How I got XSS’d by my ad network • Hacker News Board

Re: How I got XSS’d by my ad network

#51

Post by leni536 » Tue, Jul 14, 2015, 3:48 PM UTC

nly wrote: post #26

leni536 wrote: post #24

Earlier quoted context omitted.

The same could be told about other third party resources, like images and css files, too.

Maybe, but hotlinking images has historically been considered rude at best, and theft at worst. And most people still host their own CSS because it tends to come with whatever app, or theme, they're using. In any case, the defaults I live with cover all the other web resources too.

Well, pixel tracking actually exists.

http://digiday.com/platforms/explainer-why-pixel-tracking-is...

Re: How I got XSS’d by my ad network

#52

Post by tarpherder » Tue, Jul 14, 2015, 3:50 PM UTC

fastest963 wrote: post #47

leni536 wrote: post #7

Earlier quoted context omitted.

I wonder how many websites' users would be compromised if code.jquery.com got hacked.

Which is why they're adding Subresource integrity to script tags so you can detect when a popular CDN/host is hacked and not load the script: http://w3c.github.io/webappsec/specs/subresourceintegrity/#h...

How would that help? The "integrity" packet is provided by the now hacked server, and thus can never provide extra security? Or am I missing something?

Re: How I got XSS’d by my ad network

#53

Post by nly » Tue, Jul 14, 2015, 3:50 PM UTC

jdmichal wrote: post #50

bsilvereagle wrote: post #33

Earlier quoted context omitted.

As tools like uBlock and uMatrix get widespread adoption more and more people are realizing how much extraneous junk is being loaded by webpages. I think your side is slowly but surely gaining followers.

I use uMatrix, and I have already whitelisted loading scripts from common CDNs as global rules. They're everywhere and I found myself just constantly whitelisting them anyway. The trend for a long time was to cite using a CDN as a best practice, but no one ever calls out the downsides when making such statements. In this case, you lose control of the code and allow third-party access to your users' browsers.

To be fair, it has some positives: like said CDN being able to patch somelib.js to fix a security issue and thereby protect thousands of sites at once.

At the moment though, proposed solutions to trusting third parties with your Javascript, like the W3C proposal to put cryptographic hashes in to your tags etc, don't even consider these potential positives. So we're likely going to end up with the worst of both worlds.

If anything this is just enough facet of the weakness of the web as an app platform (Real solution: all sites serving client side libs should use package management, scripts should be digitally signed by the authors). As it stands it's far too common for people to just unzip WordPress or whatever in to their docroot, and so server-side code doesn't even get updated, let alone client-side code.

Re: How I got XSS’d by my ad network

#54

Post by ryan-c » Tue, Jul 14, 2015, 4:23 PM UTC

tarpherder wrote: post #52

fastest963 wrote: post #47

Earlier quoted context omitted.

Which is why they're adding Subresource integrity to script tags so you can detect when a popular CDN/host is hacked and not load the script: http://w3c.github.io/webappsec/specs/subresourceintegrity/#h...

How would that help? The "integrity" packet is provided by the now hacked server, and thus can never provide extra security? Or am I missing something?

The integrity value is part of the script tag. You add a hash of the script content as a property of the script tag, and the browser only executes if it matches.

I hacked together something that implements this sort of behavior in a script loader a while ago, if you're interested: https://github.com/ryancdotorg/VerifyJS

Re: How I got XSS’d by my ad network

#55

Post by ble » Tue, Jul 14, 2015, 4:37 PM UTC

nicboobees wrote: post #9

If you're going to put adverts on your site, always put them within an iframe, pointed at a separate "adverts" only domain. This will ensure they can't execute javascript within your own website context.

Does it have to have a different domain or would a `src`-less iframe also work? You'd have to write the ad code into the iframe from the outer page, but that's not hard.

Re: How I got XSS’d by my ad network

#56

Post by pwenzel » Tue, Jul 14, 2015, 5:24 PM UTC

danielweber wrote: post #32

teh_klev wrote: post #29

I've resisted using an ad-blocker for years because I'm happy for the sites I visit daily to earn revenue that way, and for many it's the only way they can. I limited myself to running Privacy badger and blocking Facebook/Twitter tracking cookies, that kinda thing. But this is the straw that's broken my camel's back and it spoils things for those of us who don't mind a few ads here and there. uBlock now installed, so…

Wouldn't it be better to disable third-party scripts?

In this particular case, Ghostery would be suitable over uBlock.

(I run both)

Re: How I got XSS’d by my ad network

#57

Post by juliangregorian » Tue, Jul 14, 2015, 5:30 PM UTC

Conlectus wrote: post #14

MatthewMcDonald wrote: post #8

Earlier quoted context omitted.

There's a limit on the number of simultaneous requests per domain with http1, which will not be present in http2 [0]. This limit meant that for best performance, static files should be served from multiple (sub)domains. [0] https://mattwilcox.net/web-development/http2-for-front-end-w...

The way this is phrased sounds backwards to what you actually mean. HTTP/2.0 supports _single connection multiplexing_, which means that domain sharding (splitting into different domains) is a _bad practice_.

You're both right. There's two separate (but related issues) here.

Re: How I got XSS’d by my ad network

#58

Post by nicboobees » Tue, Jul 14, 2015, 5:31 PM UTC

waffle_ss wrote: post #25

nicboobees wrote: post #9

If you're going to put adverts on your site, always put them within an iframe, pointed at a separate "adverts" only domain. This will ensure they can't execute javascript within your own website context.

Unfortunately it looks like you aren't supposed to do that with Google AdSense: https://support.google.com/adsense/answer/3394713 > Is it violating program policy if I place ads on iframe webpages in my software? > Yes, it does violate our policies. Firstly, you’re not allowed to place ads in a frame within another page. Exceptions to our policies are permitted only with authorization from Google for the valid use of…

Yeah adsense is amongst the most restrictive products out there, and the one without any support etc. Wouldn't recommend it.

Talking of which, where are the startups challenging adsense's dominance?

Re: How I got XSS’d by my ad network

#59

Post by bsilvereagle » Tue, Jul 14, 2015, 5:58 PM UTC

IanCal wrote: post #48

bsilvereagle wrote: post #33

Earlier quoted context omitted.

As tools like uBlock and uMatrix get widespread adoption more and more people are realizing how much extraneous junk is being loaded by webpages. I think your side is slowly but surely gaining followers.

Which is an interesting problem as to stop loading all these scripts I have to give another script access to everything I see.

If you download the source for uBlock/uMatrix, and run locally you avoid the auto-updating of the add-on while being able to vet the source.

Re: How I got XSS’d by my ad network

#60

Post by tarpherder » Wed, Jul 15, 2015, 3:21 PM UTC

ryan-c wrote: post #54

tarpherder wrote: post #52

Earlier quoted context omitted.

How would that help? The "integrity" packet is provided by the now hacked server, and thus can never provide extra security? Or am I missing something?

The integrity value is part of the script tag. You add a hash of the script content as a property of the script tag, and the browser only executes if it matches. I hacked together something that implements this sort of behavior in a script loader a while ago, if you're interested: https://github.com/ryancdotorg/VerifyJS

Ah I see, thanks for explaining.

So, though this does allow one to safely circumvent the hosting cost associated with bigger third party scripts, it means giving up some of the advantages like dynamic updates (as the hash would now be incorrect), right? This would therefore not work when ad providers want to be able to supply content they get dynamically from others right?