this post was submitted on 25 Jun 2024
76 points (98.7% liked)

Programming

17364 readers
171 users here now

Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!

Cross posting is strongly encouraged in the instance. If you feel your post or another person's post makes sense in another community cross post into it.

Hope you enjoy the instance!

Rules

Rules

  • Follow the programming.dev instance rules
  • Keep content related to programming in some way
  • If you're posting long videos try to add in some form of tldr for those who don't want to watch videos

Wormhole

Follow the wormhole through a path of communities !webdev@programming.dev



founded 1 year ago
MODERATORS
top 12 comments
sorted by: hot top controversial new old
[–] stevedidwhat_infosec@infosec.pub 27 points 4 months ago* (last edited 4 months ago) (1 children)

For anyone interested - I’d you are using umatrix to block shit you can punch these lines into a new text file and import as blocklist, then commit it with the tiny arrow that points left toward the permanent list to save it permanently:

* www[.]googie-anaiytics[.]com * block

* kuurza[.]com * block

* cdn[.]polyfill[.]io * block

* polyfill[.]io * block

* bootcss[.]com * block

* bootcdn[.]net * block

* staticfile[.]org * block

* polyfill[.]com * block

* staticfile[.]net * block

* unionadjs[.]com * block

* xhsbpza[.]com * block

* union[.]macoms[.]la * block

* newcrbpc[.]com * block

Remove the square brackets before saving the file - these are here to prevent hyperlinks and misclicks.

Edit: this is not a bulleted list, every line must start with an asterisk, just in case your instance doesn’t update edits made to comments quickly.

Edit2: added new IOCs

Edit3: MOAR IOCS FOR THE HOARDE

[–] gex@lemmy.world 9 points 4 months ago (1 children)

The first domain should be googie-anaiytics, the L in analytics was replaced with an i

[–] stevedidwhat_infosec@infosec.pub 5 points 4 months ago

Good catch! Missed that one

[–] mark@programming.dev 8 points 4 months ago (1 children)

Not many things require a polyfill these days. My guess is a lot of older sites are affected.

[–] stevedidwhat_infosec@infosec.pub 7 points 4 months ago

Intuit uses pollyfill… and a lot of people use that service.

Cloudflare and fastly wouldn’t be setting up mirrors if it weren’t still being used, I can guarantee that.

[–] onlinepersona@programming.dev -4 points 4 months ago (1 children)

Opensource devs need to get paid a living wage 😩 This stuff keeps happening and somehow, I can't completely blame the devs. Thousands of sites use the product and barely anybody donates. It's not sustainable.

Anti Commercial-AI license

[–] stevedidwhat_infosec@infosec.pub 23 points 4 months ago (2 children)

This has almost nothing to do with what you’re talking about.

A Chinese company bought the domain and the service in February and are attacking people in highly specific conditions. (Mobile devices at specific times)

This is an attack. Not negligence, not an uh oh oopsie woopsie fucky wucky. Attack.

[–] sukhmel@programming.dev 8 points 4 months ago

I understood the original comment as "if devs were paid they wouldn't sell out". Which is probably valid, more or less

[–] onlinepersona@programming.dev 0 points 4 months ago (1 children)
[–] stevedidwhat_infosec@infosec.pub 2 points 4 months ago (1 children)

… he made plenty off the product and made additional when he sold. Devs ability to make money has nothing to do with companies coming in and injecting malware to the service.

Any threat actor group with sufficient funds from various campaigns, spyware, etc could use said funds to buy out a dev, owner, etc.

Not to mention state-sponsored threat actors. This is the perfect example of distracting from the fact of what happened.

[–] onlinepersona@programming.dev -1 points 4 months ago (1 children)

You don't believe that income (or lack thereof) can motivate the sale of a popular library to a shady party?

Any threat actor group with sufficient funds from various campaigns, spyware, etc could use said funds to buy out a dev, owner, etc.

I don't see VLC being bought out.

This is the perfect example of distracting from the fact of what happened.

If you say so... this isn't the first time an underpaid opensource dev sold their project only for it to end up being used for ads or malware.

Anti Commercial-AI license

[–] stevedidwhat_infosec@infosec.pub 2 points 4 months ago* (last edited 4 months ago)

Not at all what I meant. The premise was that this wouldn’t happen if they were being paid fairly. Supply chain attacks happen with or without fair pay.

Look at what happened with the XZ backdoor. Whether or not they’re getting paid just means a different door is opened.

The root of the problem is that we blindly trust anyone based on name-brand and popularity. That has never in the existence of technology been a reliable nor an effective means of authentication.

If it’s not outright buying out companies it will be vulnerabilities/lack of appropriate management, if it’s not vulns it’ll be insider threat.

These are problems we’ve known about for at least a decade+ and we’ve done fuck all to address the root of the problem.

Never trust, always verify. Simple as that.