

RossM wrote: post #13
cm2187 wrote: post #5

This is why browsers should have an option "Block third party javascript" similar to "Block third party cookies". With http2, relevant javascript files will be increasingly hosted on the same domain anyway and that option would become increasingly relevant.

I see the need, but fear that if this became a common thing, you'd end up with websites proxying external scripts through their own domain.

I am not that sure of that. Advertisers need to see the connections going through their servers, otherwise they are exposed to massive fraud from the websites they advertise on. So proxy-ing their script might not suit them at all.

Re: How I got XSS’d by my ad network

#16

Post by nothrabannosir »

leni536 wrote: post #12
mayrun wrote: post #11

Earlier quoted context omitted.

doesnt have to be literally "hacked", just a change of the dns records is enough.

Well, once you hotlink jquery in your website at least use the https link (assuming your site is on https too).

No need; the browser will block http:// included from https:// pages. Including from a http:// page? Then a compromised jquery cdn is the least of your worries.

In short; no, just a compromised dns record is not enough.

Re: How I got XSS’d by my ad network

#17

Post by jon-wood »

The throw away comment on how ad networks are a cesspit at the end of that article really spoke to me - if it weren't for the abundance of "Recommended Stories" and "From elsewhere on the web" crap selling weight loss pills and click bait I'd be far less inclined to run with an ad blocker.

The fact that these ads disguise themselves as content that the site owner is recommending is particularly insidious, since it will likely encourage people to click through thinking that they can trust the content.

Re: How I got XSS’d by my ad network

#18

Post by homakov »

nicboobees wrote: post #9

If you're going to put adverts on your site, always put them within an iframe, pointed at a separate "adverts" only domain. This will ensure they can't execute javascript within your own website context.

This is a very good tip (for security) and I don't see it used anywhere yet. Should be enforced.

Re: How I got XSS’d by my ad network

#19

Post by nly »

leni536 wrote: post #7
proactivesvcs wrote: post #4

"When you allow third parties to run script on your site, you’re entirely beholden to them; they can run anything they like in the context of your site" I've seen a fair few Internet banking web sites pulling scripts from over a dozen third parties, mostly for tracking and advertising, but even for trivial things like social media. On their customer login pages. It's beyond me how they can consider this to be an acce…

I wonder how many websites' users would be compromised if code.jquery.com got hacked.

I've been saying this for years. It's not even just security: you're also potentially leaking all your visitor stats to a third party (IP, user agent, the pages they visit (via the Referer)), and effectively giving jquery.com a third party supercookie over thousands of domains.

I surf with third party cookies and referers (via RefControl) disabled, and these should be the defaults

Re: How I got XSS’d by my ad network

#20

Post by thekaleb »

nicboobees wrote: post #9

If you're going to put adverts on your site, always put them within an iframe, pointed at a separate "adverts" only domain. This will ensure they can't execute javascript within your own website context.

On the video, it is mentioned that the advertisements are in a frame.
Post reply on HN