We Are Volume’s Post

Google has blocked ads for e-commerce sites using Polyfill. io after a Chinese company altered its code, causing redirects to malicious sites. What is Polyfill. io? Polyfill. io provides code (JavaScript) that makes new web features work on older browsers. 🔒 Google states, "Protecting our users is our top priority. We've shared information to help affected advertisers secure their websites." Over 110,000 websites are affected by this attack; experts advise removing the library immediately. https://bit.ly/3Lve2Hj. #CyberSecurity #SupplyChainAttack #Polyfill #WebSecurity #EcommerceSecurity #GoogleAds #Sansec #HackersNews

Over 110,000 Websites Affected by Hijacked Polyfill Supply Chain Attack https://ift.tt/ltT864N Jun 26, 2024NewsroomSupply Chain Attack / Web Security Google has taken steps to block ads for e-commerce sites that use the Polyfill.io service after a Chinese company acquired the domain and modified the JavaScript library ("polyfill.js") to redirect users to malicious and scam sites. More than 110,000 sites that embed the library are impacted by the supply chain attack, Sansec said in a Tuesday report. Polyfill is a popular library that incorporates support for modern functions in web browsers. Earlier this February, concerns were raised following its purchase by China-based content delivery network (CDN) company Funnull. The original creator of the project, Andrew Betts, urged website owners to immediately remove it, adding "no website today requires any of the polyfills in the polyfill[.]io library" and that "most features added to the web platform are quickly adopted by all major browsers, with some exceptions that generally can't be polyfilled anyway, like Web Serial and Web Bluetooth." The development also prompted web infrastructure providers Cloudflare and Fastly to offer alternative endpoints to help users move away from Polyfill.io. "The concerns are that any website embedding a link to the original polyfill.io domain, will now be relying on Funnull to maintain and secure the underlying project to avoid the risk of a supply chain attack," Cloudflare researchers Sven Sauleau and Michael Tremante noted at the time. "Such an attack would occur if the underlying third party is compromised or alters the code being served to end users in nefarious ways, causing, by consequence, all websites using the tool to be compromised." The Dutch e-commerce security firm said the domain "cdn.polyfill[.]io" has since been caught injecting malware that redirects users to sports betting and pornographic sites. "The code has specific protection against reverse engineering, and only activates on specific mobile devices at specific hours," it said. "It also does not activate when it detects an admin user. It also delays execution when a web analytics service is found, presumably to not end up in the stats." San Francisco-based c/side has also issued an alert of its own, noting that the domain maintainers added a Cloudflare Security Protection header to their site between March 7 and 8, 2024. The findings follow an advisory about a critical security flaw impacting Adobe Commerce and Magento websites (CVE-2024-34102, CVSS score: 9.8) that continues to remain largely unpatched despite fixes being available since June 11, 2024. "In itself, it allows anyone to read private files (such as those with passwords)," Sansec said, which codenamed the exploit chain CosmicSting. "However, combined with the recent iconv bug in Linux, it turns into the security nightmare of remote code execution." It has since emerged that third-parties can gain A...

A great guide for those who work with Infatica proxies and AdsPower browser.

A lot of our customers ask how to use Infatica #proxy with AdsPower Browser. Learn how to integrate Infatica #proxies into AdsPower, a powerful tool for managing multiple accounts and browsers. Boost your online privacy and security with Infatica and AdsPower.

Supply chain risk. Do you know how many third party javascripts are running on your web estate? Do you know what they do, what they redirect to? Do you check them regularly? Third party javascripts are regularly compromised, to deliver skimmers, malware, or to subvert advertising revenue. From the hackernews article: "Google has taken steps to block ads for e-commerce sites that use the Polyfill[.]io service after a Chinese company acquired the domain and modified the JavaScript library ("polyfill.js") to redirect users to malicious and scam sites. More than 110,000 sites that embed the library are impacted by the supply chain attack, Sansec said in a Tuesday report." "The Dutch e-commerce security firm said the domain "cdn.polyfill[.]io" has since been caught injecting malware that redirects users to sports betting and pornographic sites. "The code has specific protection against reverse engineering, and only activates on specific mobile devices at specific hours," it said. "It also does not activate when it detects an admin user. It also delays execution when a web analytics service is found, presumably to not end up in the stats." https://lnkd.in/enETKeKJ

We are thrilled to share our fresh article "Browser Extension: Everything You Need to Know" with you all! 📚✨ 🔑 Key Benefits of Browser Extensions: 1️⃣ Greater Productivity: Browser extensions are powerful tools that enhance your online experience. They streamline tasks, automate processes, and save you valuable time. 2️⃣ Customization Galore: With browser extensions, you can personalize your browsing experience to suit your needs. From ad blockers to password managers, the possibilities are endless! 3️⃣ Enhanced Security: Browser extensions help protect your online privacy and security. They can block malicious websites, detect phishing attempts, and safeguard sensitive information. ✨Ready to dive deeper into the world of browser extensions? 💡✨ 🌐 Don't miss the full article on our website! Click the link below to discover how browser extensions can transform your browsing experience. 👇🔗 https://lnkd.in/dzNc3KQt Join the conversation and let us know your favorite browser extension in the comments below! 💬✨ #BrowserExtensions #TechTips #ProductivityBoost

Protecting online privacy starts with knowing what cookies are used by your websites. Page Shield extends transparent monitoring to HTTP cookies, empowering security and compliance teams with an easy overview without the need for an external scanner, nor changing existing web applications

Google Chrome will now notify users in Incognito mode, that user tracks will continue, thanks to a Google settlement of an Incognito class-action suit. This, together with the ability to not install certain ad blockers (due to loss of Google`s Youtube ad money), has made the browser a no-go for most. #privacy #data #web #browser #tech #cybersecurity https://lnkd.in/dtGMuPNX

The exploitation of trusted names continues: Over 110,000 domains relying on the Polyfill library have been hit with a supply chain attack. According to new reports, this attack affects such trusted organizations and platforms as the World Economic Forum, Intuit, and JSTOR, among others. Google just moved to block ads for websites utilizing the hijacked service. Bit of history: this all comes after a Chinese company (Funnull) acquired the domain and altered the JavaScript library ("polyfill[.]js"), redirecting users to malicious and scam sites. Researchers note significant difficulty in fully analyzing the modified script which does specific targeting and is apparently resistant to reverse engineering... #supplychainattack #polyfill #cybersecurity Andrew Borene David Franco Jay D. Tina Meeker, MBA, CISSP Andy Jenkinson Scott Niebuhr Daniel Peder Bagge Catharine Trebnick Mary Frantz Kate McKenna Dinos A. Kerigan-Kyrou Olga Nasibullina Sam Curry Paul Veeneman Elizabeth Stevens Phil Lay Tom Vazdar Alex Sharpe Micki Boland Daniel Cunningham Wendy Meadley Nick G. Lee Vorthman Karen Tulloh PMP, CISSP, CISM Petr Špiřík Jason S. Dr. Kristina Soukupova Michael A. Hennessy G M Faruk Ahmed, CISSP, CISA, CDCP Dr Doron Zimmermann (Cantab.) Fred Langford Will Rogers Matt Hayden Billy McDiarmid ☁️ Christophe Foulon 🎯 CISSP, GSLC, MSIT Shari Gribbin