JavaScript supply chain attacks are a bit like rolling thunder. The boom starts in one location and then reverberates along a path, startling folks, shaking windows, and—if there is a significant enough storm to accompany the thunder—leaving varying degrees of devastation in its wake. Last week’s story on a multi-year campaign by threat actors to insert malicious JavaScript into vulnerable WordPress sites is a good reminder of the importance of client-side security and what businesses need to do to prevent JavaScript supply chain attacks against their websites and web applications.
Data-Stealing Malware
At the core of the problem is the criminal’s desire for sensitive data—credit card information, login credentials, and personally identifiable information (PII)—or to install adware or another type of malware. Threat actors access websites and web applications by leveraging existing vulnerabilities in JavaScript code or by creating malicious scripts designed to be injected directly into web applications. This data-stealing malware or adware can take the form of Magecart, JavaScript sniffers, cross-site scripting, formjacking, and a host of other client-side attack types.
JavaScript-Based Software Supply Chain Attacks
A software supply chain attack begins with software—in this case, client-side JavaScript code. JavaScript was never built with security in mind, making it extremely vulnerable to attack. There are several ways that JavaScript vulnerabilities can creep into client-side websites and applications:
- Developers with little or no experience in security inadvertently insert flawed or fragmented code into a web application or website.
- Threat actors manipulate existing web application source code by injecting malicious scripts directly into the website.
- Flawed or intentionally malicious JavaScript finds its way onto a web application via open source repositories and the software supply chain.
With so many websites and web applications assembled during the software development process by developers using third-party JavaScript from open source and third-party JavaScript libraries, it’s inevitable that applications will eventually come under attack. Any business using JavaScript code, add-ons, or plug-ins from third-party sources is placing themselves and their customers at risk.
Recent WordPress Attacks
In the case of the recent WordPress attacks, security researchers discovered malicious code had been embedded in hundreds of websites that redirected users to the same pages—but that instead contained phishing pages and malware, and sometimes unwanted pop-up advertising scams (like fake computer infection warnings). According to the researchers that discovered the attacks, hackers focused on injecting malicious scripts into WordPress themes and plugins containing known JavaScript security vulnerabilities.
The Growth of JavaScript Supply Chain Attacks
Software supply chain attacks currently dominate news headlines—in fact, recent studies suggest that supply chain attacks tripled in 2021, compared to 2020, and there’s no reason not to expect equal or higher growth in the coming years. According to a 2021 report published by ENISA, the European Union Agency for Cybersecurity, on the topic of the threat landscape for supply chain attacks, threat actors are focusing on both the existing code and malware that can exploit that code. According to the report, an estimated 66% of attacks focused on the supplier’s code and 62% of attacks relied on malware to exploit that code. With an estimated 98% of all web applications using JavaScript, businesses can expect the impact of JavaScript supply chain attacks to reverberate globally.
Automation and Synthetic Users Can Help Prevent Attacks
Advanced client-side security solutions, such as client-side attack surface monitoring solutions use automation to protect websites and web applications. By deploying synthetic users during threat detection scans to act and interact as a real human would, these types of solutions autonomously simulate real user behavior to identify malicious scripts and unauthorized actions on web assets and then classify and report on client-side security vulnerabilities and attacks. Other client-side attack surface monitoring solutions use JavaScript security permissions to prevent data exfiltration by automatically applying security configurations and permissions for continuous protection from malicious client-side activities and third-party scripts.
Guide to Preventing JavaScript Supply Chain Attacks
Our new white paper—Guide to Preventing JavaScript Supply Chain Attacks—can give organizations a head start on the ins and outs of the types of threats and attacks impacting businesses today. The white paper provides readers with a guide for understanding how vulnerable JavaScript impacts a supply chain intricately connected to and embedded in modern websites and web applications. It explores the fundamental dangers associated with JavaScript-based, client-side coding structures, including how the software development process can sometimes create fractured and vulnerable code.
- Understand client-side vs. server-side threats
- Learn about inherent JavaScript vulnerabilities
- Explore the client side and supply chain connection
- Understand different types of JavaScript exploits
- Understand attack impacts
- Learn how to prevent attacks
Learn More
It is no longer enough to simply secure the perimeter and server side with tools like web application firewalls. Organizations must protect their front end or “client side” if they want to protect their JavaScript assets and ensure end user safety.
I’d like to invite you to download the white paper—Guide to Preventing JavaScript Supply Chain Attacks—to get an improved understanding of the impacts of JavaScript attacks and the importance of client-side security.