AI cybersecurity is so hot right now. Corporate upheavals at OpenAI, the firm behind the ChatGPT chatbot, have put artificial intelligence in the spotlight, but AI technology plays a prominent role in everything from mapping apps to corporate web development.
AI cybersecurity: JavaScript ex machina
AI complements human programmers by making the development process more efficient through coding assistants.
JavaScript has moved from a tool for internal developers to a technology that helps businesses operate and innovate on the web.
Visibility and control over how tools and AI platforms collect data are becoming increasingly important even before we consider how evolving AI technology might be abused to develop client-side attacks.
Threat actors can harness AI tools, in particular LLM (large language model) tools such as ChatGPT and Google Bard, to improve their ability to attack internal code. For example, hackers can use AI-based tools to exploit debuggers or tamper with code. AI tools have also increased script vendors’ ability to collect more data. This creates a raft of data leakage and data privacy issues.
Novel attack vectors
Deploying artificial intelligence can increase the attack surface of software systems while also enabling more advanced client-side attack vectors.
For example, Israeli security start-up Adversa has shown how machine learning systems might be vulnerable to so-called adversarial attacks. Datasets used to train machine learning systems might be poisoned with maliciously crafted data samples, Adversa warns.
Changing the script
JavaScript plays a significant role in integrating AI into web development. With the growing availability of machine learning libraries, JavaScript developers can now integrate machine learning and artificial intelligence into web application development through technologies such as TensorFlow.js.
Continuous updates have increased JavaScript’s attack surface, a trend AI is reinforcing and accelerating. Modern web applications load an average of 20+ third-party scripts, creating a software supply chain risk.
Potential vulnerabilities include broken access controls, data leakage, formjacking, account takeovers, and more.
Commercial imperatives are driving the use of JavaScript to support business goals, for example, by allowing organizations to hyper-personalize the user experience using data from affiliate websites.
For example, e-commerce operations use tags and scripts to gather the information needed to personalize the user experience.
Advertising tags, social media pixels, marketing tags, chatbots, A/B testing, analytics, payment tags, performance tags, and more all give businesses the data they need to improve the customer web experience.
AI-powered tags collect more and more data at an accelerating rate through mechanisms the “business” can’t see and has little ability to control, hence the need to rethink security strategy.
Client-side protection
JavaScript is where the rubber meets the road in web development. Both corporate intellectual property and end users need protection from malicious activity delivered through dynamic web pages.
A growing number of organizations are recognizing that protecting the client side of their web apps is needed to stay compliant with standards like PCI DSS v4, and better shield their c personal data, while also serving to improve web security maturity more generally.
Businesses need a holistic security solution that combines advanced first-party JavaScript obfuscation with state-of-the-art third-party script protection.
Client-side risks visualized
Jscrambler offers a comprehensive client-side protection and compliance platform that includes obfuscation and runtime protection tools to safeguard first-party code, plus a solution to monitor third parties in real time and block their access to sensitive data.
With Jscrambler’s platform, clients get real-time visibility into any script that could threaten the integrity of user data, highlighting behaviors considered undesirable or suspicious.
Jscrambler ‘s platform can, amongst other functions, catalog all vendors and cross-reference this data with the rules that can be configured to develop a compliance policy. The software provides detection of a wide variety of attacks:
- Detecting web-based supply chain attacks.
- Detecting data exfiltration (e.g., Magecart).
- Preventing DOM poisoning and tampering.
- Protecting against web-based threats and malware.
- Reporting threats detected in near real time to the application backend, enabling a quick response to address them.
- Gaining visibility of any client-side changes.
This collective functionality helps organizations ensure the integrity of payment pages, a key new requirement of the revised PCI DSS v4 payment industry regulations, which become mandatory at the end of March 2025.
Magecart
Over recent years, cybercrime groups have attempted to inject web credit card skimmers on e-commerce and payment websites through so-called Magecart-style attacks.
The UK’s Information Commissioner’s Office fined British Airways, the most high-profile victim to date of a Magecart-style attack, £20m ($25.4m) for a data breach that affected more than 400,000 customers.
In the summer of 2018, cybercriminals accessed an internal BA application by abusing compromised credentials for a Citrix remote access gateway. This hack was used as a toehold to hack more sensitive systems in a series of attacks that allowed cybercriminals to edit a JavaScript file on BA’s website, allowing fraudsters to exfiltrate sensitive cardholder data to a rogue domain controlled by the crooks, an ICO investigation found.
Client-side application security
Organizations faced with the challenge of preventing Magecart-style skimmers from covertly running on their sites and exfiltrating data can use behavior-based detection from Jscrambler to mitigate the threat.
Clients of the Jscrambler client-side protection platform include banks worldwide, a major EU airline, a top US retailer, and three top US-based entertainment companies.
Other clients operate in industries including financial services, payments, e-commerce, travel and logistics, gaming and gambling, and healthcare. Clients use the technology to protect against data leaks, regulatory violations, and integrity breaches.
Client-side Protection platform
Jscrambler has been focused on client-side security since 2010. Jscrambler provides multiple layers of client-side protection, from making code resilient to tampering to blocking interference from scripts supplied by third-party tools and risky vendors.
The technology lets clients protect user data and comply with regulatory standards such as HIPAA (the US Health Insurance Portability and Accountability Act), GDPR (General Data Protection Regulation), and PCI DSS.
With Jscrambler, your teams can take full advantage of third-party scripts and client-side innovation, confident you’re well protected against cyberattacks, sensitive data leakage, misconfigurations, and IP theft.
Jscrambler’s client-side protection platform lets businesses focus on innovation while staying compliant, secure, and protected from data breaches and AI-powered client-side attacks.
