Show HN: Guardscript – Detect any changes made to your JavaScript files • Hacker News Board

Show HN: Guardscript – Detect any changes made to your JavaScript files

#1

Post by Dyaz17 » Mon, Jun 24, 2019, 4:18 PM UTC

Show HN: Guardscript – Detect any changes made to your JavaScript files
guardscript.com

Re: Show HN: Guardscript – Detect any changes made to your JavaScript files

#2

Post by Dyaz17 » Mon, Jun 24, 2019, 4:20 PM UTC

Hey HN!

I created GuardScript because in my previous company we started to include more and more third-party Javascript from SaaS services on our homepage, and this created security risks for us [1] [2].

In order to reassure us, a few of these companies created independently what is essentially GuardScript: a service that monitors every few minutes any changes made to your Javascript files and sends you a notification with the changes made. You can then detect any malicious modification by analyzing these results.I decided to build it for a broader audience.

I'd love feedback and suggestions on how to make it better.

Thanks!

[1] https://www.theregister.co.uk/2018/09/12/feedify_magecart_ja [2] https://www.zdnet.com/article/hackers-breach-statcounter-to-...

Re: Show HN: Guardscript – Detect any changes made to your JavaScript files

#3

Post by dmitrygr » Tue, Jun 25, 2019, 12:01 AM UTC

I get relying on 3rd party libraries, but not hosting them yourself and just hoping that the current host never gets sold/owned/etc? That sounds insane to me...

Sounds like curl | insmod /dev/stdin level insane

Re: Show HN: Guardscript – Detect any changes made to your JavaScript files

#4

Post by leppr » Tue, Jun 25, 2019, 12:25 AM UTC

This is good, but this won't stop the first few visitors from getting pwned. Client-side check (SRI) is still the best solution.

Re: Show HN: Guardscript – Detect any changes made to your JavaScript files

#5

Post by leppr » Tue, Jun 25, 2019, 12:26 AM UTC

Dyaz17 wrote: post #2

Hey HN! I created GuardScript because in my previous company we started to include more and more third-party Javascript from SaaS services on our homepage, and this created security risks for us [1] [2]. In order to reassure us, a few of these companies created independently what is essentially GuardScript: a service that monitors every few minutes any changes made to your Javascript files and sends you a notificatio…

Suggestion: Monitor other potential attack vectors like CSS files.

Re: Show HN: Guardscript – Detect any changes made to your JavaScript files

#6

Post by netsharc » Tue, Jun 25, 2019, 12:30 AM UTC

Dyaz17 wrote: post #2

Hey HN! I created GuardScript because in my previous company we started to include more and more third-party Javascript from SaaS services on our homepage, and this created security risks for us [1] [2]. In order to reassure us, a few of these companies created independently what is essentially GuardScript: a service that monitors every few minutes any changes made to your Javascript files and sends you a notificatio…

So as a hacker, I will just need to hack statcounter to serve your IP the non-molested JS, and almost everyone else the bad JS, right?

Re: Show HN: Guardscript – Detect any changes made to your JavaScript files

#7

Post by ben509 » Tue, Jun 25, 2019, 12:31 AM UTC

Dyaz17 wrote: post #2

Hey HN! I created GuardScript because in my previous company we started to include more and more third-party Javascript from SaaS services on our homepage, and this created security risks for us [1] [2]. In order to reassure us, a few of these companies created independently what is essentially GuardScript: a service that monitors every few minutes any changes made to your Javascript files and sends you a notificatio…

Under "pricing" all the "start" buttons say "sart". (Checked Chrome and FF.)

Re: Show HN: Guardscript – Detect any changes made to your JavaScript files

#8

Post by ben509 » Tue, Jun 25, 2019, 12:35 AM UTC

dmitrygr wrote: post #3

I get relying on 3rd party libraries, but not hosting them yourself and just hoping that the current host never gets sold/owned/etc? That sounds insane to me... Sounds like curl | insmod /dev/stdin level insane

Some 3rd party services, though, serve up libraries, e.g. disqus.

Re: Show HN: Guardscript – Detect any changes made to your JavaScript files

#9

Post by ben509 » Tue, Jun 25, 2019, 12:56 AM UTC

Dyaz17 wrote: post #2

Hey HN! I created GuardScript because in my previous company we started to include more and more third-party Javascript from SaaS services on our homepage, and this created security risks for us [1] [2]. In order to reassure us, a few of these companies created independently what is essentially GuardScript: a service that monitors every few minutes any changes made to your Javascript files and sends you a notificatio…

What do you actually do about an alarm? Okay, I just got an email, check there's no release planned, I go through the diff and, oh crap, my customers are being pwned. Now I'm going to have to drop everything and manually disable those URLs until I can contact the maintainer of this service? I guess that's the unfortunate reality when using SaaS.

I'd want a runbook feature so that anyone getting the email has a procedure to:

* check release notes to identify a false alarm

* if not identify which source files the URL is used in

* disable those URLs

* flush caches

* confirm they're disabled

* contact the service provider

* roll back when upstream is fixed

Or something like that. Man, I do not miss ops work.

Re: Show HN: Guardscript – Detect any changes made to your JavaScript files

#10

Post by pietroglyph » Tue, Jun 25, 2019, 1:19 AM UTC

Looks very cool. You have a typo in the pricing area of the page: it says "Sart Free Trial" instead of "Start Free Trial".