nDiligence Unveils 'Attack the Glass' Vulnerability Affecting 50 Platform Types

A comprehensive four-year study conducted by nDiligence has identified a pervasive and critical supply-chain vulnerability, named 'Attack the Glass' (ATG), which affects the way applications render user interfaces and execute code on the client-side.

The research, made public today, found that all 50 types of software and devices examined are susceptible to this flaw, with 46 of them classified as having a Critical or High risk. The ATG vulnerability exploits the fundamental process of runtime client-side rendering, where applications assemble user interfaces, load data, and run code directly on the user's device while in operation. This process relies on components and code supplied by a vast network of vendors and their suppliers.

Attackers who compromise any single supplier in this chain can inject malicious code that executes after all standard security checks, such as firewalls, encryption, and code reviews, have passed. Once the code is loaded onto the device, it is implicitly trusted, allowing attackers to alter what the user sees, capture keystrokes, and perform actions with the user's authority, all without detection by automated security tools.

The potential impact of ATG is far-reaching, ranging from the dissemination of disinformation on news and election websites to the manipulation of critical infrastructure operations and the concealment of vital safety alerts. A past incident involving Polyfill.io in February 2024, where a compromised code library was served to over 100,000 websites for months without detection, serves as a stark example of this vulnerability's real-world implications.

Robert Beckett, Founder and CEO of nDiligence, emphasized the hijacking of user trust, stating, "People trust what they see with their own eyes... ATG demonstrates how an attacker can hijack that trust without detection or attribution." He highlighted that even with all security systems indicating safety, the displayed information can be manipulated, giving significant power to whoever controls the screen.

Before its public release, the nDiligence team spent over two years privately briefing governments due to the severe security implications. The research categorizes five potential attacker effects: deceive, disrupt, degrade, deny, and destroy. All research materials, including a detailed whitepaper, demonstrations, and remediation playbooks, are available for free sharing under TLP CLEAR.

Beckett noted that ATG was discovered during ongoing research into digital supply-chain threats, drawing on his team's extensive experience in threat intelligence and countering influence operations. The company urges anyone involved in building, operating, or defending systems used for critical decision-making to understand and mitigate the ATG vulnerability.

While the research was self-funded, nDiligence aims to raise awareness and encourage the cybersecurity community to develop defenses against this sophisticated threat that undermines the integrity of software systems across various industries and critical infrastructure.