all right thank you very much everyone
for joining me uh welcome to Copenhagen
developers Festival I keep getting to
off for calling it NDC Copenhagen so uh
catch me on that if you uh hear me
saying it I'm going to be talking today
about something that the the actual
incident itself did happen a few years
ago but this is now something that I can
talk about more publicly so while this
incident did make news headlines and you
might have seen it all of the details
that I'm going to share have not been
shared as publicly as this so we're
going to talk about something called a
cryptojacking attack and if you're not
familiar with what one of those is I
will explain it as we go but this hit
that we know of over 5,000 websites all
around the world and most of those
websites were government websites from
the UK where I live to Australia to
America and across Europe New Zealand it
was a really significant incident that
could have been much worse than it was
because we got a little bit lucky thank
you
so the incident started it was a Sunday
morning in the UK and I was just having
my first cup of coffee in the morning
wasn't planning to be doing particularly
much that day and I got a DM from a
friend of mine so a very good friend of
mine Ian messages me and he's like hey
do you have a second
and I was like oh this is either going
to take up loads of my time or be a
really big deal and he sent me this
screenshot and I'll show you a larger
version in a minute and he's like any
chance you could have a glance at the
ico's website so the Ico in the UK is
the information commissioner office it's
a government Department responsible for
data protection and if you get a fine
under gdpr these are the people that
fine you and he'd gone to their website
on a Sunday morning because I guess he's
like such a cool person and he's reading
like gdpr documentation on a Sunday and
his antivirus popped up a little warning
in the top right and I was like golly
gosh this is uh this is not good and he
said Is it real he's like you know
sometimes we get false positives from
antivirus programs right it's like oh
there's a virus on the page or and you
know that there's not and I was like
okay I need to look more closely into
this so this is the page that he was on
and like I said he was literally reading
gdpr documentation on the Sunday morning
uh that's the bigger problem here
so I was like no yeah like his antivirus
program is definitely telling him there
is something wrong on this page and for
those of you that may be familiar you
can already start to see from the names
of some of the the files up here in the
URLs JS minor this was coinhive if
you're not familiar with coinhive we'll
learn about them shortly and I was like
okay his antivirus program is like
pretty sure there's some malicious job
script on this page let's go fishing
let's go see what we can find in there
so I start to kind of respond to him I'm
like okay you know I see the same thing
I get a warning I try I have VMS with
antivirus programs I spin them up they
see the same thing and I was like yeah
they actually have like this coin I've
reported on their homepage and he's like
yeah that's what I'm seeing I was like
okay so now what do we do and and it's
kind of like a valid question right he's
like well you know my antivirus is
saying it's there yours it's like what
do we do like now what it's like okay we
all agree that there's some malicious
JavaScript on this page so the first
thing I thought to myself well is anyone
familiar with the term responsible
disclosure so it's like quite kind kind
of a rare term to be used in normal
context but in the security world if you
see a problem with somebody's website or
application or something you can go to
them and responsibly disclose it's like
hey I'm you know a security person I
found an issue on your site I'm going to
tell you about it so you can fix it
rather than Hack you and steal all of
your
money normally nor I would have done
that but I went a slightly different
path with this one and this is something
that I was criticized for a lot of the
time because I was like well they've got
malicious JavaScript on their site it's
a Sunday so the government's closed so
I'm not going to be able to speak to
anybody anyway so I sent this tweet to
say look I've gone onto their website
you can see I fired up the dev tools
we'll take a closer look in a second and
I was like yes this actual piece of
JavaScript is on not just like the page
that Ian was reading but it's on all of
their Pages most people usually have
their JavaScript depend is the same
across the whole site it was across
their whole site and I was like wow this
is really bad like there is a government
website loading a malicious Javascript
file and then the next question is like
well how did it get there right like
this is a pretty serious compromise if
somebody's adding JavaScript tags to
your production site and they're not
supposed to be there so I did a bit of
research to see if I could figure out
like how did it actually get there like
what is we know the JavaScript is there
but what is the injection Point how is
it getting in
so I use some external tools that can
observe websites from other places
around the world I was like is this just
something that we're seeing in the UK or
if you load the site from a different
country or a different continent do you
see the same thing I see because we
might have GEOS sensitive content we
might see different things so I start
loading it from different locations all
around the world and they all see the
same thing this malicious JavaScript is
running on the page and I was like wow
this just gets worse as we go so I Ed
some more tools to confirm this and I
started to work back through the
dependencies to see which one injected
this malicious JavaScript this coinhive
Library So eventually I located the file
that was including this dependency and
it was a simple plugin that did text to
speech called browsealoud
so this immediately confirms it's not
actually the government that have been
hacked you know somebody's not broken
into the government's application or
figured out how to inject some code in
this JavaScript one of their
dependencies has been compromised and
it's a really basic JavaScript
dependency gives you like a little
speaker icon in the corner of the page
and you can click the speaker icon and
it will read the content of the page for
visually impaired users accessibility is
good governments have particularly High
accessibility requirements therefore
many of the sites as you'll see later
were government sites using this
dependency but this is what I realized I
was like well actually if it's a third
party dependency that's been compromised
it's not just the site that's been
compromised it's any site that's using
this dependency too
and this is when it kind of started to
unravel a little bit so I was like oh
boy who uses these people so you go to
their website and you're like okay right
like because people usually have like
our customers include and I'm like oh
well I can just go and see who all the
other companies are that are currently
hacked and the funny thing was they used
their own library on their website so
they were also compromised and they were
running this malicious JavaScript across
their entire site
too so at this point things aren't
looking good and I was like okay I
finally found the file I found the
injection point in their Library so this
was the URL for the file that was
compromised now the company never really
confirmed the exact Vector but our best
guess and the thing that most of us
agree on was they they have their
Library stored in an S3 bucket that had
some weak credentials on it and somebody
was able to get them somehow or figure
them out log in and change the file and
this was what they did now the comment
at the top is legitimate that was part
of the original file and then you can
see the minified uh JavaScript starting
at the bottom there that is also
original this part in the middle is what
the attack has injected now if you're
ever skimming through the dependencies
on a site and you see OB fiscated
JavaScript like this you can pretty much
guarantee this isn't going to look good
when you deobfuscate it and I was pretty
confident as soon as I saw this I was
like yeah like this is where the
problem's going to start part so of
course I have to kind of take a bit of a
closer look at this the injection Point
itself isn't pretty big so I know
straight away before I've even
deobfuscated this this is just going to
bootstrap additional assets right like
this is not the entire payload they're
just going to have a really tiny
injection in the library and then start
to bootstrap their other Assets in and
this of course is what they did so if we
take a basic look at this now I've de
oisc it it's quite simple you can see
they're pulling in the coinhive library
at the top and then they're going to
start using it to do some cryptocurrency
Mining and this is all coinhive really
was used for so coinhive was originally
started and it was proposed as like a
legitimate idea and the idea was um like
everybody hates advertising and tracking
but it's how websites make money so a
website when you go to the website
instead of serving you adverts and
tracking you and doing this kind of
stuff they could load the coinhive
library and say okay well when you're on
my website I'm going to borrow your CPU
to mine a little bit of cryptocurrency
instead of serving you
adverts so like we can argue about
whether or not you agree with the
business model but that was the intended
use case of this software what attackers
realized was if we could do this if we
could load the coinhive library and put
our wallet in there instead of
presumably the organization's wallet
address when people go to that website
they will M crypto currency but instead
of sending it to the owner of the
website they'll send it to the attackers
that put the JavaScript there and this
is what became the phrase cryptojacking
so now all the attackers had to do was
run around the internet and find a way
to get their JavaScript into other
websites and of course going after
dependencies is a far higher yield if I
breach into your application and inject
it I get your application and your
visitors but if I find a popular
dependency and I compromise that and
inject my malicious JavaScript you you
can get thousands and thousands of
websites with presumably millions and
millions of visitors to all mine
cryptocurrency for
you now I was pretty confident straight
away that this was not intentional I was
like it must have been a compromise
right like you know the government
haven't put a crypto minor on their own
site this company has clearly been the
victim of some kind of breach because
all of this was happening in pretty much
real time so we're going through the
process
chronologically now if you think about
it this is really the kind of start of
the problem and most people would look
at this script tag and think
well you know like that's a pretty
standard thing to see on the web right
we probably see like 40 of these per
website nowadays because we all pull in
so many JavaScript dependencies but this
is what caused the attack like this is
the actual
problem does anyone see a problem with
this when they look at it does anyone
see anything problematic
yeah okay so did you attend my workshop
recently no okay you you know the answer
exactly so the problem that we have here
is this script tag basically says go to
this
location there will be some JavaScript
there bring back the JavaScript and then
run the
JavaScript and if we think about it as
much as like yeah there's a path and
it's you know plus scripts brows aloud.
JS like we have no assurances what
JavaScript is actually at this location
if we were to go fetch this file now and
then go and fetch it in 5 minutes could
it be
different right like it could be to we
could go fetch it in 5 seconds and it
could be completely different so all
this really says is go get some
JavaScript and bring it back and run it
we have no assurances about what's
actually going to be there or how much
or for how long so this is really where
the problem begins now because I knew
this script tag I was like okay this is
the actual script tag loading the
library that's problematic I can now go
crawl the web and look for this script
tag on other SES because I know what the
actual problem is so I ran my crawler
and I was like right go craw the
homepages of like all of the major sites
out there and see if you can find an
instance of the script tag because if
they have the script tag they have the
malware and it's like oh the US courts I
was like they don't do anything
important I'm sure this will be fine
right and it's like the student loan
company in the UK so these guys process
like millions and millions of pounds of
student loans to all of our students and
then repayments from those they're
handling huge amounts of money sensitive
data and information that's not good a
general medical Council in the UK where
all of our doctors and nurses are
registered I was like whoop there's a
lot of sensitive information going
through this site as well and it just
carried on it kept going right all of
our NHS applications in the UK were
running this malware so all of our like
Medical Data really sensitive
information is going through these
websites and all of these sites now are
running malicious JavaScript in the page
alongside all of that
data so the potential for harm here is
enormous and we're kind of lucky that so
far looking at the JavaScript that we
saw all they seem to be doing is
stealing your CPU to M
cryptocurrency so
far now I realized if anyone's not
familiar with Google doing so a Google
dog is usually something that we use
where it's like a particular search term
in Google to identify a website that's
vulnerable to hacking so if you've never
heard of this there are particular
Google queries that will usually return
a list of websites that are highly
susceptible to being hacked by certain
vectors so I wrote a crypto dog Google
dog where I was like okay go and find
all of the sites out there that have a
doov extension that are loading a crypto
Miner on them and you can actually go to
this right now like if you open on your
phone and go to that address it will
redirect you to Google run the search
and show you the current list of
government websites right now that are
running crypto miners right now live
it's like this is not historic like you
can go do this at any point in time and
over time like yes the list has got
smaller and smaller and smaller but you
can go run that query right now and it
will show you all of the government
websites out there that will steal your
CPU if you go to them so the remed ation
has not gone well we still have quite a
problem here but this is one of the
vectors that I used to find most of the
sites at the time so as you can see last
time I took a screenshot there's only
like 1,020 sites back then it was many
many thousands more so we have made some
progress but we still have a problem and
this was all happening on a Sunday
remember and on the Monday I was like
okay you know we need to start doing
something about this this like who do
you call like I know of thousands of
thousands of government websites running
malicious JavaScript like what do I do
and then I got a DM from the national
cyber security Center because I've been
live tweeting my investigation all
through the Sunday presumably they
caught up on the Twitter thread and I
got a DM and it's like hey Scott can I
grab your email now gchq is our spy
agency our government spy agency in the
UK and the ncsc are part of our
government spy agency and they dm' me
and they're like can I grab your email
and I was like uh like you already have
it surely right so they did reach out to
me I did respond nicely eventually I was
like this has to be a joke right like
the government is tweeting me there is a
problem or dming me but they reached out
and they were like look you've obviously
kind of been poking around with this and
doing the
investigation we're kind of now seeing
this and catching up on it could you
come down and speak to us and they
wanted me to go down to London where
they're
based I was like sure no problem I guess
like it's a
trap it's like have you ever doing
something and you're so sure it's wrong
but you keep doing it anyway throughout
this whole thing I was just like this
feels so wrong so they reach out and
they like look you've obviously been at
the callace like you've done loads of
the investigation we know kind of like
what's gone wrong like let's come and
talk about this and I was like okay sure
now after I went down there and spoke to
them
it turns out it's really really hard to
like patch thousands and thousands of
government applications of course the
British government ring responsible for
like some hundreds of them they were
like America and Australia and things
like we saw as well but even then if you
wanted to go out and quickly deploy a
change to like tens and tens and tens of
government sites run by different teams
all around the country that some of them
that we didn't even know how to get hold
of it's like okay well like how do we
remediate this quickly like we really
need to stop this this attack now
because it is an attack it is a
breach but like how do you make such
change so quickly and it just turns out
that they couldn't they were like this
is not going to be a simple process you
know we need to rip that script tag off
every single website now like you know
anytime after that is not
good and the problem that we had was
this script tag you know it's like well
how do
we immediately solve the problem yes
like remove the script tag or because
they were like well we can't really do
that it's going to take too long to get
in touch with all the Departments and do
the change requests and approve them and
everything else they were like why don't
we just get in touch with the vendor
right like let's just get in touch with
the vendor and be like hey delete this
file now like remove the file please so
essentially like those were the two
threads that were started it was like
number one start reaching out seeing if
you can get somebody to drop the script
tag from the page and number two call
the vendor and be like hey by the way
you've been breached please can you go
tidy up this file now it's turns out
deleting the file was the thing that
happened fastest so the vendor got that
done on the
Tuesday they took a phone call it's like
hey it's the government you've been
hacked like delete some
files every single phone call we made
someone on the other end was like nice
try put the phone down so this was just
like it was it's kind of funny but it at
at the time it was like yeah like this
is really difficult like there's no
processing place to deal with this like
you know just people keep laughing at us
on the phone
so you know like we had to we had to
resolve this more long term the short
term the vendor finally deleted the file
and you know they got the original file
back and it's like okay you know in that
instant like everything is fixed now
right as soon as they delete the file
and put the original version back it's
like okay we are actually fixed you know
like the problem is
solved and he's like right but it could
just happen again tomorrow so like how
do we actually fix the problem so that
was when we kind of shifted Focus onto
actually resolving the issue long term
because all of the pr people are like
this is going to be terrible it's going
to make like news headlines we're going
to look really bad we must make sure it
doesn't happen again right like it's bad
enough that it happened once we can't
have it happen
twice but the big problem that we had is
that that script tag is basically this
now there's loads of young people here
you might not know what a check is but
we used to have these things where you
would write like I will give you $100
and then you would put your signature
down here in the bottom and then give it
to someone and they could walk to a bank
and put it in the bank and then the bank
would give them $100 right my bless her
my grandma she still sends me these at
Christmas so this is what we would refer
to as a blank check you would take a
check out with your checkbook you would
sign it and then you would give it to
someone and then they can fill out the
amount and that's the part where we
start to have problems would you take a
check out of your checkbook sign it and
then give it to someone and let them
them fill out the amount sounds like a
terrible idea because it is and you
would never give anybody a blank check
but if you think about it this script
tag is a blank check for JavaScript
you're saying give me some
JavaScript but we're not saying like how
much or what JavaScript or what's it
supposed to do I mean yeah you could
argue with like the domain name and the
path as some kind of indication of what
we want but actually really if you put
this on your site that's it there are
zero guarantees of what it's going to do
how long it's going to do it for how
much of it there is and whether it will
change between now and 3 minutes from
now and this is where the problem starts
I was like as long as you have this on
your site the same thing can happen
again tomorrow right this is the blank
check for JavaScript you are trusting
this vendor to give you the JavaScript
that you wanted not the JavaScript that
you got and they were like well you know
know what's the solution to this and I
never want to go and I've just done my
two-day security Workshop here at uh
Copenhagen developer Festival I almost
said NDC again then and um this is one
of the things that we talk about it's
like I don't want to go in and just say
okay right no thirdparty dependencies
you have to like self-host them all or
because it's not really practical
advice so I discussed this problem uh
because the BBC got very interested in
it as well and we actually ran this um
kind of little TV episode which I'll put
on in the background here and this was
like this made like National TV in the
UK the hacker favor and the question is
like how do we solve this you know like
how do we how do we fix this problem
this house looks like your computer
after it's been
hijacked I love working with the media
like they want like Matrix text on
things and they want to make it sound as
Jazzy as possible to add insults to
injury your electricity bill is about to
go up as you pay to power a machine
that's now working hard for the
criminals a friend of mine got in touch
with me on the Sunday morning and said
I've just been to commissioner's office
website where the Ico here in the UK our
data protection body at the government
and he said my antivirus program has
thrown up this warning on the screen he
said this is a government website can it
have a virus on it so what we discovered
was originally that the Ico website was
running a crypto Miner so your your
browser would be hijacked to BU
cryptocurrencies for the hackers after
some investigation what we found was
that a third party supplier that
provides them with software had been
breached and they had included the
crypto Miner in that a thirdparty app
used by the Ico and thousands of other
websites had been compromised the
malware told visitors computers to start
mining cryptocurrencies for the bad guys
and you can see before my system was
doing one or two different things and
now the miner is running of course the
attackers are just like give us all the
CPU like give us everything on this
device and using it to mine
cryptocurrencies uh you can configure a
crypt minet in how much of the
computer's power it will use now if
you're greedy and you take 100% then
someone's computer or phone or tablet
will slow down and you will notice that
when you try to do things it's not
responsive it hangs uh what they' done
in this case is they' on the configured
it to use up to 60% of the power of the
device so if would use a lot of it so
again the average user may never have
known that it was there and that it was
running Scott showed me how they could
have stolen visitors data so why didn't
they so what I've set up here is
something that the attackers could have
done I've given myself the same level of
access they did and you'll notice that
the information commissioner's office
website has a username and password
field uh so if you just go ahead and
type something into that field and
already if you look at the information
being sent to my device here oh my God
this is coming up on there straight away
as you type that is sent in real time to
me and the attackers in this instance
could have done that absolutely they
just chose not
to why easy money you know attackers
will take the low hanging fruit they put
the crypto man onto this website and
they walk
away and this is one of the things that
really kind of stuck with me afterwards
there was every time I spoke to the
journalist and that was Dan Simmons he's
a tech reporter for BBC
Click he was like why did they not do
all of these evil things that you keep
showing me because I showed there we
have like our gov ID accounts in the UK
and the Ico website doesn't have login
credentials like a username and password
but of course if I've got JavaScript on
the page it's not hard for me to add a
login form and then for me to control
where that login form sends data and
some of the other examples that I gave
because I use my proxy to intercept the
traffic and inject my malicious
JavaScript into the page and then I
wrote a few different JavaScript
payloads one of them was the one that
you saw another one of them and they
just wouldn't put it on the TV I created
just like a a black and yellow slashed
banner across the top that said prime
minister
assassinated and they would like you
know like every Government website
they're going to there's just this huge
banner and they're like well we can't
put that on the TV because if someone's
like walking down the street and sees
like a big screen like it's like you
know they might think like oh my gosh
the end of the world is here so they
wouldn't use that one and I was like but
why couldn't they do that if you can
inject arbitary JavaScript into
someone's website really the only thing
that's going to limit you is how evil
you are and how good your imagination is
so I had another one where it played the
Star Wars theme tune and made the page
scroll up it's like you know I'm like
what can you not do once you have
JavaScript in the page like your your
power is Limitless and all these
attackers chose to do was mine
cryptocurrency and our assumption is
that they're goal was to put it there
have nobody notice and if it stayed
there for like days and weeks and months
eventually you're going to start making
some real money so we can presume that
that was their motivation but it comes
back to this this is still the source of
that problem because this is the ability
to inject arbitrary JavaScript into the
page that includes this script tag and
this is the first problem that we needed
to solve is how do you stop this from
happening and like I said before we
didn't want to say
self host all of your dependencies or
you know don't use CDN or what because
people do that and we do that for a good
reason unfortunately we actually have an
answer and the the kind of annoying
thing here is we've had the answer for a
very long time we have something called
sub resource Integrity which allows you
to ensure the Integrity of subresources
on your page like JavaScript and it's
really really simple it looks like this
so all I've done is just change that
script tag we saw a minut minute ago to
enable Integrity checking on the file
now this is like a completely standard
browser feature it's been around for
like nine years now I want to say and
all you have to do is add these two
attributes to the script tag so the
first one is the actual Integrity
attribute itself this is a sh 256 hash
of the remote file that the browser is
going to download so what we're saying
to the browser is okay go download this
file from the CDN from the vendor from
wherever but when you download it before
you run it just hash it and make sure
it's actually the file that we were
expecting because if it's not the file
we were expecting we don't want it if
this file has been tampered with if it's
been changed in some way the Integrity
check will fail and we'll know the file
has been tampered with do you want to
download and run JavaScript that's been
tampered with like probably not now the
other attribute required is the cross
origin Anonymous one all that means is
that when the browser sends a request
for this file it will send it without
any cookies if it happened to have
cookies for that domain so this will be
an unauthenticated request to load the
JavaScript the important one is this one
the Integrity
check that's it that's you know the
government are like oh my gosh what do
we have to do to stop this attack and
make sure it never happens again how
much money is it going to done I like
that's it just go add this line to the
Javascript file like we don't need any
software you don't have to buy a license
there's no product this is a built-in
browser functionality in literally every
single browser out there now there was
one catch there's always a catch there
was one catch for this particular
scenario this generally doesn't apply
but in this particular scenario if we
take a look at the Javascript file that
I showed you earlier the comment up at
the top there first of all the vendor
was like do not copy yourself host the
file you will not be
supported and then the second line of
comment was a bit of a problem because
you can see that there is a version
there now it's quite old even at the
time that this happened and if we zoom
in and take a look a bit more closely
you can see what they're saying is this
was browser lad plus version
2.5.0 so this presented a problem
because if we think about this
Javascript file now I've renamed the
file to latest. JS this is basically
what this file was you go here and you
always get the latest version of the
library right there's no version in the
past there's no version in the file name
or anything like
that now this presents a problem for
integrity checking because now by Design
when you go here the JavaScript is
supposed to change at least somewhat
regularly and I was like yeah so you
can't Integrity check something that's
literally designed to change and it's
like no problem no sweat we've got the
vendor in the room at this point I was
like all the vendor has to do is give us
like you know plus
2.5.0 ba. JS just give us a version path
and say in this path is
2.5.0 and then we can add the Integrity
attribute like no problem and the vendor
was like no sorry we can't do that and I
was like well it's you know it's not a
particularly big deal right like we just
need a version path or a version file
name or something to say this is 2.5.0
when you go
here and they were adamant that they
were not going to do it and it's like
but but why
and they said well if you go here and
pull the latest version like this if we
bump the version you know excluding CDN
or browser cache everybody basically
gets updated immediately the next
visitor that pulls the file will get the
latest version of the library which
means we don't have to do anything like
feature deprecations and support older
versions and do announcements for
breaking changes because we just deploy
the change in this file if we have some
like Legacy apis we don't need to
support them we can just drop them
because everybody's on the new version
instantly and they're saying to the
government people like this is good for
you as well because if we release a
change release an update if we add a new
feature you get it instantly right like
we change
sorry or get hacked but they're like you
know we release a change and you get a
new feature straight away you don't have
to do anything and the government people
are like yeah this sounds awesome like
we don't have to do stuff and I was like
look this is fine I was like and I
completely agree with what they're
saying but let me say what they're
saying with just slightly different
words right I was like you've got these
group of people over here who can deploy
arbitrary code changes into your
production site with no prior approval
or testing or
anything and they were like uh yeah that
doesn't sound like a good idea now you
say it like that and I was like because
ultimately that's what this is right
like they just change the file you load
the file off we go so I was like yeah
this is basically the vendor it's like
we can patch the Js anytime no problem
right and we switch it out for the
attacker we can patch the jsv anytime no
problem and this is the trade-off that
you have to make do you want somebody to
have this ability to just arbitrarily
deploy new code straight into your
production site with like no advanc
warning or anything you just go to the
file next time and it's different and
then the client loads it and runs it and
eventually the people in the government
were like okay yeah like he's right like
this this sounds like a really bad idea
now you've explained it like that
because at the point when like you said
down here if it's an attacker that's
made that change goes straight into
production and remember we're so lucky
that all they did was mine
cryptocurrency right like if they'
redirected it to like a pornographic
website oh every Government website in
the world is like redirecting to
pornography like Hello this like this
can't happen we can't have this risk So
eventually we finally got them to Cave
they said we will give you a virion path
and that means that you can use SRI so
this was like now the first line of
defense against this problem
but in security we like to practice
something called defense in depth which
means have more than one mechanism to
protect you against an issue so if your
first line of defense ever lets you down
you've got a backup you've got something
that will save you and I said look we
have this other really cool feature it's
built into web browsers you don't have
to buy a license or any software and you
can use it completely free and it's
called content security policy now
content security policy is a feature
again built into all web browsers that
allows you to write a security policy
for your page that says this is my page
and this is what should happen and you
give that security policy to the browser
and the browser says okay this is your
page and this is what should happen and
it makes sure that it does so content
security policy is super powerful and
it's super easy to deploy you write the
policy and deliver it to the browser as
a HTTP response header so this is how
you deliver obviously the page and the
policy together so this policy would be
enforced on the page that was delivered
below it now you can see a couple of
what we call directives in there I'm
going to break them apart so you can see
kind of what they look like so in this
content security policy we're being
pretty relaxed it's a pretty basic
policy but I'm saying by default this
page is allowed to load stuff from me
from my site most people are generally
safe to say that if you don't trust
yourself you have other things that you
need to fix first but you should
generally be able to load stuff from
yourself but then we're getting a bit
more specific and most people frequently
want to control script with this because
script is the most dangerous thing on
the page so I'm saying okay look
JavaScript we override the default we
don't inherit so if you want to Lo
JavaScript from yourself you specify
self again and then I want to load
JavaScript from this location
here now in this this particular
scenario we would have loaded the
JavaScript from browser loud because
browser alloud is now an allowed source
of JavaScript but as soon as they start
to try bootstrap other Assets in and
pull things from other locations like
coinhive decom and the others they would
just be blocked the browser would
literally look at that and say the
source attribute on this script tag is
not one of
those gone we don't have it anymore and
then connect source is controlling data
that goes out of the page and things
like xhrs so where can the page not only
fetch stuff and load it but where can
the page send stuff as well so again you
know you might want to send things back
to yourself in this case if it's doing
text to speech it sends the text and
gets the audio so you can allow it to do
only the things that it needs to do for
the page to operate properly but if this
does some crypto maning and tries to
start sending data to coinhive doccom
it's not going to work the browser will
simply block it now if something gets
blocked you can request that the browser
calls back and tells you so this is the
final kind of piece of the puzzle for
CSP when something is blocked we call it
a violation so if there is a violation
of the policy if something happens
that's not supposed to happen and the
browser blocks it it will send you a
report it's just a little Json payload
that says I was on this page and you
told me this but I found that and you
get this nice Json payload and it will
send it to wherever you want you just
put an address here and you say if
something violates this policy if there
is Javascript on my page that is not
supposed to be there please tell me here
and this is so so powerful so so easy
and it looks like this this is the Json
blob that you would get so in the case
of the Ico whose website we were just
looking at it would say right I'm on the
ico's website on your website we blocked
something from this domain because it
violated the policy policy and the
directive that caused us to block that
was the script source so I would look at
this and say right we've got a script
tag on this page and the source
attribute of that script tag is here now
further down it would also give you a
copy of the original policy so you could
see what was the browser working with
and um and then you would know exactly
right I said this should happen and this
has violated the policy and all you
would have to do is injest this Json now
and you would know like the first user
that loaded that page with the infected
JavaScript it would try and then
bootstrap the coinhive asset in the
browser would block it and it would
dispatch this post request we call it
real time you know give or take a few
seconds it's about as close to real time
as you're going to get and this is all
that you would have to do if it was the
connect source that was violated then it
would look like this right pretty
similar thing again but the effective
directive would change to update and
tell you what was the thing that got
blocked and why was it blocked
so now for me given that both of these
things are built into the browser both
sub resource integrity and content
security policy to go turn these things
on now you don't have to do anything
other than turn them on right they're
they're built into the browser
themselves there's no you know
JavaScript library like JavaScript is
the problem more JavaScript is not the
solution there's no you know JavaScript
library no service ey component or
anything all you do is deliver that
response header and all of this fun
functionality is built into Chrome
Firefox Safari whatever browser that you
use so for me now the big problem that
we've seen because this was like 2018
into 2019 the big problem we've seen in
the last couple of years has not
actually been cryptojacking so these
attackers are now doing the exact same
thing they're finding ways to compromise
your third party dependencies but
instead of injecting something like the
coinhive crypto Miner to mine
cryptocurrency what what they're doing
instead and it's a group that we refer
to as magecart we don't actually know
who they are uh it could just be one
person for all we know but what they're
doing is they're using those two or
three lines of JavaScript that they
inject to run a key logger and skim keys
off the page now if their JavaScript
library is loaded onto a site with an
e-commerce component and the user is s
there typing in their 16-digit card
number the expiry date the cbv number
and in the background those few lines of
JavaScript Ajax in each keystroke out of
the back and the attackers are just sat
there reading your credit card data
straight out of the
page so this is where they've gone to
and where they currently are with these
abilities to inject malicious JavaScript
they've realized yes crypto mining was
okay but they weren't really making a
lot of money if you get a set of card
details with the CVV number you can
easily get like $ 30 or $40 for that so
if you get them onto a popular website
that has many many payments a day
and you just sit there quietly in the
background silently skimming the data
the website still works right you go to
buy something you submit it you get
charged the thing arrives at your house
but they took a copy whilst you were
typing it into the website and they've
become really really good at this and
unfortunately this has now become their
real primary focus so I have here just
some of what I would deem to be like the
most impactful breaches which were all
of these organizations had their
application compromised in some way to
include two or three maybe four lines of
JavaScript that were a mage cart
schimmer and all Mage cart focus on is
pulling that credit card data out of the
page during the payment process now when
they really hit their stride was kind of
2018 you may have even heard of The
Ticket Master or the British a Airways
breach back then these were enormous
between these two organizations they
have over 200 million million dollars in
fines just for this breach caused by
these three or four lines of JavaScript
that they ended up with in ticket
Master's case it was a thirdparty
dependency they had like a smart chat
bot and you know it pops up in the
bottom corner it's like hey how can I
help you today and you can ask it
questions and stuff when they put the
JavaScript library for that on their
page they went into Google tag manager
and were like put it on the whole
site the whole site included the payment
page right so you're on the payment page
typing in your credit card number and
it's like hey can I help you I'm going
to skim the data while I'm here because
the chatbot was compromised and all it
was doing was just recording keystrokes
on the page and just firing them out the
back now British Airways was slightly
different they have many applications
one of them was their own kind of CMS
and what they did was they hosted all of
their JavaScript assets on the CMS and
then used them in their other production
sites so it was one of their
applications that got compromised but it
it was like third party to the
e-commerce application and their
smartphone app was just a web view that
loaded the same JavaScript assets so
when they breached the CMS and changed
one of their own files their main
website and their smartphone app loaded
the compromised JavaScript and again
four lines of
JavaScript and they were skimming
hundreds of thousands of people's card
data and the attackers will put it there
and they'll just leave it there right
there's no visual impact the site still
works nobody knows what's happening and
they just sit there silently for as long
as they can scooping up as much card
data as they can the reason that these
two attacks were found and most of the
other ones on here I was particularly
involved in The Ticket Master and
British Airways ones was because
eventually the attackers had so much
card data they were like okay we'll just
cash out now and load up all these cards
with fraudulent transactions so that's
why they were found because tens of
thousands of people suddenly started
getting these fraudulent transactions on
their card now when that happens the
bank runs something called the CPP
report which is a common point of
purchase report if you have 10,000
customers come to you and say I have
fraudulent transactions on my card they
run a common point of purchase report
and say where have all of these people
been because that's the vendor that's
been breached so you run the CPP report
and it's like oh all of you have shopped
at Ticket Master like I wonder who's
been breached out of these like 70,000
people so it wasn't because the breach
was found the banks got in touch with
kit master and said hey you've been
breached right it wasn't some cyber
security company it wasn't a product or
a researcher or some scanner it was the
bank saying hey the attackers have
finally hit all of our customers with
their fraudulent
transactions we have to get better at
this right this is not good and up until
like present day magecart whoever they
are whatever they are have been wreaking
havoc on enormous organizations costing
literally like just for The Ticket
Master alone in the UK and British
Airways just the British regulator has
finded them like eight and 20 million
pounds because they lose people's
private data it's your name your address
your card number right that's that's a
pretty big gdpr breach and then they get
fined by the American regulators and
other Regulators then they get fin by
the card companies and it's like wow all
of this from a few lines of
JavaScript so looking at the attacks
there are multiple ways that you can use
free browser Technologies to stop this
all of the these attacks fall you know
if we kind of simplify this down a
breach has to happen somewhere most of
the time it's one of your thirdparty
dependencies so you're not going to have
Direct Control to impact this you can
require your vendors to do security
Audits and security questionnaires and
things but generally speaking you know
we're not directly responsible for this
part but the breach at that third party
is going to have one goal which is to
inject some JavaScript and this is the
point at which we can start to take some
immediate action
we've got subresource Integrity so that
we can Integrity check those JavaScript
files make sure that the JavaScript
you're loading is the JavaScript that
you want the JavaScript that you expect
and then even if that fails and somehow
we end up getting it in all of these
attacks require some kind of
exfiltration of data from the page
either the users sensitive data name
address we have seen some attacks where
they steal credentials so they have
their key logger on the login screen
they have to exfiltrate the card data or
if it's a crypto Miner they have to
exfiltrate the results of the mining and
we can use content security policy on
these last two parts as well content
security policy allows you to control
where the JavaScript comes in from and
where can the data be sent to if an
attacker gets JavaScript into your page
but they can't send the users's data
somewhere and it just stays in the
users's browser there's not been a
breach right the attackers haven't got
their hands on the data so even if we
fail at these two and get here and still
stop it there's still not being a
breach so for me to have such powerful
things like SRI and CSP of course still
work on this part as well but the bits
that we can do something about are the
bits over there it's free it's simple
and it's easy and if we look at the
thousands and thousands of websites out
there that we've analyzed none of them
were using any of these Technologies so
we have to do better at this
now I have intentionally left 15 minutes
almost of time for open Q&A here so I
would like some audience interaction
there has to be some questions about
this and someone has to be the brave
person and go first so
yes
so the the browser loud vendor one in
this case yeah so the question there to
repeat for everyone you know basically I
say it's simple and it's easy but in
this case the vendor push back on adding
versioned
files I guess
ultimately like one of the biggest
things is to probably look at a lot of
us don't have that scenario where the
remote file is dynamic you know if we
look at most script tags they do usually
have a version path or fining so they're
kind of the instant wins and in my
experience that's also the majority of
external Javascript that we load so I
think to even just to get started on
that bit would be really really good but
you are correct there are even to this
day there's big vendors that I push back
on and we have this problem right now
with one of them where they require us
to load a script tag that is dynamic by
Nature so in that scenario then the only
question that you need to ask yourself
is do I need to load that script tag on
my login page on my payment page right
if it's a little AI chatbot widget do I
really want that on the same page as my
my customer credit card data you know if
I'm a medical website and they're
logging in to read their medical report
do I need an AI chatbot on this page or
can I just put it on all the other pages
so even if you are stuck in a scenario
where something like SRI isn't available
because of a a decision like that forced
on you you can still reduce the scope of
where that JavaScript is and therefore
if that JavaScript is compromised what
is the potential for the attack so we we
do still s have some options it's not
the ideal option but if that's forced
upon you then that's what I would
do
yes
yeah okay so the question there for the
crowd was um the virus scanner notif
ification that I showed right at the
beginning obviously they knew something
they knew this JavaScript was bad so
when they saw it they said this is bad
um you know should they have like
notified the authorities or or basically
done something more than give that alert
I guess is what you're getting at
so I mean I guess they could I've never
seen anything like that either before
then or since then um one of the biggest
problems that I would have in that
scenario is the frequency of false
positives which is why I was I did a
little bit of Investigation myself right
at the start I didn't just see that and
think this is true I saw it and I was
like I'm going to go do some poking
around in the dev tools first because
personal experience the you know false
positives are quite common I don't know
if they should do more than that I don't
know or even if there would be a process
for them to reach out to law enforcement
and in this case as well you know if
there a virus scanning product like that
they could be installed on any endpoint
in any country and you know how would we
impact act that on a global scale so I
don't know if they could or if they
should yes here in the
middle
yeah so again to summarize for the video
and remote people um why why could a web
browser not do something like have a
sensible default that was Secure by
default and say okay you know like we
can't communicate with any other
external domains apart from the site
that we're loading from if you want to
go speak to some other third party maybe
there should be some process
notification something and yeah like
it's a great idea and if we were to
rebuild the web now like that is
absolutely how it would be the problem
that we always have with situations like
this is like you know why are things
like CSP and SRI always retrofit and
it's because we can't change the default
Behavior because it's so deeply
ingrained so we end up saying okay well
like this is how it works that sucks so
we've added this new thing that you can
turn on to fix the thing if we change
the default Behavior it would just break
too much stuff it would
be yeah maybe we could draw some Line in
the Sand like that and just say after
this day you know tough you're just
going to have to do one of these things
one of the common comparisons I draw
here though is our efforts to try and
migrate the web to https which was a
really big thing from like 2013 onwards
after the Snowden Revelations everybody
really understood the problem and was
like hey we do all this like you know
sensitive information and private stuff
and messaging and communication online
it should all be encrypted so other
people can't see it and that effort is
still ongoing now and I think that was a
way bigger impact and if we look at how
big that was by comparison and still how
we're fighting that fight when I look at
something like this that's comparatively
smaller I think we're never going to
have the the effort you know we're never
going to be able to achieve that little
bit doomsayer there actually but that's
what I think
y
yeah I agree yeah so I'll res sumarize
for everybody there and please correct
me if I'm wrong so essentially like when
we started the drive towards encryption
on the web we had incentives like if you
move your website to https you would get
a boost in your SEO ranking so there
were like
positive um like the thing that I
usually say is instead of hitting people
with the stick we dangled the carrot and
that was better so that's essentially
kind of the path that you're going with
this I think
yeah like we definitely need to
incentivize this the question is always
how do we do it and I hear people and in
the media and a lot I talk about
legislation you know in the UK we have
like the kite Mark for engineering
standards and like fire safety standards
things aren't allowed to just blow up
and set on fire should we have like a
cyber standard for security and say look
like if you achieve this minimum level
of security you get like the stamp to
say you've met the minimum requirement
and I like the idea of things like that
the thing that always scares me
is technology typically moves faster
than legislation can and eventually
legislation hinders rather than helps so
that would be my only big concern with
enforcing it via legislation we have
complianc thingss like PCI if anybody
does payment card processing you'll know
about PCI but how would we where would
the incentive come from if not from
legislation I was think
o
yeah I think this nicely ties into the
question from the back as well around
you know yes maybe the browsers like
certainly the larger browsers like
Chrome Firefox Safari would have the
effort to push something like this but
given that they've just burned all of
their capital on pushing https we also
have to be careful that they don't try
to do too much too fast and I think
these things would also
probably I don't know they just don't
have the same impact as encrypting the
web did if we were to put them side by
side any more questions just got enough
time for one
more
yeah
yes so good question um were the
government able to get the Hacker's
wallet shut down so because of the way
that Monero Works no you can't do that
unfortunately one of the weird things
that we learned later was because we
didn't really spend any res resources on
this until much later was we really
tried to identify precisely when was the
file Chang to see how long had the
JavaScript been there and then you can
kind of try and figure out because on
mono you can't look at the wallet and
see how much money they made either so
it's like okay well we'll have to like
estimate and it turns out that the J we
found it on the Sunday morning like Ian
first notified me and we started
investigating they put it there on the
Saturday
night so it had been there about 14
hours so if you look at the major
headlines um from like Wy and a couple
of the other outlets they did some basic
calculations and they were like they
probably made about
$40 so I was like you know committing
like major International crimes like go
to prison forever stuff and they got
like probably $40 out of this I'd have
just given them that and done something
else all right is there one more
question go ahead
sorry yeah so if you run that Google doc
now that script tag is literally still
on some websites out there I don't know
if they were all part of the same attack
because the Google search is just
looking for the presence of the script
tag not how it got there but there are
definitely sites out there if you run
that Google doc that are still trying to
load that script tag now the really
funny thing is H does everyone know Troy
hunt that runs have I been pwned he now
owns the coinhive decom
domain little bit dodgy if you ask me um
so he Now controls the JavaScript that
loads when you load any JavaScript from
coinhive decom so yeah if you go here
and run this crypto do it will show you
the sites with the script tag but it's
not necessarily from the same attack
that we investigated but they are still
there that's live right now you can go
check
it which script sorry
the so if you load the any coinhive
JavaScript now it used to pop up a
message that was like hi I'm Troy hunt
and your website is probably hacked and
you should go and check stuff he has a
blog post about it it's quite funny and
the really funny thing is everybody lost
their mind they weren't crazy about this
CU like you're putting this message on
my website and I didn't author I'm like
you're running malicious JavaScript like
this this is not the problem that you
should be angry about right now um so
yeah it's still there you can go if you
search like Troy hunt coinhive it'll
take you straight to the blog where he
took control of the
domain uh any more
questions I'm around for the rest of the
event so if you see me today tonight
tomorrow come say hi uh thank you very
much for stopping
by