How I got XSS’d by my ad network • Hacker News Board

Re: How I got XSS’d by my ad network

#21

Post by [deleted] » Tue, Jul 14, 2015, 1:08 PM UTC

leni536 wrote: post #7

proactivesvcs wrote: post #4

"When you allow third parties to run script on your site, you’re entirely beholden to them; they can run anything they like in the context of your site" I've seen a fair few Internet banking web sites pulling scripts from over a dozen third parties, mostly for tracking and advertising, but even for trivial things like social media. On their customer login pages. It's beyond me how they can consider this to be an acce…

I wonder how many websites' users would be compromised if code.jquery.com got hacked.

[deleted]

Re: How I got XSS’d by my ad network

#22

Post by mayrun » Tue, Jul 14, 2015, 1:15 PM UTC

nothrabannosir wrote: post #16

leni536 wrote: post #12

Earlier quoted context omitted.

Well, once you hotlink jquery in your website at least use the https link (assuming your site is on https too).

No need; the browser will block http:// included from https:// pages. Including from a http:// page? Then a compromised jquery cdn is the least of your worries. In short; no, just a compromised dns record is not enough.

if it is a http:// page, then even a small change in the local host file is enough.

Re: How I got XSS’d by my ad network

#23

Post by nly » Tue, Jul 14, 2015, 1:18 PM UTC

cm2187 wrote: post #15

RossM wrote: post #13

Earlier quoted context omitted.

I see the need, but fear that if this became a common thing, you'd end up with websites proxying external scripts through their own domain.

I am not that sure of that. Advertisers need to see the connections going through their servers, otherwise they are exposed to massive fraud from the websites they advertise on. So proxy-ing their script might not suit them at all.

So let's do the opposite! Just point our DNS at the ad networks and have them reverse proxy our content! It's genius!

(You just know it's gonna happen one day under the guise of a free CDN)

Re: How I got XSS’d by my ad network

#24

Post by leni536 » Tue, Jul 14, 2015, 1:21 PM UTC

nly wrote: post #19

leni536 wrote: post #7

Earlier quoted context omitted.

I wonder how many websites' users would be compromised if code.jquery.com got hacked.

I've been saying this for years. It's not even just security: you're also potentially leaking all your visitor stats to a third party (IP, user agent, the pages they visit (via the Referer)), and effectively giving jquery.com a third party supercookie over thousands of domains. I surf with third party cookies and referers (via RefControl) disabled, and these should be the defaults

The same could be told about other third party resources, like images and css files, too.

Re: How I got XSS’d by my ad network

#25

Post by waffle_ss » Tue, Jul 14, 2015, 1:22 PM UTC

nicboobees wrote: post #9

If you're going to put adverts on your site, always put them within an iframe, pointed at a separate "adverts" only domain. This will ensure they can't execute javascript within your own website context.

Unfortunately it looks like you aren't supposed to do that with Google AdSense: https://support.google.com/adsense/answer/3394713

> Is it violating program policy if I place ads on iframe webpages in my software?

> Yes, it does violate our policies. Firstly, you’re not allowed to place ads in a frame within another page. Exceptions to our policies are permitted only with authorization from Google for the valid use of iframes. Secondly, you’re not allowed to put ads in your software, e.g., if you control both a website with ads and an app that loads that website, we will take action against it.

Re: How I got XSS’d by my ad network

#26

Post by nly » Tue, Jul 14, 2015, 1:33 PM UTC

leni536 wrote: post #24

nly wrote: post #19

Earlier quoted context omitted.

I've been saying this for years. It's not even just security: you're also potentially leaking all your visitor stats to a third party (IP, user agent, the pages they visit (via the Referer)), and effectively giving jquery.com a third party supercookie over thousands of domains. I surf with third party cookies and referers (via RefControl) disabled, and these should be the defaults

The same could be told about other third party resources, like images and css files, too.

Maybe, but hotlinking images has historically been considered rude at best, and theft at worst. And most people still host their own CSS because it tends to come with whatever app, or theme, they're using.

In any case, the defaults I live with cover all the other web resources too.

Re: How I got XSS’d by my ad network

#27

Post by mahouse » Tue, Jul 14, 2015, 1:33 PM UTC

What alternatives are there anyway?

I wonder what could be done to serve 3rd-party ads, making sure they can't hinder the experience of the users of the webpage.

Is this just laziness from those ad networks, or do we currently have the tools to counter this?

Re: How I got XSS’d by my ad network

#28

Post by mrweasel » Tue, Jul 14, 2015, 1:33 PM UTC

Whenever I talk to people who work for ad networks or similar companies, I'm, without fail, impressed by how little technical knowledge they possess. If you work for a company that sells internet services, you should at least have some basic understanding of how the internet works.

Re: How I got XSS’d by my ad network

#29

Post by teh_klev » Tue, Jul 14, 2015, 1:36 PM UTC

I've resisted using an ad-blocker for years because I'm happy for the sites I visit daily to earn revenue that way, and for many it's the only way they can. I limited myself to running Privacy badger and blocking Facebook/Twitter tracking cookies, that kinda thing.

But this is the straw that's broken my camel's back and it spoils things for those of us who don't mind a few ads here and there. uBlock now installed, sod the ad networks.

Re: How I got XSS’d by my ad network

#30

Post by danielweber » Tue, Jul 14, 2015, 1:40 PM UTC

nly wrote: post #19

leni536 wrote: post #7

Earlier quoted context omitted.

I wonder how many websites' users would be compromised if code.jquery.com got hacked.

I've been saying this for years. It's not even just security: you're also potentially leaking all your visitor stats to a third party (IP, user agent, the pages they visit (via the Referer)), and effectively giving jquery.com a third party supercookie over thousands of domains. I surf with third party cookies and referers (via RefControl) disabled, and these should be the defaults

I've been called an idiot (even here on HN) for being paranoid about loading scripts from all over the web. I think it's a losing battle and my side is going the way of the dinosaurs.