You know, I just remembered a really funny story.
So, the criminals will find a way around this.
We had a sort of compromise once, and it was a very similar sort of compromise,
it was a harvesting compromise.
But the JavaScript was really cool.
It looked to the IP address of where the user was coming from,
and if it was coming from a card payment brand,
if it was coming from a payment processor,
if it was coming from the merchant itself,
it didn't fire the attack.
So it would hide itself in circumstances where it might be identified.
Yeah.
And also it only did it in one in every five transactions.
So, you know,
that's the thing that made me think that the BrowseAloud situation before,
like we got off really lightly because it was just
like a shotgun that's on everything,
there was no attempts at hiding itself or concealing itself from
the people who are going to try and find it.
So, if it like knew your IP address and Scott's IP address,
who, and Scott found it, didn't he, Scott found this,
yeah?
Yeah.
If it had known their IP addresses, like every security researcher,
it would have just said, well,
I'm not going to fire if it's that person looking at it.
They'd have to start getting very intelligent then, but I take your point.
When we saw this one that didn't execute if I was on my desk at work,
but if it executed at home, I thought that was pretty clever,
actually.
So someone had to fingerprint your externally facing IP address range as well.
Yeah.
That's really creepy.
And it wasn't just the card brand I worked for,
it was the other card brand, it was the payment processor that was being used,
it was the company itself,
it was the four forensic companies that are used in the UK
for doing forensic card breaches --- Wow.
--- so these guys have spent some time doing it.
There's some effort, there's some love.
There is some love in crafting that.
You're absolutely right.
So, if we look at the,
obviously we're going to try and do a detect by doing the standard things,
or are we going to detect stuff that has gone wrong on our website,
but then the next thing is, well,
then it's a case of doing detection based on looking at what
our website is serving as a remote user,
and then seeing if that CSP has changed.
But at least there's one thing to look for.
See, when I thought about this originally,
before I knew about CSP,
I was thinking how do I look for a random piece of
JavaScript that's just been added to a website?
But now I've got one thing we're looking at,
we're looking at just the CSP changing or being deleted,
and that's technically feasible.
Yes.
So, that's pretty cool.