Show HN: Guardscript – Detect any changes made to your JavaScript files

Re:Show HN: Guardscript – Detect any changes made to your Ja... by Dyaz17 on Monday June 24, 2019 @12:20PM (#20265158)

Hey HN!

I created GuardScript because in my previous company we started to include more and more third-party Javascript from SaaS services on our homepage, and this created security risks for us [1] [2].

In order to reassure us, a few of these companies created independently what is essentially GuardScript: a service that monitors every few minutes any changes made to your Javascript files and sends you a notification with the changes made. You can then detect any malicious modification by analyzing these results.I decided to build it for a broader audience.

I'd love feedback and suggestions on how to make it better.

Thanks!

[1] https://www.theregister.co.uk/2018/09/12/feedify_magecart_ja [2] https://www.zdnet.com/article/hackers-breach-statcounter-to-...

[ Parent | on HN ]

Re:Show HN: Guardscript – Detect any changes made to your Ja... by ben509 on Monday June 24, 2019 @08:56PM (#20270189)

What do you actually do about an alarm? Okay, I just got an email, check there's no release planned, I go through the diff and, oh crap, my customers are being pwned. Now I'm going to have to drop everything and manually disable those URLs until I can contact the maintainer of this service? I guess that's the unfortunate reality when using SaaS.

I'd want a runbook feature so that anyone getting the email has a procedure to:

* check release notes to identify a false alarm

* if not identify which source files the URL is used in

* disable those URLs

* flush caches

* confirm they're disabled

* contact the service provider

* roll back when upstream is fixed

Or something like that. Man, I do not miss ops work.

[ Parent | on HN ]

Re:Show HN: Guardscript – Detect any changes made to your Ja... by Dyaz17 on Tuesday June 25, 2019 @01:59AM (#20271541)

You are right, for now all the analysis should be done by the owner of the script. I'll think about adding a runbook...

[ Parent | on HN ]

Re:Show HN: Guardscript – Detect any changes made to your Ja... by netsharc on Monday June 24, 2019 @08:30PM (#20270036)

So as a hacker, I will just need to hack statcounter to serve your IP the non-molested JS, and almost everyone else the bad JS, right?

[ Parent | on HN ]

Re:Show HN: Guardscript – Detect any changes made to your Ja... by jjeaff on Tuesday June 25, 2019 @12:01AM (#20271073)

If you want to mitigate that, you simply need to run this from, or proxy the request through, some other random ip address.

[ Parent | on HN ]

Re:Show HN: Guardscript – Detect any changes made to your Ja... by ben509 on Monday June 24, 2019 @08:31PM (#20270041)

Under "pricing" all the "start" buttons say "sart". (Checked Chrome and FF.)

[ Parent | on HN ]

Re:Show HN: Guardscript – Detect any changes made to your Ja... by Dyaz17 on Tuesday June 25, 2019 @01:45AM (#20271483)

Thank you! I have changed it.

[ Parent | on HN ]

Re:Show HN: Guardscript – Detect any changes made to your Ja... by BubRoss on Monday June 24, 2019 @09:26PM (#20270351)

Why wouldn't someone just detect changes to the files at the OS level?

[ Parent | on HN ]

Re:Show HN: Guardscript – Detect any changes made to your Ja... by godzillabrennus on Monday June 24, 2019 @09:40PM (#20270434)

Not all hosts give you control at the OS level.

[ Parent | on HN ]

Re:Show HN: Guardscript – Detect any changes made to your Ja... by jjeaff on Tuesday June 25, 2019 @12:02AM (#20271077)

It sounds like this is talking about 3rd party scripts included in the page. Like Google analytics and the like.

[ Parent | on HN ]

Re:Show HN: Guardscript – Detect any changes made to your Ja... by Dyaz17 on Tuesday June 25, 2019 @01:46AM (#20271488)

Exactly.

[ Parent | on HN ]

Re:Show HN: Guardscript – Detect any changes made to your Ja... by jhgg on Tuesday June 25, 2019 @01:03AM (#20271337)

>GuardScript is usefull when Subressource integrity is not feasible or not implemented, which is most of the time for SaaS services.

Can you explain what this means?

[ Parent | on HN ]

Re:Show HN: Guardscript – Detect any changes made to your Ja... by Dyaz17 on Tuesday June 25, 2019 @01:45AM (#20271482)

Well many companies that offer you a service don't include the Subresource integrity Tag.

Check for instance Stripe : <script src="https://js.stripe.com/v3"></script> or Facebook : <script async defer src="https://connect.facebook.net/en_US/sdk.js"></script>

If they offer you a javascript and it has to change frequently to fix bugs, for instance, they don't want to be bothered with having to coordinate with all their customers to change the subresource integrity tag...

In this case our service could be an alternative.

[ Parent | on HN ]

Re:Show HN: Guardscript – Detect any changes made to your Ja... by leppr on Monday June 24, 2019 @08:26PM (#20270004)

Suggestion: Monitor other potential attack vectors like CSS files.

[ Parent | on HN ]

Re:Show HN: Guardscript – Detect any changes made to your Ja... by Dyaz17 on Tuesday June 25, 2019 @01:46AM (#20271486)

Thanks for the suggestion

[ Parent | on HN ]