In a groundbreaking revelation, nDiligence, Inc. has published a four-year cybersecurity study highlighting an alarming vulnerability across 50 different software and device types. Conducted with meticulous precision, the research titled ‘Attack the Glass’ (ATG) uncovers significant security risks, with 46 platforms rated as Critical or High risk.
Comprehensive Analysis of Software Vulnerabilities
Published from San Francisco, California, the study delves into vulnerabilities in applications that utilize users’ devices to render interfaces, load data, and execute code during runtime. The security loophole identified allows attackers to manipulate what users see and how applications perform, even after passing security checks.
Many applications, including web browsers, mobile apps, and industrial devices, rely on runtime client-side rendering. This means their interfaces are assembled from a variety of sources, including the organization’s systems and its vendors. If an attacker compromises any single supplier, they can infiltrate the application, altering on-screen content and capturing user inputs without detection.
Real-World Implications and Past Incidents
A notable instance illustrating this vulnerability occurred in February 2024, when the domain behind Polyfill.io—used by over 100,000 websites—was acquired by a sanctioned company. The compromised code remained undetected for months, affecting countless devices until researchers identified the issue.
nDiligence’s research shows potential exploitation methods, such as delivering false information on news sites or misleading infrastructure operators. This threat prompted the company to brief governments privately for over two years before public disclosure.
Call to Action for Cybersecurity Community
Robert Beckett, Founder and CEO of nDiligence, emphasizes the urgency of this discovery. He stresses the importance of recognizing this vulnerability to safeguard the integrity of critical software systems. Beckett warns that attackers can manipulate screens to influence decisions and beliefs, highlighting the need for improved detection and attribution methods.
The ATG research categorizes potential attacker effects into five areas: deceive, disrupt, degrade, deny, and destroy. All findings are freely available under Traffic Light Protocol (TLP) CLEAR, including comprehensive documentation and remediation strategies.
Beckett encourages those involved in system development and defense to understand and mitigate these vulnerabilities. The study’s findings stem from nDiligence’s extensive experience in threat intelligence and countering influence operations. Since 2024, the company has collaborated with researchers, vendors, and governments to address and close these security gaps.
nDiligence, Inc. continues to lead in supply-chain intelligence, emphasizing the necessity of robust defense mechanisms in securing digital infrastructures.
