Understanding the polyfill.io domain attack

tl;dr: The recent compromise of the polyfill.io domain has triggered a broad-reaching web supply chain attack, impacting over 100,000 websites across various sectors including finance, healthcare, non-profits, academia, and more. To ensure the security of your website, we strongly advise you immediately remove any reference to polyfill.io.

Latest update: 27th June 2024

Sansec, a leader in malware and vulnerability detection, has published the following update:

Namecheap has now set the status of the domain to clientHold, meaning it is no longer active in the DNS removing the current risk.
• Cloudflare has launched an automatic JavaScript URL rewriting service that redirects any link to polyfill.io found in proxied websites to its own version under cdnjs, ensuring site functionality and mitigating supply chain attack risks.
• polyfill.io must still be removed from your estate, but be aware of the risk of breakages so ensure that you use a replacement. You can find alternatives on Cloudflare and Fastly.

The Polyfill.io compromise

The term “polyfill” is commonly used to describe libraries that help resolve inconsistencies across different web browsers, especially older browsers where cutting-edge technologies are not available. Although polyfill.io was not directly related to the concept, it became a trusted resource for finding and adding these polyfills. 

The polyfill.io domain was sold to a Chinese company, Funnull, in February 2024. It was subsequently discovered that polyfill.io started injecting malicious code into its scripts, causing anyone visiting a website using this domain to unknowingly run malware in their browser.

The malicious code injected through cdn.polyfill.io is sophisticated, dynamically generating payloads based on HTTP headers. It activates only on specific mobile devices, avoiding detection by evading admin users and delaying execution. Websites embedding the compromised scripts may inadvertently redirect visitors to malicious sites, exposing them to further risks such as fake Google Analytics links leading to dubious destinations.

Google has been sending warnings about loading third-party JavaScript from domains like polyfill​.​io and is now blocking Google Ads for websites that use the compromised code.

We’re recommending that all references to polyfill.io be removed from estates due to the potential risk from the wider domain. 

Identifying impacted Red Sift customers

Our headless browser, part of Red Sift ASM, conducts a full daily inspection of all websites monitored in our customers’ estates. We then surface the technologies, libraries, and third-party services that are used by the site, including Polyfill, along with any domains that are found in the HTML of the page that these rely on. This information is also utilized in our HTML Content Check (previously known as Mixed Content check).

Having this information readily available allowed us to quickly check all our customers’ accounts and identify the websites containing the compromised domain name. Our Customer Success team then personally notified each affected customer.

What you should do right now

To ensure the security of your website, we strongly advise you to immediately remove any reference to polyfill.io from your estate.

Should you require alternatives for Polyfill hosting, you can find them on Cloudflare and Fastly.

How Red Sift helps to continuously and proactively prevent these attacks

As mentioned, Red Sift ASM is already able to detect the technologies, libraries, and third-party services, including domains, so that customers can quickly discover when malicious technologies and related assets are part of their external attack surface.

Having this capability also meant we could react rapidly to add warnings about dangerous activity to Red Sift. From today, Red Sift ASM customers will:

1) See an Issue created if the poisoned domain polyfill.io is found anywhere in their monitored estate. The issue explains the reason for the critical warning and the steps that are required to remove the risk from the estate.

2) See a warning in our HTML Content check if the poisoned domain polyfill.io is found anywhere in their monitored estate.

Get protected now

To learn more about Red Sift ASM and how it can continuously help you stay on top of these types of threats, why not book a demo. In the meantime, if you have any questions or need assistance, please contact us

PUBLISHED BY

Francesca Rünger-Field

27 Jun. 2024

SHARE ARTICLE:

Categories

Recent Posts

VIEW ALL
News

Introducing DNS Guardian: Stop impersonation and spam caused by domain takeovers 

Rahul Powar

tl;dr: We’re thrilled to announce DNS Guardian — a new feature in Red Sift OnDMARC that can swiftly identify and stop domain takeovers that lead to malicious mail. Back in February, we shared updates with the community about SubdoMailing – an attack discovered by Guardio Labs. The attack was a form of subdomain takeover,…

Read more
Security

Navigating the Information Security Landscape: ISO 27001 vs. SOC 2

Red Sift

As cyber threats evolve, so do the standards and frameworks designed to combat them. Two of the most recognized standards in information security are ISO 27001 and SOC 2. What sets them apart, and which one is right for your organization? Let’s delve into the key differences. Purpose and Scope: Global Framework vs. Client-Centric…

Read more
News

G2 Summer 2024 Report: Red Sift OnDMARC’s Winning Streak Continues

Francesca Rünger-Field

We’re delighted to announce that Red Sift OnDMARC has again been named a Leader in G2’s DMARC category for Summer 2024. This recognition is based on our high Customer Satisfaction scores and strong market presence. Red Sift appeared in 11 reports – 5 new ones since Spring 2024! – earning 5 badges: A few…

Read more
News

Google will no longer trust Entrust certificates from October 2024

Red Sift

Tl;dr: Google has announced that as of October 31, 2024, Chrome will no longer trust certificates signed by Entrust root certificates. While there is no immediate impact on existing certificates or those issued before 31st October 2024, organizations should start reviewing their estate now. On Thursday 27th June 2024, Google announced that it had…

Read more
News

Understanding the polyfill.io domain attack

Francesca Rünger-Field

tl;dr: The recent compromise of the polyfill.io domain has triggered a broad-reaching web supply chain attack, impacting over 100,000 websites across various sectors including finance, healthcare, non-profits, academia, and more. To ensure the security of your website, we strongly advise you immediately remove any reference to polyfill.io. Latest update: 27th June 2024 Sansec, a…

Read more