this post was submitted on 26 Jun 2024

908 points (98.9% liked)

Technology

59605 readers

3434 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago

MODERATORS

908

The new Chinese owner of the popular Polyfill JS project injects malware into more than 100 thousand sites (sansec.io)

submitted 5 months ago* (last edited 5 months ago) by 0x815@feddit.org to c/technology@lemmy.world

116 comments fedilink hide all child comments

Archived link

The polyfill.js is a popular open source library to support older browsers. 100K+ sites embed it using the cdn.polyfill.io domain. Notable users are JSTOR, Intuit and World Economic Forum. However, in February this year, a Chinese company bought the domain and the Github account. Since then, this domain was caught injecting malware on mobile devices via any site that embeds cdn.polyfill.io. Any complaints were quickly removed (archive here) from the Github repository.

top 50 comments

sorted by: hot top controversial new old

[–] originalucifer@moist.catsweat.com 175 points 5 months ago (11 children)

nah. over 100k sites ignored dependency risks, even after the original owners warned them this exact thing would happen.

the real story is 100k sites not being run appropriately.

[–] vzq@lemmy.blahaj.zone 130 points 5 months ago (1 children)

The hackers just engaged in a little bit of technical debt collecting ;)

[–] Feathercrown@lemmy.world 25 points 5 months ago (1 children)

I'm stealing this phrase

[–] vzq@lemmy.blahaj.zone 15 points 5 months ago

Please do! I’ve been trying to make it stick for almost a decade!

[–] douglasg14b@lemmy.world 109 points 5 months ago* (last edited 5 months ago) (10 children)

That's not how systemic problems work.

This is probably one of the most security ignorant takes on here.

People will ALWAYS fuck up. The world we craft for ourselves must take the "human factor" into account, otherwise we amplify the consequences of what are predictable outcomes. And ignoring predictable outcomes to take some high ground doesn't cary far.

The majority of industries that actually have immediate and potentially fatal consequences do exactly this, and have been for more than a generation now.

Damn near everything you interact with on a regular basis has been designed at some point in time with human psychology in mind. Built on the shoulders of decades of research and study results, that have matured to the point of becoming "standard practices".

load more comments (10 replies)

[–] ShaunaTheDead@fedia.io 53 points 5 months ago (3 children)

One place I worked at recently was still using Node version 8. Running npm install would give me a mini heart attack... Like 400+ critical vulnerabilities, it was several thousand vulnerabilities all around.

[–] corsicanguppy@lemmy.ca 30 points 5 months ago (2 children)

Running npm install would give me a mini heart attack

It should; but more because it installs things right off the net with no validation. Consistency of code product is not the only thing you're tossing.

[–] LordCrom@lemmy.world 16 points 5 months ago

How else would you get LPAD ? Expect me to write 2 lines of code when I could just import a 100 Mb library to do it for me?

load more comments (1 replies)

load more comments (2 replies)

[–] homesweethomeMrL@lemmy.world 41 points 5 months ago (2 children)

the real story is 100k sites not being run appropriately.

Same as it ever was. Same as it ever was. Same as it ever was.

[–] kautau@lemmy.world 9 points 5 months ago (2 children)

Yeah this is just capitalistic business in general. Don’t do anything proactive if it might reduce the bottom line in the short term. Blame others and beg for help when you weren’t proactive. Succeed singularly, fail collectively

load more comments (2 replies)

load more comments (1 replies)

[–] best_username_ever@sh.itjust.works 21 points 5 months ago* (last edited 5 months ago) (5 children)

100k sites ignored dependency risks

JS: typing systems are boring, warnings are boring, security is boring.

load more comments (5 replies)

load more comments (6 replies)

[–] Supermariofan67@programming.dev 142 points 5 months ago (1 children)

This is why ublock origin is an essential security tool.

[–] letsgo@lemm.ee 19 points 5 months ago (2 children)

What rules can we add that solve this problem? (I've tried DDG but didn't find any results)

[–] Supermariofan67@programming.dev 67 points 5 months ago (1 children)

This one is already in the default uBlock filters - Badware risks

I also strongly suggest adding https://big.oisd.nl/ as a filter list. It's a large and well maintained domain blocklist (sourced from combining lots of other blocklists) that usually adds lots of these sorts of domains quickly and has very few false positives.

If you want to take it even further, check out the Pro list and Thread Intelligence Feeds list here https://github.com/hagezi/dns-blocklists

These can all be added to a pihole too if you use one.

load more comments (1 replies)

[–] dan@upvote.au 125 points 5 months ago* (last edited 5 months ago) (2 children)

My favourite part is that the developers that currently own it said:

Someone has maliciously defamed us. We have no supply chain risks because all content is statically cached

https://github.com/polyfillpolyfill/polyfill-service/issues/2890#issuecomment-2191461961

Completely missing the point that they are the supply chain risk, and the fact that malicious code was already detected in their system (to the point where Google started blocking ads for sites that loaded polyfill .io scripts.

We don't even know who they are - the repo is owned by an anonymous account called "polyfillpolyfill", and that comment comes from another anonymous account "polyfillcust".

[–] Melvin_Ferd@lemmy.world 33 points 5 months ago (1 children)

Pollyfilladmin

[–] JPSound@lemmy.world 10 points 5 months ago (1 children)

Pollyfillpassword

load more comments (1 replies)

[–] Treczoks@lemmy.world 9 points 5 months ago

I'm not into JS stuff, but when I read that google is blocking ads, shit must be flowing in gargantuan amounts...

[–] dan@upvote.au 99 points 5 months ago (5 children)

Reposting my comment from Github:

A good reminder to be extremely careful loading scripts from a third-party CDN unless you trust the owner 100% (and even then, ownership can change over time, as shown here). You're essentially giving the maintainer of that CDN full control of your site. Ideally, never do it, as it's just begging for a supply chain attack. If you need polyfills for older browsers, host the JS yourself. :)

If you really must load scripts from a third-party, use subresource integrity so that the browser refuses to load it if the hash changes. A broken site is better than a hacked one.

And on the value of dynamic polyfills (which is what this service provides):

Often it's sufficient to just have two variants of your JS bundles, for example "very old browsers" (all the polyfills required by the oldest browser versions your product supports) and "somewhat new browsers" (just polyfills required for browsers released in the last year or so), which you can do with browserslist and caniuse-lite data.

load more comments (5 replies)

[–] jamyang@lemmy.world 76 points 5 months ago (1 children)

Man, the Chinese are becoming a new major nuisancec on internet.

[–] cheese_greater@lemmy.world 26 points 5 months ago* (last edited 5 months ago) (6 children)

Is therea way to ground them for a month while they think about what they did?

~~Take away his honey~~ No more honey on school nights

Edit: could the US/NATO ground China in some debilliting/deterrent way? Like geopolitically/economically spank them and send them to bed without dinner until they come to Jesus?

[–] joyjoy@lemm.ee 21 points 5 months ago

All Chinese businesses are owned by the CCP, except the ones that get caught being naughty. Suddenly those are a private business with no ties to the party.

[–] Strykker@programming.dev 11 points 5 months ago (1 children)

All it would really take is internet providers to black hole the China AS numbers in their BGP configs. Then boom China basically can't talk to the rest of the world.

[–] cheese_greater@lemmy.world 10 points 5 months ago* (last edited 5 months ago) (2 children)

This should be done with the new axis of evil and let them see how much they truly hate and "need" the destruction of the decadent West. Its insane their shenanigans are still being tolerated at all, cut em off and let them build their own self-sustaining economies and force the West to eliminate their dependance on mercurial and malicious actors on the world stage.

load more comments (2 replies)

load more comments (4 replies)

[–] Bertuccio@lemmy.world 59 points 5 months ago (3 children)

Whichever editor let them post "100 thousand" should be spanked one 100 times with the severed hand of whatever asshole wrote it in the first place.

[–] Potatos_are_not_friends@lemmy.world 21 points 5 months ago (3 children)

spanked one 100 times

One 100 times or 1 time, but 100 times?

[–] ericatty@lemmy.ml 8 points 5 months ago

100x one 100 thousand times

load more comments (2 replies)

[–] LodeMike@lemmy.today 44 points 5 months ago (4 children)

What's the malware do?

[–] UnderpantsWeevil@lemmy.world 23 points 5 months ago (1 children)

Frustrating that the article doesn't specify and simply links to a different Github page which doesn't clearly specify the problem either.

I have to assume the site's article was dynamically generated, without any actual tech journalist doing the reporting. The byline is "Sansec Forensics Team" which doesn't even link out to the group. Also, the "Chinese Company" isn't named either it the article or the references, which is incredibly shoddy reporting. The archive link is dead.

This whole page is indicative of the failed state of tech journalism. A genuinely explosive story but its so threadbare and vague that it becomes meaningless.

load more comments (1 replies)

[–] ikidd@lemmy.world 21 points 5 months ago (1 children)

Makes you hungry an hour later.

[–] LodeMike@lemmy.today 12 points 5 months ago

Ah frick

load more comments (2 replies)

[–] fne8w2ah@lemmy.world 28 points 5 months ago (1 children)

Wumao trolls incoming in 3..2...

[–] 0x815@feddit.org 20 points 5 months ago (1 children)

They must earn their 50 cents ...

load more comments (1 replies)

[–] cupcakezealot@lemmy.blahaj.zone 22 points 5 months ago

that's not very nice to call javascript malware. i know it's bad but still.

[–] QuadratureSurfer@lemmy.world 21 points 5 months ago (2 children)

That GitHub "archive here" link leads to a page where it hasn't been archived... (or was the archive removed??).

[–] DocMcStuffin@lemmy.world 28 points 5 months ago

Looks like someone tried to archive an archived page. You can see https://web.archive.org/... is listed twice in the url. I just trimmed off the first one then it works: https://web.archive.org/web/20240229113710/https://github.com/polyfillpolyfill/polyfill-service/issues/2834

[–] 0x815@feddit.org 12 points 5 months ago

Sorry, it's corrected now (and thanks@DocMcStuffin)

[–] faizalr@kbin.run 20 points 5 months ago

Again?

[–] NutWrench@lemmy.world 13 points 5 months ago (1 children)

This is probably connected to China cloning the entire GitHub website to their own servers.

[–] Kushan@lemmy.world 22 points 5 months ago (1 children)

I'd be surprised if it's directly linked

load more comments (1 replies)

load more comments