Hacker News Reader

It's injecting the malicious script into the source of http pages. With httpS, this is not possible unless you also change the root certificate of the computer.

From the article :

"Mitigations

These attacks would not be successful if the following resources were served over HTTPS instead of HTTP:

http://push.zhanzhang.baidu.com/push.js; orhttp://js.passport.qihucdn.com/11.0.1.js

You may want to consider blocking these URLs when not sent over HTTPS."

The cannon is injected into HTTP resources.

In most javascript sandboxes if you request a domain from an site you are restricted by the same content policy. This makes it harder to do things like make requests to sites for example that don't use https when your on one that does use it.

https://developer.mozilla.org/en-US/docs/Web/Security/Same-o...