Vampires in the Browser: banishing uninvited Javascript from your web app
summary
Examples show third‑party JS actually stealing data and computing power: CoinHive cryptojacking mines tiny sums, while Magecart skimming compromises ~400,000 customers and costs British Airways ~£20M in fines. Vulnerable CDNs and services like jsDelivr unpkg raw.githack RawGit and ad/marketing layers such as Google Tag Manager are the attack surface. Practical counters are concrete: capture outgoing requests with a proxy, enforce subresource integrity, tighten origins with content security policy, host or hash assets, and monitor for unexpected changes.
AI-written summary · about
chapters (11)
- 0:00Intro
- 1:04What is a vampire
- 2:53How Javascript is served
- 3:48Thirdparty JS attacks
- 8:40githack
- 12:11How to spot a vampire
- 13:31Technical solutions
- 15:07User experience
- 15:50Vampire guests
- 19:40The End
- 20:25Outro
related talks
40mHostile JavaScript: Attacking and Defending the Browser
57mYour Website Is Running Code You’ve Never Seen
55mWeb Application Security: Browsers Fight Back!
38mCaught My WebApp Cheating on Me!
33mHacking The Front-End
33mHacking your Front-End Apps
29mYour Scripts In My Page - What Could Possibly Go Wrong?
52mBreaking Fraud and Bot Detection Solutions