Millions of sites could've been exposed in the Polyfill, BootCDN, Bootcss, and Staticfile attack - and it was all orchestrated by a single operator
Briefly

from ITPro6 months ago
The concerns are that any website embedding a link to the original polyfill.io domain, will now be relying on Funnull to maintain and secure the underlying project to avoid the risk of a supply chain attack, Cloudflare's Sven Sauleau and Michael Tremante explained.
ITProhttps://www.itpro.com/security/millions-of-sites-couldve-been-exposed-in-the-polyfill-bootcdn-bootcss-and-staticfile-attack-and-it-was-all-orchestrated-by-a-single-operator
Such an attack would occur if the underlying third party is compromised or alters the code being served to end users in nefarious ways, causing, by consequence, all websites using the tool to be compromised.
ITProhttps://www.itpro.com/security/millions-of-sites-couldve-been-exposed-in-the-polyfill-bootcdn-bootcss-and-staticfile-attack-and-it-was-all-orchestrated-by-a-single-operator
Concerns materialized on 25 June when threat intelligence network Sansec claimed the new Chinese owner of the Polyfill project was injecting malicious code into over 100,000 websites.
ITProhttps://www.itpro.com/security/millions-of-sites-couldve-been-exposed-in-the-polyfill-bootcdn-bootcss-and-staticfile-attack-and-it-was-all-orchestrated-by-a-single-operator
Read at ITPro
#supply-chain-attack #cdns #website-security #polyfill #risk-mitigation
[
|
]