Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 3 down vote favorite

I was doing some research on Content Delivery Networks. For those who don't know, a CDN is a large collection of servers that cache and quickly serve up static content such as images, css, js, etc, to end users. CDNs can significantly increase performance by not only caching content but by also limiting the number of network hops to retrieve content.

I'm considering using free CDNs but I was surprised to find next to zero articles, blogs, or forums concerning potential security risks when using them. What are the risks of using free CDNs? How are those risk mitigated?

share|improve this question
2  
I think your question lacks a few important details. What is your exact use case, for example? – 0xC0000022L Jul 3 '12 at 20:18
Can you provide a few examples of the free CDNs you are considering? – Mark Jul 3 '12 at 21:59

migrated from stackoverflow.com Jul 3 '12 at 20:11

1 Answer

up vote 5 down vote

Since you are usually loading CSS, JavaScript and graphics from a CDN anyone with root-like permissions on the CDN servers (i.e. the company running the CDN) can:

  • replace your images with other ones, such as porn or other things you don't want your users to see on your website
  • replace your CSS to load said images, mess up the design, etc. - for IE and Mozilla/Firefox users the CSS could also cause arbitrary JavaScript code to be executed
  • replace your JavaScript to annoy your user, redirect to other sites, possibly load exploit code to infect them with trojans
  • (have technical problems causing your site's assets to load much slower than normally)

So all in all, only use a CDN you trust enough not to do those things.

share|improve this answer
"replace your CSS to load said images, mess up the design, etc." CSS can also contain JS! – curiousguy Jul 3 '12 at 22:40
2  
"for IE users the CSS could also cause arbitrary JavaScript code to be executed" (via behavior) - did I miss a way that works in other browsers? – ThiefMaster Jul 3 '12 at 22:48
1  
@ThiefMaster It's possible in Firefox, too. See Zach's answer on stackoverflow.com/questions/476276/using-javascript-in-css – Polynomial Jul 4 '12 at 15:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.