So welcome back, everyone.
There's a resignation decision is about Stoled Crosseyed scripting, well, unlike a light reflected
exercise, stoled exercise is all about persistence.
So remember, what was the what was the power of Reflektor exercise is that it was pretty easier.
I mean, if you let's say I want to compromise to an individual user, I can just simply compromise
any any random website, any simple, you know, single page website as well.
And, you know, I can then in fact, there is no small site where the developer or the owner of the
website might be.
It might not be taken care of, but security with it, I can probably try infecting it or probably all
I can grab what is already infected.
The problem was this.
This I mean, reflected exercice takes a lot of energy and a lot of time as well, because that's where
you have to concentrate on individual users.
So let's say you need if a hacker basically need thousands of thousands of victims, he will have to
send in thousands of e-mail to all those user phishing e-mail.
Right.
And then we can expect at least 50 percent or 60 percent of them get converted or compromised.
In fact, store exercice solve this problem for hackers.
What happened is restored exercice.
It's more of a persistence.
Let me show you how exactly when you look at these two stored exercice and what happened is it's a persistance.
It means that whatever you do, whatever hacker if let's say hacker compromises, if a hacker in fact
a website or find a wonderful website if or maybe he'd do something and get it.
Get vulnerable bob of the store exercice maybe.
So if anything has been done it will still remain there, it will still remain there.
And any user after that, maybe after a day, after two days, after three days, they're still getting
compromised.
What do you do if you look at the Reflektor, this is for every new user.
That has to be a new link to be sent to the new victim.
But with these store Xerces, there is only one time activity need to be done on the website.
After all.
After that, all the following user, all the following victims automatically get compromised.
And that's what's going to happen.
And that there is a very big incident happened, has happened, in fact, with MySpace as well, on
back where the site got compromised.
After that, like millions of the user, the hacker wasn't having much friends on his account.
But when he made use of store X Cross scripting through which in just just one minute he got 10 friends
request after like 30 minutes he got 700 friend request.
After three hours, he got somewhere around 30000 friend requests.
And it kept happening until he got around one million friend request.
And after that, in fact, the platform social media platform itself got the point that something something
got wrong in the platform and that's how it got detected.
So there was a very, very popular, very popular attack happening on the platform as well.
But that's how it is.
It was everybody started recognizing it and it was a part of all that stopped in volubility as well.
Right.
And still pretty much popular on many of the many of its still active for many of the Web sites.
So remember, there's a persistent nature.
And also in this site, in this case, the site received the malicious requests and include within its
leader responses as well as TDP responses.
And it's easy to compromise millions of user with this attack.
The reason is once you compromise this Web site scene, you can't really compromise on a Web site,
which is not that maybe, you know, normal Web site where you have just 10 or 15 visitors coming in.
If you, in fact, that you still be not sure how many you know and what will be the conversion rate,
because a hacker would be spending like day or maybe 20 days or 30 days or probably month or month to
infect site.
And if he don't get much visitors on those Web site, it doesn't make sense.
Right.
So in order to get millions of user.
On millions of conversion or maybe at least thousands of conversion, he needs a site which is pretty
much popular, which is which could be in e-commerce, which could be any sort of, you know, other
platform as well.
Right.
So the attacker needs such a platform where if the weather if it has been impacted, if it is infected,
all the following victims get automatically compromised without even doing any further activity.
Do it right.
So this is easy once the infection has been done, required an infected site, having a huge visitor.
Why I talked about.
Now let's understand how exactly it going to work as the hacker.
Basically, first of all, the hackers need to compromise hacker to insert JavaScript code, you know,
JavaScript code on a vulnerable site.
So that's the first thing, if you remember.
But reflective exosomes, the first part was he to the hacker need to reach out to all individual users
manually, manually.
He need to send all these e-mails or probably it can be automated, of course, but it need to be targeted
so that to get maximum conversion.
So but in the stored accesses account, attacked hacker need to compromise a vulnerable site.
And he always need to always need to have access to it so that he he can once he so some JavaScript
code or in fact do sign again, whatever the following visitors comes in, they automatically get those
JavaScript back to all those visitors, in fact.
So let's say one visitor comes in, the visitor, no one comes in, he will automatically get compromised.
The second user comes to the games, to this vulnerable site.
He will also get compromised.
How exactly?
Because the moment the new user comes to this vulnerable site or website page, he will see that JavaScript
code into it.
Your browser automatically download all the content of the page.
He will also download the malicious JavaScript code inserted by the hacker.
That's how and the script code will still be there, and that's where it is stored and persistent persistence
in nature.
So that's how the first victim comes in and look at the browser and he get infected.
Second also comes and he downloads the content of the same page.
Download the JavaScript code as well.
He will be impacted as well.
How to user exactly the same for user?
Exactly the same.
And that's what makes this attack so, so impactful.
Right.
So if it is done once, it can impact millions after that.
Right.
So that's why this attack is so impactful and will be learning about in more detail when will perform
the lab about it as well.
All right.
So we'll get you in the next session and then get.