News for hackers. Stuff that matters.

A comment on Protecting sites from Cryptojacking with CSP and SRI.

Re:Protecting sites from Cryptojacking with CSP and SRI by cbr on Sunday February 11, 2018 @03:00PM (#16354434) 

    Want to know how you can easily stop this attack?  What
    I've done here is add the SRI Integrity Attribute and
    that allows the browser to determine if the file has
    been modified, which allows it to reject the file.
SRI does not fix this problem. If you put an integrity attribute on the script, then the next time BrowseAloud releases to prod their script will stop working on your site.

This is a product that works by running a script on your page to make changes. There's no option for defense in depth here: either you trust that their processes are secure enough that they're not going to XSS you, or you shouldn't run their code on your site at all.

The bar for including javascript from other sites should be a high one, but there are times when the tradeoff is reasonable. For example, I have Google Analytics [1] on my site, and I trust them to handle this responsibly.

[1] Disclosure: I now work for Google

[ Parent | on HN ]
Re:Protecting sites from Cryptojacking with CSP and SRI by gambler on Sunday February 11, 2018 @03:04PM (#16354455)
>The bar for including javascript from other sites should be a high one

Yes, but that's not how most developers think these days. Try browsing the Web with NoScript and you will routinely witness dozens of domains in the block list.

[ Parent | on HN ]
Re:Protecting sites from Cryptojacking with CSP and SRI by throwawaypanda on Sunday February 11, 2018 @09:34PM (#16356135)
>The bar for including javascript from other sites should be a high one

>but that's not how most developers think these days.

The decision to include third party javascript is sometimes not even up to developers these days.

"A deal has been signed with company X, put their widget on the site" is something I've now heard a few times.

Arguments about the third party code greatly increasing page load time, page size, introducing security vulnerabilities etc then fall on deaf ears. High developer turnover seems to co-occur in these environments.

[ Parent | on HN ]
Re:Protecting sites from Cryptojacking with CSP and SRI by arkh on Monday February 12, 2018 @03:03AM (#16357233)
> For example, I have Google Analytics [1] on my site, and I trust them to handle this responsibly.

I don't. And I don't appreciate people injecting Google beacons on their website. Same thing with Facebook, Twitter, Disqus and all the other shit-scripts.

[ Parent | on HN ]