> At the time, BA said hackers had carried out a "sophisticated, malicious criminal attack" on its website.
Compromising a single JS resource that was being carelessly loaded on a payment page doesn’t qualify as sophisticated in my mind. It might not be uncommon in the industry, but tools like SRI and CSP stop these attacks dead in their tracks.
I believe we are about one huge attack[0] of this kind away from realising how dire the situation truly is.
As a victim of the earlier Ticketmaster attack I’m curious as to if the ICO is investigating that too.
Compromising a single JS resource that was being carelessly loaded on a payment page doesn’t qualify as sophisticated in my mind. It might not be uncommon in the industry, but tools like SRI and CSP stop these attacks dead in their tracks.
I believe we are about one huge attack[0] of this kind away from realising how dire the situation truly is.
As a victim of the earlier Ticketmaster attack I’m curious as to if the ICO is investigating that too.
0: https://hugotunius.se/2018/11/29/how-to-hack-half-the-web.ht...