Auditing Archives: The Case of the Evil JavaScript

Quick Answer: Why Is Third-Party JavaScript Risky on Payment and Login Pages

‍
Third-party scripts (Google Analytics, widgets, marketing tools) can become "evil scripts" if compromised, letting attackers steal card numbers and passwords from payment pages.

• A compromised third-party script can be modified to perform actions beyond its original purpose without the developer's knowledge.
• Modified scripts can locate stored variable values on a page and exfiltrate them to the attacker.
• Avoid including unnecessary third-party scripts on pages that handle sensitive data, like payment and login forms.
• This is one reason PCI DSS emphasizes monitoring and inventorying scripts on payment pages.

‍

Dynamically included script is usually good, but no good deed goes unpunished.

The following post is a segment in the Auditing Archives series. Hopefully the security failures I’ve seen while auditing businesses will help inspire better practices to ensure your own business security.

‍Virtually all ecommerce sites add or include third party scripts to their website. Google Analytics, for example, provides a free, in-depth view into site traffic and visitor demographics. Other common third parties include widget manufacturers, marketing firms, and social media platforms.‍

See also: PCI 3.0: What You Need to Know‍

The problem comes when a web developer includes third party script on pages that accept sensitive information (e.g., payment page, login page). If that third party script code has been compromised and modified to perform additional or other actions than its original intention, a hacker could use the modified script to glean sensitive data from the page. This new ‘evil script’ can locate stored variable values (credit card numbers, passwords, and other sensitive information) and send them back to its creator.

Check out the Slideshare.

Auditing Archives: The Case of the Evil Java Script from SecurityMetrics ‍