Does including all these 3rd party javascript files impose a security risk?

Question

When you have all these various javascript files included on a page for various services like website analytics, click tracking etc., doesn't this create a huge security risk because using javascript they can hijack the persons credit card that is entered on the form?

How is this even considered to be safe currently?

Meaning, your server is security, your payment provider is secure, you have SSL, but if someone was to hack into any of these services people use (I see over 10+ services many sites use to track clicks, ad related, etc) then they can comprise your payment form.

Karolynkaron

Answer 1

Yes this is a security risk, known as a third party script include.

By including a script on your page hosted by a 3rd party, you are trusting that the external domain is not malicious nor compromised. By using a <script src="//example.com"> tag, the third party domain has full control of the DOM on your site. They can inject whatever JavaScript they wish.

You are right to be concerned. PageFair was recently compromised bringing down every site that it offered its analytics service to with it. You should verify all third party domains that you are referencing for script, and ensure you trust them. For example you are probably OK with the big guys such as Google and Facebook, however any others you should consider either dropping them or reviewing the script code and then hosting locally on your domain instead.

You can mitigate this with subresource integrity:

<script src="https://example.com/example-framework.js"
        integrity="sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC"
        crossorigin="anonymous"></script>

This will ask the browser to check that the loaded script has the specified cryptographic hash. Any changes to the script, even as much as a single character, would produce a completely different hash enabling any changes to be detected and the script would be rejected from loading and running. As of August 2018, all major browsers support it except for IE and iOS Safari.

Rescission

Yeah maybe running a background service that scans for changes in their script, and then alerting of that chance. Then again, the script is all minimized so have fun trying to figure it out! – Karolynkaron

Answer 2

EDIT: As has been pointed out to me in the comments, you cannot solve all of your JavaScript security problems by downloading all of the resources over HTTPS, as I asserted in a previous version of this answer. Instead, that simply reduces the problem to how much your end user can safely trust the provider of the JavaScript itself - and if the service gets compromised or is an actively malicious organization, they can't.

There are two primary ways that hosts can solve this problem and make their JavaScript downloads more reliable for their users:

1. Where it doesn't make sense, don't include the JavaScript component at all. One thing you will notice on Amazon.com, for instance, is that while the normal shopping pages have header bars and are full of extra information and advertising and all that, the actual checkout page, where you enter your payment information, is almost blank - most of the styling and scripting is not included, and there are certainly no ads on the page.
2. If you need the component, but can host the script yourself, do so. That way, unless you yourself are compromised, you can be confident that any script being downloaded by the user is not, because you are providing it. For offline scripts that don't actively communicate with other services, this is often needed anyway for compatibility reasons, and many online scripts can also be included here without too much loss in functionality.

Saltsman

Yes but if one of those services get hacked, and someone writes javascript to swipe private info on the form. That's my point. And those other services won't be as secure because they are startups doing click tracking or whatever. – Karolynkaron

So what you're saying here is your concern about the javascript servers themselves getting hacked, such as the click tracker. In this case, you just copy all of the script files to your server so that anyone trying to target you only has one endpoint - your server. If the service you're contacting gets hacked, it can't do nearly as much damage. Out of curiosity, what specific website are you thinking of that has this problem? – Saltsman

My concern isn't a particular provider, but I'm just kind of shocked that websites that handle secure credit card information usually have tons of 3rd party trackers installed. I don't see how the PCI compliance process can ignore this security issue. – Karolynkaron

"However, if every single one of those en masse JavaScript downloads is downloaded over a secure, HTTPS connection, then it's totally fine" This is only true if you can 100% trust the third party. Which you never can, can u – Donia