A new skimmer uses WebSockets and a fake credit card form

Re:A new skimmer uses WebSockets and a fake credit card form by lowcodetv on Wednesday November 11, 2020 @05:25PM (#25063741)

"The skimmer injects a loader into the page source as an inline script."

"Given the obfuscated nature and supply chain origination of in-browser attacks, traditional CSP-reliant approaches miss most of these types of attacks."

"Also, a lot of CSP policies don't limit WebSockets usage."

...But CSP is very aggressive with denying inline scripts.

Could be a browser plugin, or maybe an infected common JS package?

[ Parent | on HN ]

Re:A new skimmer uses WebSockets and a fake credit card form by hn_throwaway_99 on Wednesday November 11, 2020 @09:17PM (#25065672)

My reaction exactly. This whole post seemed like purely thrown shade against CSP, which should prevent both injection and data exfiltration as designed when used correctly, in order to sell Akamai's product.

[ Parent | on HN ]