Hacking websites via third-party JavaScript libraries
1–10 of 39 posts
Re: Hacking websites via third-party JavaScript libraries
#2The fact that this was possible is a testament that web devs really have no concept of due diligence. Sad.
Imagine if running a native app on your computer would load random DLLs from servers. It boggles the mind.
Re: Hacking websites via third-party JavaScript libraries
#3I’ve come to the conclusion that the way to secure your website from third party JavaScript is to monitor everything happening on your site:
https://enchantedsecurity.com/
These third party libraries are a necessary part of modern websites. It’s worth trusting but verifying their security.
Re: Hacking websites via third-party JavaScript libraries
#4SRI is such a cool idea (in theory) but the approach fails in practice. Also very few sites maintain a solid Content Security Policy (CSP). What's the point of all these controls/tools when nobody uses them?
Re: Hacking websites via third-party JavaScript libraries
#5I’ve come to the conclusion that the way to secure your website from third party JavaScript is to monitor everything happening on your site: https://enchantedsecurity.com/ These third party libraries are a necessary part of modern websites. It’s worth trusting but verifying their security.
>Add Enchanted Security's JavaScript to your website to prevent data exfiltration attacks, protecting passwords, credit cards, and other sensitive information.
>Install Enchanted Security's tamper-resistant JavaScript snippet on your site. The inline snippet is designed to be small, adding only a few milliseconds to load time, and does not require active configuration on your end.
There's a lot of marketing copy on your site, but it doesn't really tell me what it's really doing, or even how Enchanted Security itself is secured.
Re: Hacking websites via third-party JavaScript libraries
#6I'd really like to see a web where developers stop `npm install`ing tons of dependencies, I really would!
Re: Hacking websites via third-party JavaScript libraries
#7A few ways out of these are:
- don't eval on the server side (this is a bad idea most of the time anyway);
- serve js bundles from your own domain and set an appropriate content security policy;
These hacks won't work then.
Re: Hacking websites via third-party JavaScript libraries
#8I’ve come to the conclusion that the way to secure your website from third party JavaScript is to monitor everything happening on your site: https://enchantedsecurity.com/ These third party libraries are a necessary part of modern websites. It’s worth trusting but verifying their security.
Hah. "Security is hard, let's go shopping (for our magic security dust)!"
Re: Hacking websites via third-party JavaScript libraries
#9The fact that this was possible is a testament that web devs really have no concept of due diligence. Sad. Imagine if running a native app on your computer would load random DLLs from servers. It boggles the mind.
Technically applications with auto updates do load "random" DLLs from servers.
I'm pretty sure you can't make a blanket statement like this without discounting a lot of developers who do take security into account when developing. These are just some interesting holes that were reported.
Is all your code perfect?
Re: Hacking websites via third-party JavaScript libraries
#10I’ve come to the conclusion that the way to secure your website from third party JavaScript is to monitor everything happening on your site: https://enchantedsecurity.com/ These third party libraries are a necessary part of modern websites. It’s worth trusting but verifying their security.
The other option is to reduce your attack surface by minimising the amount of JS you use.