Hacker News Reader

Comment by dotBen | Hacker News Reader

If anyone still needs convincing these CDN'd JS lib are a bad design pattern, check out this presentation from 2012's Black Hat (and also DEFCON) on MITM attacks on them that persist after the user has been exposed (due to indefinite caching of poisoned JS files).

http://media.blackhat.com/bh-us-12/Briefings/Alonso/BH_US_12..., or https://www.youtube.com/watch?v=ZCNZJ_7f0Hk (quite entertaining presentation)

the tl:dr is users browse a short time via an anonymous proxy (c'mon, many do), the proxy MITM's these CDN's JS lib requests and serves up poisoned versions that work but also check a mothership server to load in further poisoned + persistently cached JS files for popular websites (banking, facebook, etc). User then ends their proxy session but future visits (even direct, not via proxy) to sites loads in the now cached poisoned JS libs. Phishing, credential theft, clipboard theft, etc is all now possible

View on HN

How often does your average user browse via an anonymous proxy? I doubt most would even know what the hell you are talking about. I can understand for your more clued up or power user, but you give the average user too much credit.

Every time they use a public wifi hotspot. Any time you use a network you don't control and where you have no reason to trust the admin, you may as well be using a proxy.

The requirement to trust the admin isn't about the admin MITMing you, but rather trusting their competency in preventing other users MITMing you. Of course the admin could be bad as well.

Fair point. But if they have gone to this extent, they could just as easily inject some code into the HTML no?

http://news.ycombinator.com/item?id=3804608

They're talking about what happens when you load an infected jquery.min.js from cache when you get back to your home wifi network.

Any time you browse via public wifi you might be being fucked with. How often are you actually? My wager, depending on setting, very rarely.

In your local starbucks? Probably very rarely. In the VIP business lounge of an major international airport? I wouldn't be so sure in this day and age...

In the cafe on the corner of your block in syria, iran and similar places though, the odds are a lot better.

Yay for never using public wifi hotspots, now if I could only impress that upon the millions of Americans who do so everyday...

I set up a VPN server at home on an old laptop, it works well for me in these scenarios (also for location-blocked services like Netflix while travelling out of country).

Yeah that's a good point, the # of those users is going to be high in that user sampling (black hats), but very low for most of the rest of the world. I think I used an anonymous proxy back in '02 to get around a forum ban or something.

Reply on news.ycombinator.com