Critical Supply-Chain Vulnerability in Runtime Client-Side Rendering Affects 50 Software and Device Platform Types
A four-year research study by nDiligence, Inc. reveals a widespread cybersecurity vulnerability named "Attack the Glass" (ATG) affecting 50 types of platforms including web browsers, mobile apps, vehicle and medical device displays, and industrial control screens. The vulnerability stems from the practice of runtime client-side rendering, where user interfaces are composed on users' devices from code and data sourced from multiple suppliers. An attacker controlling any single supplier can manipulate the application's behavior and content after security checks, potentially deceiving users and undermining trust without detection. The study highlights a real-world example involving Polyfill.io's domain takeover and warns that current security measures like encryption, Zero Trust, and firewalls are ineffective once compromised code is loaded onto devices. The research includes detailed documentation, demos, and mitigation strategies, and calls for urgent attention from cybersecurity communities to protect critical infrastructure and decision-making systems. This article announces the public release of the full ATG research, including a sixteen-chapter whitepaper, twenty online demos, and remediation playbooks under TLP:CLEAR. It emphasizes the realistic threat scenarios of manipulated UI content influencing critical decision makers, including commanders and infrastructure operators. The disclosure follows more than two years of private government briefings and reiterates the original example of the Polyfill.io incident, underscoring that traditional security measures do not detect or prevent this attack once runtime client-side code is loaded. This public release increases accessibility to mitigation strategies and encourages widespread security community engagement.
Linha do tempo
-
nDiligence Publishes Comprehensive Public Research on Critical 'Attack the Glass' Supply-Chain Vulnerability Impacting Diverse Platforms
This article announces the public release of the full ATG research, including a sixteen-chapter whitepaper, twenty online demos, and remediation playbooks under TLP:CLEAR. It emphasizes the realistic threat scenarios of manipulated UI content influencing critical decision makers, including commanders and infrastructure operators. The disclosure follows more than two years of private government briefings and reiterates the original example of the Polyfill.io incident, underscoring that traditional security measures do not detect or prevent this attack once runtime client-side code is loaded. This public release increases accessibility to mitigation strategies and encourages widespread security community engagement.
ler a análise desta fonte ocultar
This article announces the public release of the full ATG research, including a sixteen-chapter whitepaper, twenty online demos, and remediation playbooks under TLP:CLEAR. It emphasizes the realistic threat scenarios of manipulated UI content influencing critical decision makers, including commanders and infrastructure operators. The disclosure follows more than two years of private government briefings and reiterates the original example of the Polyfill.io incident, underscoring that traditional security measures do not detect or prevent this attack once runtime client-side code is loaded. This public release increases accessibility to mitigation strategies and encourages widespread security community engagement.
nDiligence, Inc. has publicly released its extensive four-year study titled Attack the Glass (ATG), revealing a critical supply-chain vulnerability affecting 50 types of software and device platforms that use runtime client-side rendering. This vulnerability allows attackers who compromise a single supplier to manipulate what users see and do in applications after all conventional security checks have passed, undermining trust in digital interfaces across sectors including government, critical infrastructure, and healthcare. The study provides demonstrations and remediation playbooks, emphasizing the risk of undetectable screen content manipulation capable of deceiving users, disrupting critical operations, and degrading trust. The research builds upon previous incidents such as the 2024 Polyfill.io domain compromise and has been shared after extensive private briefings with governments, highlighting an urgent need for industry-wide vulnerability awareness and mitigation.
-
Critical Supply-Chain Vulnerability in Runtime Client-Side Rendering Affects 50 Software and Device Platform Types
ler a análise desta fonte ocultar
A four-year research study by nDiligence, Inc. reveals a widespread cybersecurity vulnerability named "Attack the Glass" (ATG) affecting 50 types of platforms including web browsers, mobile apps, vehicle and medical device displays, and industrial control screens. The vulnerability stems from the practice of runtime client-side rendering, where user interfaces are composed on users' devices from code and data sourced from multiple suppliers. An attacker controlling any single supplier can manipulate the application's behavior and content after security checks, potentially deceiving users and undermining trust without detection. The study highlights a real-world example involving Polyfill.io's domain takeover and warns that current security measures like encryption, Zero Trust, and firewalls are ineffective once compromised code is loaded onto devices. The research includes detailed documentation, demos, and mitigation strategies, and calls for urgent attention from cybersecurity communities to protect critical infrastructure and decision-making systems.