DebugBear Instructs Users To Remove Monitoring Script After Security Incident
DebugBear told customers to remove its Core Web Vitals monitoring script due to a security incident, according to Search Engine Journal. The incident may have allowed hackers to serve malicious JavaScript.
Original reporting · searchenginejournal.com
Original: “Hackers Hijacked DebugBear’s DNS To Serve Malicious JavaScript via @sejournal, @vahandev”
Read “Hackers Hijacked DebugBear’s DNS To Serve Malicious JavaScript via @sejournal, @vahandev” at Search Engine Journal →
How this was written. Awesome B2B wrote this article with a language model from Search Engine Journal’s reporting (model: @cf/meta/llama-3.3-70b-instruct-fp8-fast); it describes that reporting rather than adding to it. The original, linked above, is the full story.
Key points from Search Engine Journal’s report
- DebugBear has instructed its customers to remove its Core Web Vitals monitoring script due to a security incident.
- The incident may have allowed hackers to serve malicious JavaScript to users, potentially stealing funds and accessing sensitive information.
- Website owners should take steps to protect themselves, including removing the compromised script, checking for unauthorized changes, and invalidating exposed sessions.
- The incident highlights the risks of using third-party scripts on websites and the importance of website security.
- High-value websites may be particularly vulnerable to hacking attempts and should take extra precautions to protect themselves.
DebugBear, a website monitoring service, has instructed its customers to remove its Core Web Vitals monitoring script from their websites due to a security incident. The company reported that hackers had compromised its DNS records, allowing them to serve malicious JavaScript to users. Search Engine Journal reported that the incident may have affected multiple websites that use DebugBear's Real User Monitoring script.
The security incident was first reported on October 29, and DebugBear has since issued updates on the situation. According to the company, the attack targeted one customer's website, but it is not yet clear whether other customers were also affected. DebugBear has stated that it has found no indication that its internal systems were compromised.
An analysis by cybersecurity firm Hudson Rock found that the malicious JavaScript was used to steal funds from users of the Polymarket website. The code was able to access the trading client already available in a logged-in browser, and it did not require the user's password to do so. This has raised concerns about what other malicious actions could be taken using the permissions of a signed-in visitor.
DebugBear has instructed its customers to take several steps to protect themselves from the security incident. These include removing the Real User Monitoring embed immediately, checking for unauthorized changes and persistence, and invalidating exposed sessions and resetting passwords. Customers should also review their account creation, permission changes, and tag-manager history to check for any suspicious activity.
In addition to these steps, DebugBear has recommended that customers put their websites into maintenance mode if they confirm a compromise. This involves isolating the affected site and showing a static maintenance page with an HTTP 503 response. The site should then be cleaned up and verified to be free of malicious code and backdoors before being brought back online.
The security incident has highlighted the risks of using third-party scripts on websites. While DebugBear's monitoring script was intended to help website owners track their Core Web Vitals, it ultimately provided a vector for hackers to serve malicious JavaScript. As a result, website owners should be cautious when using third-party scripts and take steps to protect themselves from potential security incidents.
Search Engine Journal reported that the incident is a reminder of the importance of website security, particularly for high-value websites that may be targeted by hackers. By taking steps to protect themselves and removing the compromised script, website owners can help to prevent further malicious activity.
Questions and answers
What should I do if I use DebugBear's Real User Monitoring script?
You should remove the script immediately and check for unauthorized changes and persistence, according to Search Engine Journal.
Could the malicious JavaScript have accessed my website's internal systems?
DebugBear has stated that it has found no indication that its internal systems were compromised, but it is still possible that hackers may have accessed other websites' internal systems.
How can I prevent similar security incidents in the future?
You can help to prevent similar incidents by being cautious when using third-party scripts and taking steps to protect your website, such as regularly reviewing your account creation and permission changes.
