-3

I was reading about CDN services and how they work. I saw this article about how a US army site got hacked by using a CDN:

https://www.welivesecurity.com/2015/06/09/us-army-website-hack/

When hackers hack a CDN service, they can log in to the site? and upload shell maybe? or just hijack it like DNS hijack attacks?

3

If you were reading about how CDNs work, then you will know that the CDN serves copies of the assets on the source site. Just like the article you linked talked about.

Hacking the CDN does not mean that they have access to the backend of the source site to log in or place shells.

The attackers can, as the article describes, serve whatever content they would like to visitors, like malware.

If, on the other hand, you were asking what could be done on the CDN if the CDN gets hacked, then that's a completely undefined question. It's like asking what damage can be done when a server gets hacked. It depends on what access the hackers got when they hacked the CDN.

2

A CDN is supposed to allow sites to reference a remote, publicly available resource (e.g. a script, stylesheet, font, etc), rather than embedding it themselves, and allow the browser to cache it. If the CDN is compromised, then so is the resource.

For instance, let's say that the CDN for Bootstrap is compromised and somebody replaces it with a malign version that includes a keylogger. Every site that references the CDN will then download bootstrapThatTotallyHasntBeenCompromised.min.js and expose their users to a keylogger.

In the example above, the hackers uploaded a new version that spawned an alert on page load with a propaganda message. In this particular instance, it's not that severe (see the XKCD strip at the bottom of the article), but it could have been a lot worse.

EDIT: one thing that could help mitigate this is sub-resource integrity (SRI). This is just a fancy term for providing a checksum hash for the resource; if the hash from the downloaded resource doesn't match the hash that's published by the CDN, then the browser will block it. Troy Hunt has a bit more detail here.

Obviously, SRI doesn't help at all if the CDN deliberately uploads a malign version and publishes the hash for that, but that's a different kettle of fish entirely.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.