Re:The Great Cannon has been deployed again
by jiofih on Friday December 06, 2019 @01:34PM
(#21724677)
I fail to see how this attack has anything to do with http? The scripts can be served over https no problem, it’s the host that is compromised. Maybe you’re thinking of sub-resource integrity attributes?
[ Parent
| on HN ]
Re:The Great Cannon has been deployed again
by nihonium on Friday December 06, 2019 @01:36PM
(#21724697)
It's injecting the malicious script into the source of http pages.
With httpS, this is not possible unless you also change the root certificate of the computer.
Re:The Great Cannon has been deployed again
by Ruthalas on Friday December 06, 2019 @01:37PM
(#21724703)
From the article :
"Mitigations
These attacks would not be successful if the following resources were served over HTTPS instead of HTTP:
http://push.zhanzhang.baidu.com/push.js; orhttp://js.passport.qihucdn.com/11.0.1.js
You may want to consider blocking these URLs when not sent over HTTPS."
Re:The Great Cannon has been deployed again
by RL_Quine on Friday December 06, 2019 @01:35PM
(#21724685)
The cannon is injected into HTTP resources.
Re:The Great Cannon has been deployed again
by onesmallcoin on Friday December 06, 2019 @04:27PM
(#21726142)
In most javascript sandboxes if you request a domain from an site you are restricted by the same content policy. This makes it harder to do things like make requests to sites for example that don't use https when your on one that does use it.
https://developer.mozilla.org/en-US/docs/Web/Security/Same-o...