PolyFill Vulnerability is WILD

Recorded live on twitch, GET IN

### Article
By: Sansec Forensics Team

### My Stream

### Best Way To Support Me
Become a backend engineer. Its my favorite site

This is also the best way to support me is to support yourself becoming a better backend engineer.

MY MAIN YT CHANNEL: Has well edited engineering videos

Discord

[PledgeBass]

I'm always shocked that stuff like this isn't wayyy more common with how much of modern software is full of 100s of thousands of lines of code that the software provider didn't even write or likely read.

[orbik_fin]

Back in the day it was Windows users downloading random executables from the Internet, infecting their PC with malware. Now it's web developers doing the same thing but with other people's machines.

[DArea]

Prime: I only have node_modules in one thing...
...
Prime: Dude, I have clerk? 7:22
Prime: How did I download "The Internet" by having a "types" package!?

Software Engineering in 2024, step One: Download The Internet

[diReLoCke]

Prime - “I am baffled, I am shocked that I have never thought about this type of attack.”
The entire security industry - *openly weeps into their 6th finger of bourbon*

[pukkimi]

I have demanded for over 15 years, that no external resources are linked to any of our sites. I have waited for exactly this kind of an attack, or DNS spoofing attack that could cause the same but not at this scale.

Also when you link an external js or css, you are using someone else's resources instead your own and it isn't right and sometimes not even reliable. Too much traffic and the proveder could stop usage depending of the referer of the request.

[JoeStuffzAlt]

"We don't want to hire an entry-level developer unless the developer has 5 years of experience". It's an interesting vector. You can get that experience

[gkiokan]

hahahhahaha I break on that part "I have only types definnition, how the hell I downloaded the whole Internet" hahahahhahaah

[Cafuzzler]

I still remember when the worst we had to worry about was the color.js dude throwing a fit because he wanted to get paid for making a library all the big tech companies used. Now we've got to worry that disgruntled developers aren't giving control up to foreign intelligence services on a multi-year OP, or just straight up selling it to the highest bidder.

[carljacobs]

I'm working on an embedded product to be used in an industrial setting. They want a basic web based interface. Some of the young engineers wanted to use node + CDNs + all the modern web magic. But I'm old-fashioned and don't trust stuff that's either too large or dynamically downloaded, so used minified versions of the libraries I needed (bootstrap and jquery), and wrote the server side CGI in bash scripts. It all turned out to be shockingly simple to do, and completely side-steps the risk shown in this video.

[Tony-dprl]

NEVER go to production with code that pulls from a CDN you don't control.

[asdfghyter]

12:18 you can use the integrity attribute with a hash on your script tags to ensure that no-one can change the code under you. pairing that with some good CSP headers will go a long way to protecting your website against various kinds of script injection

[gruntaxeman]

Having tons of dependencies of unaudited code has been known security risk all time. I do have in my projects dependencies but almost all of them I have someone curating them, or they are well funded (like React) rest of the dependencies I do check the code or fork.

I generally avoid dependencies.

[hilmar]

FunNull that's some impressive naming right there 😂

[FaultyTwo]

If I have a nickel for every times a Chinese developer injects their backdoor into open-source projects, I would have five.
Which isn't a lot but it's really weird if you think about it.

[johanlarsson]

What do you mean "this could totally just happen!"? The more difficult version of it already happened with SSH login failure, so ofcourse this to can happen.

[theaifam]

Use checksums to prevent any upstream modifications and setup CSP to load only what you „own“.

[cyberneticbutterfly]

There is a kind of metaphor or analogy in security here, to "Progressive Enhancement" in frontend:
Teams want no dependencies that add security work.
Better to not use the thing that demands more security work unless you have to.
Solving the problems with larger vendor dependencies or the only the biggest open source dependencies.
But then how can things grow to become big in the first place?

[federicoreina]

Prime not fully appreciating the github auctions joke 😭

[snrd]

There are two things that (among others) you can do as a maintainer of a website to prevent this kind of attack from working: Using Subresource Integrity (SRI) and defining a Content Security Policy (CSP) either in html or in the http header. Sadly most websites don't use these features and browsers don't require these features to be used. I wish by default scripts wouldn't be loaded until the browser can verify its integrity and external resources wouldn't be loaded until they are defined in the CSP, but sadly this would break the entire web.

[ikiris]

This has been a spam / malware vector for ages. Its what happened to multiple browser addons as well.