One Script Tag Just Pwn'd Over 100,000 Websites

Polyfill dot io is compromised. The results are terrifying. Everyone from Hulu to The Guardian to Intuit is currently pwn'd.

SOURCES

S/O Ph4se0n3 for the awesome edit 🙏

[bluepilkinton-ching]

New idea for an ad blocker: Injecting Polyfill script tags into site

[BobKane-gx]

"Isn't NPM the same? There are a million who-knows-whats in my module directory. It took 30 minutes just to delete dependencies that depend on dependencies, a million times over.

[Mitch-xord]

15:45 the reason they didn't pin it to a specific hash is the most dangerous thing about pollyfill, it changes based on user agent. Each user may be served a different js file, so you can't pin the script to a specific hash. They give full control of what may be PAYMENT PAGES to a script that randomly changes BY DESIGN! Don't embed things like pollyfill, even if you don't have evidence of it being compromised.

[ankiy]

Working in one of the largest bank of Australia. I told my manager about this polyfill thing he was still not convinced after your tweet . Now sharing this video to him. Reason being i am having 2 yrs if experience while he is industry for last 15 yrs.

[ITAC]

Damn. I had no idea. Terrifying knowing how when repos like Polyfill are bought by different companies, they can do what they please with what they own, whether for the good or not. In most cases, the company that takes over has good intentions, but in the case of Polyfill, it's clear that this wasn't the case.

[owenwexler]

Moral of the story: self-host everything, don’t rely on anything external. Even for something as harmless and innocuous as a CDN like JSDelivr, there are implications. What if JSDelivr is down the day your site goes viral, to name one example?

[nordern]

Using non-checksumable external libraries is a terrible idea? Who would have thought!

[timseguine]

To be fair: even before Chrome, Firefox had already put significant pressure on Internet Explorer, Safari and Opera to embrace standards (although to be really fair, IE was the only real problem child). Chrome was just doing what Firefox already started but with the leverage of better UX and more marketshare. I am glad they killed the old web.

[Cyanide]

And this is why I never deploy production code that calls a third-party CDN. If you're doing that, you are trusting that third party to send you the script you're expecting every time someone loads the page. But they absolutely could send you literally whatever they want instead.

[Sandromatic]

Its wild that they got the github repo too? Like idk that seems weird.

[insylogo]

I love how the thing says JSTOR is being affected by the polyfill hack and you're like "cool, let me go open that right now".

[ThePCJohnson]

I would expect the Cloudflare status page to be running outside of their CDN infrastructure to keep it available during outages so it isn't entirely surprising that they came up with an easy way to avoid the issue and forgot to apply it to that separate part of their systems.

It should definitely be on a bunch of checklists now though so that nobody will forget about it for a while.

[ShayBlez]

You passed over nintendo in that list, holy f u c k

[BattyBest]

6:15
I love the TOS going "Oopsies, we may give you a virus, we cant know for sure!!, 1!! Plz check urself for any viruses we may or may not have put on your website!!!111!, "

[RedStone]

6:20 are they suggesting developers to embed an antivirus on their website?

[StagnantWaterDolphin]

Where does Theo gets his shirts? They look terrific

[CharlesBallowe]

For the cloud flare status page, I'm assuming they can't serve that page using their caching/rewriting layer - if there's a problem with the core service and the status page is proxied by it, nobody would be able to view the status.

[paultapping]

so as a new new dev I'd been wondering for a while about the security of CDNs and cross-site linking which, back in the day was almost exclusively an attack method, that I keep being instructed to use. Is the benefit of not serving a 20kb css or js file yourself really worth it?

[waynehawkins]

Thanks for this, as a developer, I have removed this from my web project. The sad thing is a lot of Bootstrap templates have this as a default and I just use it, well into now.

[tabsc]

The way I snickered when you @'d hulu.... that is rich lol