Polykill Sites reported to be using cdn.polyfill.io (as of Feb 27,2024)

DHS is trying to fight Chinese infiltration. https://www.theverge.com/2024/6/24/24185013/homeland-securit...

alitonium commented Jun 21, 2024

{For specific details:

    The compromised url is: https://cdn.polyfill.io/v2/polyfill.min.js
    Behavior: The first time a user, who uses a phone, open a website through an ads ( google ads or facebook ) with this link, it will redirect user to a malicious website.
    How it works:
        The request send to https://cdn.polyfill.io/v2/polyfill.min.js needs to match the following format:
        Request for the first time from a unique IP, with a unique User-Agent.
        User-Agent match that of a phone, we used an iphone's user agent ( Mozilla/5.0 (iPhone14,2; U; CPU iPhone OS 14_0 like Mac OS X) AppleWebKit/602.1.50 (KHTML, like Gecko) Version/10.0 Mobile/15E148 Safari/602.1 ).
        Referer from a reputable website that installed polyfill.
        Accept /
        Accept-Encoding gzip, deflate, br, zstd
        Delete all cookies

The request will return the original polyfill code, appended with a piece of malicious code. This code will make a run javascript from https://www.googie-anaiytics.com/ga.js , if the device is not a laptop. You can reproduce this multiple time on the same machine by changing User agent gently, (ex: change Mozilla/5.0 to Mozilla/6.0). Sometimes the server will just timeout or return code without the injection, but it should work most of the time.

{malignant code as per comments https://github.com/alitonium}

The javascript on https://www.googie-anaiytics.com/ga.js will redirect users to a malicious website based on some condition. I cannot check this further due to the lack of time. The content of gooie is here https://pastebin.com/hAgtHd70 in case they delete it.

The code check for a number of conditions before running ( useragent, screen width, ...) to ensure it is a phone, the entry point is at the end:

bdtjfg||cnzfg||wolafg||mattoo||aanaly||ggmana||aplausix||statcct?setTimeout(check_tiaozhuan,-0x4*0x922+0x1ebd+0xd9b):check_tiaozhuan();

The code has some protection built-in, so if it is run on a non-suitable environment, it will attempt to relocate a lot of memory to freeze the current devices. It also re-translate all attribute name access with _0x42bcd7 .

At this point I think we can definitely conclude that the is a compromised CDN without having to further dig into the remaining obfuscated code.}

https://github.com/polyfillpolyfill/polyfill-service/issues/...