malicious javascript injected into 100,000 websites

A malicious CDN has been caught shipping javascript exploits on over 100,000 websites. This is truly one of the craziest attacks I've ever seen.

🛒 GREAT BOOKS FOR THE LOWEST LEVEL🛒

🔥🔥🔥 SOCIALS 🔥🔥🔥

[深夜-lf]

when the child says googie : 🥰
when the hacker says googie : 💀

[saberint]

Another reason why we don’t use 3rd party libraries or cdn’s. you can’t secure what you don’t control

[lolidkstudio]

i totally agree with the guy who commented “i just farted”

[RFelizardo]

While escaping the js runtime certainly is a possibility, especially if they're targetting old unpatched browsers, my mind with this sort of exploit immediately jumps to user data theft rather than RCE.

[zzco]

Lol, nope. Firefox don't use V8.

Being the inventor of JavaScript, they use the engine they developed during Netscape's heyday. Mozilla has maintained it ever since.

That is specific to Chromium-based browsers.

[thennoth]

Polyfilling, as it says on the MDN page on the screen, is the name given to backporting features by rewriting them in compatible older JS, it doesn't refer to some specific library.

[donleyp]

This is why I always host all the JavaScript for my sites internally.

[youtubewzd]

10:15 Congrats to having a working digestive tract.

[dominicbout]

6:26: "in V8's interpretation of C++" should be "in V8's interpretation of Javascript"

[Duconi]

Even if it's not an exploit to get out of the browser's sandbox. They would still have access to the website and all user data and their security tokens would get leaked to that company. And as even financial institutions used it, that's a big issue.

[eggflaw]

Watching half way through this it's already terrifying...

[tonyinv]

Nobody could have guessed that automatically using other people's code on your site could be dangerous 😂

[victorvsl]

I was recommended this channel by the algorithm - it's incredible how well it got to know me in the last 17 years since my account is technically active.

[LewisMoten]

Polyfill is still a thing, but it’s usually compiled with the code rather than a link to another website.

[drakeomar]

I just found your channel! I love it haha and this year has been crazy!

[Dj-Ann]

now im confident that i was never paranoid about polyfil but just beign realistic

[bugdeveloper]

JS and nodeJS are already notorious for memory issues

[seasong]

I find it pretty astonishing, that anyone can upload something to pip, cargo, npm etc but the majority of packages don't seem to contain malware.

[razt]

12:04 what is there to say about open source?
Whenever an open source project comes out to have malicious code injected it's always the same story: "oh I really wonder if open source was a good idea, just saying you know. I wonder what this means for the future of open source".

The only reason we found out about this and many previous vulnerabilities and the word got spread is because of open source and open source platforms like github.

Would you have liked it better if polyfill were closed source and were just as popular? Without a community board or forum to discuss these things openly?

You think Microsoft's proprietary IE js interpreter was any more resilient compared to the same era Chrome interpreter because it was closed source? No, ofc not and even Microsoft knows that now.

What a naive way of looking at the world.

[codewarren]

I think it's funny that says "googie analytics" because he doesn't notice that the lowercase L in "anaiytics" has also been replaced