How I got XSS’d by my ad network • Hacker News Board

Re: How I got XSS’d by my ad network

#41

Post by glomph » Tue, Jul 14, 2015, 2:33 PM UTC

nly wrote: post #19

leni536 wrote: post #7

Earlier quoted context omitted.

I wonder how many websites' users would be compromised if code.jquery.com got hacked.

I've been saying this for years. It's not even just security: you're also potentially leaking all your visitor stats to a third party (IP, user agent, the pages they visit (via the Referer)), and effectively giving jquery.com a third party supercookie over thousands of domains. I surf with third party cookies and referers (via RefControl) disabled, and these should be the defaults

Could this be illegal? I mean the EU for example has pretty strict requirements on what you can do with user information.

Re: How I got XSS’d by my ad network

#42

Post by matthewmacleod » Tue, Jul 14, 2015, 2:38 PM UTC

micro-ram wrote: post #40

cm2187 wrote: post #5

This is why browsers should have an option "Block third party javascript" similar to "Block third party cookies". With http2, relevant javascript files will be increasingly hosted on the same domain anyway and that option would become increasingly relevant.

Blocking third party JS does not help me offload the libraries to a CDN (ex. cdnjs.com) to save server bandwidth.

Is server bandwidth a problem, though?

Re: How I got XSS’d by my ad network

#43

Post by pavel_lishin » Tue, Jul 14, 2015, 2:47 PM UTC

myfonj wrote: post #31

In retrospect it seems he could have saved himself a Fiddler session if he just opened console debugger in browser and used `?"-(function(){debugger}())-"` in URL instead of `?"-prompt()-"`. (I would not have guessed this either, but may come handy next time.)

Well, that's handy.

Re: How I got XSS’d by my ad network

#44

Post by andersonmvd » Tue, Jul 14, 2015, 2:48 PM UTC

That's called Malvertising :P

Re: How I got XSS’d by my ad network

#45

Post by jerf » Tue, Jul 14, 2015, 2:59 PM UTC

micro-ram wrote: post #40

cm2187 wrote: post #5

This is why browsers should have an option "Block third party javascript" similar to "Block third party cookies". With http2, relevant javascript files will be increasingly hosted on the same domain anyway and that option would become increasingly relevant.

Blocking third party JS does not help me offload the libraries to a CDN (ex. cdnjs.com) to save server bandwidth.

It's 2015, though, not 1996. If you seriously can't afford to send your visitor a few-dozen-kilobyte file once in a blue moon (because you do have far-future expire dates, right?), you've got bigger problems than CDN'ing your jQuery is going to solve.

If you're serving megabytes of JS such that that is enough to matter... no, it's still true, if that's not sustainable you've got bigger problems than a CDN is going to solve. Even on very JS-heavy sites, the amount of your bandwidth taken up by JS shouldn't be that large on a properly-configured site. (Yes, I can construct some rare exceptions... you've got a demo site for WebGL and your average viewer hits you once with no cache, grabs megabytes of JS and textures, then moves on never to return. But they are rare, even if you can construct them in your head.)

Re: How I got XSS’d by my ad network

#46

Post by Pwntastic » Tue, Jul 14, 2015, 3:11 PM UTC

nicboobees wrote: post #36

thekaleb wrote: post #20

Earlier quoted context omitted.

On the video, it is mentioned that the advertisements are in a frame.

Is the iframe pointed at a separate domain though? This is crucial to enforce the same origin security within javascript.

You could also make use of the sandbox[0] attribute, but that will really only benefit IE10+ users (and chrome, ff, others.)

[0] https://developer.mozilla.org/en-US/docs/Web/HTML/Element/if...

Re: How I got XSS’d by my ad network

#47

Post by fastest963 » Tue, Jul 14, 2015, 3:27 PM UTC

leni536 wrote: post #7

proactivesvcs wrote: post #4

"When you allow third parties to run script on your site, you’re entirely beholden to them; they can run anything they like in the context of your site" I've seen a fair few Internet banking web sites pulling scripts from over a dozen third parties, mostly for tracking and advertising, but even for trivial things like social media. On their customer login pages. It's beyond me how they can consider this to be an acce…

I wonder how many websites' users would be compromised if code.jquery.com got hacked.

Which is why they're adding Subresource integrity to script tags so you can detect when a popular CDN/host is hacked and not load the script: http://w3c.github.io/webappsec/specs/subresourceintegrity/#h...

Re: How I got XSS’d by my ad network

#48

Post by IanCal » Tue, Jul 14, 2015, 3:29 PM UTC

bsilvereagle wrote: post #33

danielweber wrote: post #30

Earlier quoted context omitted.

I've been called an idiot (even here on HN) for being paranoid about loading scripts from all over the web. I think it's a losing battle and my side is going the way of the dinosaurs.

As tools like uBlock and uMatrix get widespread adoption more and more people are realizing how much extraneous junk is being loaded by webpages. I think your side is slowly but surely gaining followers.

Which is an interesting problem as to stop loading all these scripts I have to give another script access to everything I see.

Re: How I got XSS’d by my ad network

#49

Post by jameshart » Tue, Jul 14, 2015, 3:33 PM UTC

proactivesvcs wrote: post #4

"When you allow third parties to run script on your site, you’re entirely beholden to them; they can run anything they like in the context of your site" I've seen a fair few Internet banking web sites pulling scripts from over a dozen third parties, mostly for tracking and advertising, but even for trivial things like social media. On their customer login pages. It's beyond me how they can consider this to be an acce…

The issue here isn't so much that they can run anything they like - it's not implied that the provider intentionally put a cross-site scripting vulnerability into the code. The issue is that you don't get to audit the third party code for vulnerabilities, and vulnerabilities can be introduced without your knowledge.

But that is part of the tradeoff you make when you agree to accept money from someone to add their code to your site.

If someone offers you a hundred bucks to carry a bag onto a plane for them, you'd be right to be suspicious. Ah, but it's not just a random stranger. You were introduced to them by your buddy, the ad network. So that's okay then. Your ad provider wouldn't be dealing with anybody who was actually criminal. But what about negligent? Did they pack the bag themself? Have they let it out of their sight?

When you run ads on your site, remember which direction the money is flowing in, and remember who is the customer.

Ad networks are a trust broker. The ad provider wants to know their ad really was shown to a real person in a real web browser, who really does meet the demographic profile they are paying to target. They do not trust you, the publisher, at all. And they are paying.

You, as the publisher, are getting money from the ad network to compensate you for the inconvenience of surfacing the advertiser's content on your site. And of proving that you aren't defrauding them. To do that, you are going to give up some control.

And that includes control over whether the code you're serving is secure.

Re: How I got XSS’d by my ad network

#50

Post by jdmichal » Tue, Jul 14, 2015, 3:34 PM UTC

bsilvereagle wrote: post #33

danielweber wrote: post #30

Earlier quoted context omitted.

I've been called an idiot (even here on HN) for being paranoid about loading scripts from all over the web. I think it's a losing battle and my side is going the way of the dinosaurs.

As tools like uBlock and uMatrix get widespread adoption more and more people are realizing how much extraneous junk is being loaded by webpages. I think your side is slowly but surely gaining followers.

I use uMatrix, and I have already whitelisted loading scripts from common CDNs as global rules. They're everywhere and I found myself just constantly whitelisting them anyway.

The trend for a long time was to cite using a CDN as a best practice, but no one ever calls out the downsides when making such statements. In this case, you lose control of the code and allow third-party access to your users' browsers.