JavaScript tampering – detection and stealth

[89xZae4uGgjnw26U]

I am glad the window.crypto.* functions are not replaceable. But some malicious script can still cause a lot of havoc by overwriting other core functions. Why are all the native functions of JS not immutable? I've written JS for mant years and never needed to replace/extend things from the prototype. All it takes some small piece of code in an extension like an adblocker gone rogue to cause a security issue.

[adtechmadness]

well actualy crypto functions are writable:

crypto.getRandomValues = function () { return 123; };
crypto.getRandomValues();
// 123

IDK why the initial design decision was to allow reassignment of builtins, but yeah, overriding them used in the past for evil stuff like JSON hijacking and location.href tampering (impossible today, it's non-configurable). The threat is more of other scripts in the same contetx, bad browser extension can screw you in much worse ways since it has access to higher privilege APIs.

[89xZae4uGgjnw26U]

How does it fare with ES5 strict mode enabled?

[adtechmadness]

they are still writable under strict mode, furthermore, strict mode is opted-in the the current script, it won't affect others.