Last week, Polymarket, a “prediction market” (really just a casino where you bet on things happening or not) was hacked.
The hackers got in by compromising DebugBear, a service that measures your site’s performance via a small script injected into its pages.
It was DebugBear this time, but the principle is general and works on pretty much any external service that invites you to add their script(s) to your website: HubSpot, CookieBot, Intercom, Adobe Fonts, … , everyone.
If any third-party is compromised, malicious code can be injected into every single website that depends on that third-party’s scripts. That’s what we call a supply-chain attack.
There are ways to mitigate this risk but, to be honest, I can count the number of sites that do it on my fingers. Because not bothering is a lot easier.
Getting a bit technical here, so send it to your IT people if your eyes glaze over: the ideal protection is a combination of Subresource Integrity (SRI) and pinning.
With SRI, you add a cryptographic hash to the code that calls the script (a hash is a sort of fingerprint of the file). If the script changes even by a single character, the fingerprint no longer matches, and browsers refuse to load the file.
Pinning is fixing the version of the script your site calls. Instead of saying “load the latest version” which is what many sites do, you say “load version 3.7.3”.
Combining both will protect you from bad things getting injected into your site. Ask your IT people to set it up (they’ll probably complain).
If your site loads third-party scripts, check it with this scanner.
If the third-party isn’t offering SRI hashes by default, get your IT people to generate your own here.
Colin
PS: the first step is to ask yourself if you really need to load all these scripts