The new Chinese owner of the popular Polyfill JS project injects malware into more than 100 thousand sites
sansec.io
The polyfill.js is a popular open source library to support older browsers. 100K+ sites embed it using the cdn.polyfill.io domain. Notable users are JSTOR, Intuit and World Economic Forum. However, in February this year, a Chinese company bought the domain and the Github account. Since then, this domain was caught injecting malware on mobile devices via any site that embeds cdn.polyfill.io. Any complaints were quickly removed (archive here) from the Github repository.
You are viewing a single comment
Mate, actionscript was not only basically JavaScript with adobe vendor extensions, but it was literally a programming language! If that's not arbitrary code, then you've got a crazy definition of what is! You've kinda unequivocally demonstrated that you have no idea what you're talking about at this point, I'm afraid.
And way to completely misunderstand the evercookie. The flash part was how it could jump between browsers, no browser cookie can do that. It was a combination of everything that made it such a problem.
Arbitrary code execution is a vulnerability where you write and execute arbitrary code outside of the intended environment
Just because Actionscript is a language doesn't mean it has the functionality to do whatever to your machine. It lacks most of those functions because it is mostly a graphics library. It would have to run an already prepared external script via some improper memory pointer somewhere for it to be arbitrary code execution.
And Actionscript is not built on top of JavaScript. Both JavaScript and ActionScript are based on ecmascript. They are different, just like Typescript and JavaScript are different.
Actionscript was object oriented and had proper types unlike JavaScript which to this day is one of the worst programming languages.
Are you sure I'm the one misunderstanding the problem of evercookie? Was the problem that you could access the same cookies from multiple browsers because of ActionScript, or was it that evercookie maliciously restored said deleted cookies after they were supposed to no longer be used? One is a feature that allows transferring sessions between browsers on the same computer. The other is essentially malware.
ECMAscript is based on JavaScript
I'm not gonna bother entertaining the rest of your post, you can't seem to even get the basics right
Ecmascript was made to standardize JavaScript, but it isn't based on JavaScript. Actionscript is then based on ecmascript, making Actionscript a sibling to JavaScript, not a subset.