PWA as a new Cyber Attack Vector
summary
Progressive Web Apps rely on Service Workers that run outside pages and can persist after a visit; demos show a crafted JSONP registration can install a worker despite HTTPS/same‑origin assumptions. Once installed, it performs fetch interception, can modify uploads/downloads, load WebAssembly parsers, or wake on push/background sync to run a coinhive miner—proof‑of‑concepts demonstrate persistent crypto mining and even interference with Chrome extensions.
AI-written summary · about
chapters (13)
- 0:00Intro
- 0:46About Vitalii
- 1:37What is PWA
- 5:33Service Worker
- 6:39Service Worker Security
- 9:11Installation Process
- 12:31Register Service Workers
- 13:38Example
- 14:51HTTP request interception
- 15:44Chrome extension interception
- 16:33Request uploads
- 16:54WebAssembly
- 17:34Crypto mining
