Slashdot Mirror
Pop-Under Deception and Private Property
RogerRamjet98 writes "I was browsing the web today and I got hit with a pop-under ad. Annoying but no big deal, right?
Wrong. This one managed to change my home page to (CT:Link removed. Why would we send these dicks traffic?)
Which pretends to be yahoo, and is convincing enough to fool the average computer user, but is really a platform for launching more pop-under ads.
Combine this with the AOL/WinXP news, and it makes me think that the settings on my computer ought to enjoy legal protection as private property: Changing them without my permission (such as adjusting my home page, or whatnot) should constitute assault or trespass." Or turn of JavaScript. Or don't run IE. But good luck on that trespass case. With a history of laws like the DMCA, Uncle Sam can only make it worse.
Actually this is a common problem and growing more so at the moment - it was only on warez sites and porn sites but is increasingly common. The other night i was involved in 'ahem' warez surfing (i know i know) and came across a link i thought looked good, clicked on it and copped 12 popup windows (yep i expected it and should have) what i didnt expect is a changed home page and 10 new favourites not to mention that lovely code that locks a window at full screen and you cant close it - you have to CTRL-ALT-DEL
no warnings and no question - this can be done and according to my developers is really easy to do - and as these days to get all web pages to work you need to use IE- theres not a lot of choice - of course you can lock it down but that means many things wont work properly anyway - so whats the solution ?
someone come up with an answer for this ? PS popup killer doesnt work with My IE - i use cable and of course it doesnt work as its a customised version.
So any ideas ? (please dont advise me to change to Mosaic or Netscape or opera as i cannot do that with my cable provider (i love opera but it wont work properly with most of my plugins without playing and i dont see the point of having a broadband link and a crippled browser - i spend my days playing with servers and dont want to spend my nights configuring browsers - this is why i dont use linux at home)
I refuse to argue with Anonymous Cowards - if you want a discussion get an account....
Most recent browsers provide a function in their scripting that lets you set the home page for the browser. This is what sites use when they provide a button that says "Click to make this site your home page" or some such. If you've got sensible browser security settings in place, you'll get prompted before the browser will actually do it, but many people have security settings too low for that. For those people, all it takes is a web site that hooks up the script to set the home page to run when the page is finished loading, and bang, one reconfigured browser.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
Tech law, cyber law, or whatever one wants to call it is too early in its development to provide much help here. As CmdrTaco pointed out, the few times lawmakers get involved in this field, they really screw things up (eg, DMCA, patenting obivous things with lots of prior art, etc.). There aren't a lot of helpful precedents and/or laws on the books, so we are probably out of luck here.
There are some novel legal theories one could try from (NON-intellectual) property law concerning trespassing, personality, etc. But, again, things are too unsettled in this area for these types of legally novel theories to have a high probability of success as causes of action.
My thought is that the best possible solution to all of this is some combination of technological and legal solutions.
Technologically, there have been a lot of work done on blocking pop-up ads and maybe something like that can be used here.
Legally, it would be great if people could do something like what RMS has done with GNU GPL and give individuals A LOT of legal protections over their privacy and presence on the Internet and let them contract -- under their own informed free will -- with others on what terms individuals are willing to interact with businesses on the web.
you copyrighted your preferences, then put some lame arse encrption on them, defeatable simply by accessing them through javascript, you could get these guys thrown in jail without bail...
Reliable, Great Value Hosting: $7.95/mo 2.4G/120G
I can't comment on what browser the original poster is using, but taking the IE theme further, I will say that is one browser that is too integrated with its environment, at least under Windows. There are one or two websites that will install an application, without you even knowing, to change your cursor to something else. Sure this is a harmless installation, if not irritating, but imagine if the that application was a virus?
If you combine this behaviour with the recent IIS targeted virus, then you could easily have a virus that modifies web pages to include javascript to install itself into the machines of the vistors to the site.
I definetly ask myself why Javascript is not limited to a sandbox, in the same way Java is? Until then best use some other navigator to surf the web.
Jumpstart the tartan drive.
---- El diablo esta en mis pantalones! Mire, mire!
"a few websites that make extensive use of javascript" are certainly no great loss. Any site excluding text-based clients (and blind users) don't deserve to be visited.
Changing them without my permission (such as adjusting my home page, or whatnot) should constitute assault or trespass.
Actually, this may constitute breaking the law. After all, if you hack into someone's computer and change any data on their computer, then you've broken the law. If you write a virus that goes in and changes data on someone's computer without their knowledge, again, you've broken the law. Seems to me that this qualifies. You don't have to do any damage, per se, but changing the data on their computer is enough.
IANAL, but I don't see a real distinction between a virus and what these ads are doing. Just MHO.
You were just trying out a neat new javascript trick on the front page for a few min and THOSE DICKS are really the slashdot crew. ::grins::
So what qualifies as an unauthorized modification of data? You are the one receiving data and running the code; they are not executing it remotely. It is, to some extent, your responsibility to see that mailicious code isn't executed on your computer. This is why browsers have security settings.
IE makes no difference, Nutscrape is just as bad.
As for disabling Javascript, say goodbye to quite a few websites that make extensive use of javascript.
You could turn off scripting, or use a browser that doesn't permit that kind of manipulation.
Sorry, but while these covert actions are annoying, and the people behind it definitely ought to be smacked hard, it's not cause for legislation - unless, perhaps, they are taking advantage of security holes to alter your settings in destructive ways.
CLI users are immune to this, right?
If you can get someone to download an activex control or a plug-in, anything goes.
Whenever I hear the word 'Innovation', I reach for my pistol.
Switch browser..?
If CmdrTaco does so much as to even mention the name, that will almost guarantee increased hits, which is exactly what they want. Advertising is not about making people happy. It's about making people remember you and visit your website. It's based on one of the oldest principles of advertising: An entertaining ad is not nearly as effective as an annoying one.
.sig the way it is drives more hits to my MP3.com page than anything else I've tried -- internet pyramid schemes, MP3.com's auctions, and submitting to search engines.
Slashdotters are curious. We'll click any link and search any subject to learn more. Look at my post. Posting to slashdot with my
No, I can't help but feel that CmdrTaco did the right thing; even speaking their name here helps them out.
But of course, it's only a matter of time before some friendly poster mentions who it is anyhow.
That's a nasty one, kinda like the old DOS programs that would put up a screen or message that looked like your network log-in prompt, and then record your password before logging you in as normal.
I don't see how you're ever going to legislate against something like that, though. You immediately raise unanswerable questions about what consistutes an e-trespass, and what constitutes giving permission to change something on your system.
Fortunately, there is always an easy answer. People forget in this world of scripting and viruses that no-one can ever force you to run something on your own PC -- not even MS, though they wish they could :-). If you don't like it, just run with a browser where you can switch off cookies, Javascript, and all the other rubbish. Such things are freely available; all you have to do is go get them. 'Course, it would be nicer if switching them off was the default, so the people who want them get them, but the people who aren't informed enough to know about them don't get screwed...
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
Personally, I would put the link in and make sure they get hella /.ed.
This doesn't sound *too* bad, but it won't stop there. It won't be long until some script kiddie figures out a way to change all the URLs on people's favorites to theirs. And by the time that people find out, it's too late -- They don't even know where the popup was (or that it even was a popup! I had no idea until just now...)
Got Rhinos?
i can't seem to find this mysterious turn of javascript. A google search would only give me webpages written by illiterates like the dumbfuck who posted this article.
But microsoft puts features like "Make This My Homepage" for your benifit remember :) Its just a coincidence that it can be turned against you...kind of like the famous contact list in Outlook makes a great thing for a worm to bind to.
Is internet explorer the only one vulnerable to these malicious javascript?
"It has always been this way and it won't change, god bless the fucked up USA" The Briefs
Something similar has happened to me before, while other sites ask "Would you to set your homepage to ...?" I wonder if the ability for a site to do that without a pop up asking permission could be considered a security hole that MS should make a patch for, as one site modified my Windows registry to make that site the 'default' home page.
The One Rule Of Chess You'll Ever Need: Don't play someone who carries a kit in their bookbag.
Run Mozilla/Galeon/K-Meleon, and encourage others to do the same, explaining to them *why* they should consider changing over!
The Free desktop that Just Works
Are there any people (who have enough knowledge of Internet Explorer or the Windows OS in general) how this could be achieved? I find it very disturbing that such settings (such as your browser's home page) could be altered remotely without your permission, which could constitute a breach of computer security. As far as I know, (depending on your jurisdiction) there isn't any specific legislation that marks your computer's settings as your private property. The only thing you can do is, like Taco said, disable JavaScript or don't run IE. Which makes sense anyway.
----------
When the pin is pulled, Mr. Grenade is no longer our friend.
Granted, I agree that we shouldn't send "those dicks" any traffic. And I agree that companies who do this sort of thing are indeed dicks. And I also agree that it would be most amusing to see an entire
But it would also get old quickly. So, Taco, what's the name of the organization whose link-to you removed? Not a domain or anything, just a noun that we can use instead of "those dicks."
You cannot apply a technological solution to a sociological problem. (Edwards' Law)
Some states have laws against unauthorized access to a computer's resources. Surely a "pop under" advertisement has not been granted permission to your resources, and changing your settings is definitely a form of "access". Why not go after them with that angle.
Sig under construction since 1998.
Could someone post the script that changed the home page (suitably neutralized, of course)? I know of no way to change someone's home page without permission; if such a way exists, it would be a bug.
I suspect the poster was tricked into approving it, but is too proud to admit it... its seems the usual reaction to being duped is to cryout, "there outta be a law..."
This is one of those things where you just need to step up and defend yourself. While there very well may need to be some kind of law in place to protect against such activity, it can't very easily be enforcable worldwide. Plus there's so much bloody red tape these days it would take years for such a law to pass. Take some of these suggestions people have had and run with them. Turn off javascript. Use a browser that lets you turn off pop up windows.
I wish there were a better solution. Unfortunately, some of the sites I like to hit use javascript. Javascript is occasionally useful (more often than not, in fact). It seems that forsaking a technology simply because some people choose to abuse it isn't the way to go about doing things (*cough*napster*cough*).
So besides disabling Javascript, what else can we do? Is legislation a viable option? Complaining to the webmaster of the site with the evil js?
What have you tried that has worked for you?
FP
"Tell me doctor, with all of your defenses, are there any provisions for an attack by killer bees?"
or rather finaly an application for the slashdot effect
I used to have a cool sig, back when I cared
But I find the alternitives far worse. Yes its made by the evil empire, and no its not Open Source, but it is by far the best web browser out there. Sure I get hit by stuff like this and it sucks but that is realitively small compared to the inconviniences posed by the other browsers. I am sure most of you will flame me for this (hence the Anonymous coward post, sorry, but I got my karma to think of) but if you would actually give IE a chance you might see where you need to improve the alternitive browsers. The browser is the killer app for a platform (something that microsoft recognized, hence them bundling it with the OS) and until Linux has a browser that is not horribly broken or out of data it won't succeed as a desktop OS.
1. Call up Microsoft and tell them that they want their default installs to be more restrictive.
2. Install one of tons of programs that will stop ads from popping up. It isn't that hard to install most of these little programs.
3. Use something else. It doesn't take that much to go install Netscape or others.
This isn't a "Microsoft bash" - if there are things popping up all over the place and your homepage keeps changing, don't write your congressperson trying to make certain use of javascript illegal - write Microsoft asking them why they allow these javascript "features" in default installations of their browsers.
Yeah, they make an ASS of U and .... HEY!!!
man i hear you.... Porn sites are famous for automatically downloading .exe files without your permission.
I dont have any trouble under linux, but windows sometimes will install a porn dialer, which to teh unsuspecting dad , when accidentally clicked will dail a 900 number... This shit has got too stop, but i dont see it happening anytime soon..
Its bad enough that netscape pops up an ad upon opening a new browser, that alone is enough to make me switch to mozilla..
But an IP address would also be nice, to give to the Code Red Worm...
Anyone out there happen to know the code req'd to do this?
...does anybody know where I can bulk order X12 tiny cameras?
I dont suppose anyone reading this has any pull with the various w3c commitees?
There should have been an overhaul of javascript a long time ago. PARTICULARLY since stylesheets require javascript [Who the hell got bought out to get that one in the spec??]
There should be a subset of javascript that is only related to validating forms, playing around with formatting on the same page, etc. but has all of the secret nasty stuff like changing preferences and cookies TAKEN OUT. That that version, and only that version, could be the required scripting component for CSS, etc.
javascript could be turned into an actual force for good, instead of the deep pit of evil it is currently.
www.thehun.com warned me about this! And has a link on how to make it so it doesn't happen. It is IE that's affected, some people posting said otherwise, but they are wrong. Free porn and computer advise all rolled into one! Thank god for The Hun!
I don't know if DOS retaliation is the right tact to take, but it sure is a shame we can't have a real life doberman that will sick whoever makes a pop-under ad... Wonder where X-10 HQ is?
If you don't think too good, don't think too much
www.jdhodges.com
When web advertising was less invasive, this was not such a big deal to readers. In fact, it was the business-model-of-last-resort: "ads will pay for an essentially free internet." (Let's play find-the-fallacy.) Web publishers ("content providers") promised the moon to advertising customers - that they could instantly generate sales and site visits, measure the results with click-throughs, and do this all without alienating their own base. It didn't work that way.
If the expectations of web advertising had been more moderate to begin with - in line with those of print ads - this sort of thing wouldn't be happening now. But I don't expect it to get better. I don't believe in rational markets with good information finding optima, I believe that irrational expectations create bad situations, vicious cycles develop, and things fall apart. The nice bit about it is that we are, ultimately, getting the internet back from the suits that are failing to selling it to us.
Actually...come to think of it...it is very surprising that trying to change your homepage from msn.com doesn't result in some kind of Microsoft FUD-ish message like:
"Warning! If your homepage is changed from MSN.Com you will not receive valuable updates and integrated web functionality! Are you sure you want to proceed with this reckless course of action?"
:)
- JoeShmoe
-- I wonder which will go down in history as the bigger failure: the War on Drugs or the War on Filesharing
Thank you slashdot, I've been looking long and hard for the lowest form of life, and indeed you have found it! However the link was removed. :(
Yup, I agree, these scum... nah, fsck that, I would never insult scum like that. I would never associate them with my phallus, hell these guys aren't fit to be fed on by that which I scrape from my shoe. These guys should do time for this crap. Spam isn't ok to begin with, emulating a known "good" (yahoo sux, google is much better) is illegal, but when you alter my computer config its war!
There are any number of really good reasons to run both JavaScript and IE. As a web developer I love JavaScript. If I validate a form with JavaScript I save the user time since they don't have to wait for the server to validate and respond (the server its own validation, of course, so I don't save any CPU cycles). This is a win for both of us: the user gets a faster response and I get a happier user.
For people running Windows (nearly everyone, last I checked), IE is the fastest, most stable, and most feature-rich browser available. Yes, it's chock-full of security holes. That's by design. Microsoft is pretty explicit in trading usability for security, and it shows. [Some of] Their products are very user-friendly.
To avoid getting modded down as a troll, I'll say that Microsoft sucks and only lusers use IE. Lusers like my mom, of course, who has trouble enough on the web without me updating Mozilla to milestone "slightly faster than a melting glacier" every other week on her P200. I use Mozilla, and it kicks IE's ass for my use, and on my computer.
My point? The problems here are (a) lack of security focus by Microsoft. There should be no setting, anywhere, that allows changes to local software without explicit user consent. They have fucked this up royally, time and time again, and I don't think it's ever going to change. Plus, if they have their way, the concept of "local software" will go away entirely.
The other problem ((b), if you're keeping track) is human capacity for evil. Some PHB had a brilliant idea: "Ok, we need to change every directory name on the computer to 'Porn-R-Us.com'. You can do that, right?". Some low-life programmer said, "Sure, there's an ACtiveX control for it."
It all comes down to human decisions. Somewhere along the line a human being decided to fuck another human being to make a buck. The only way to stop this is to remove the buck. This is often done with a lawsuit, or other legal action. So I say yes, sue these bastards 'til they can't walk straight.
This isn't as much "normalization" as it is "don't take so many drugs when you're designing tables."
After just reinstalling, I would just like to point out that yes, IE does take you to a page to set MSN to your home page. BUT, even if you don't choose to make it your home page, it still wisks you off there until you set a new homepage. So many, many people hit msn.com just out of shear laziness. And people wonder why msn.com is like 2nd most popular site on the internet.
At least you didn't get bitten by this hole. Goodbye, kernel...
How 'bout this: We attempt to have the server slashdotted and possibly go offline. Everyone turn off JavaScript in your browsers and we'll allow Taco to post the link. Everyone cuth with that? Even if that doesn't work, just reprogram Code Red to set it's sights on that server as opposed to the whitehouse
The One Rule Of Chess You'll Ever Need: Don't play someone who carries a kit in their bookbag.
My page
KernelPanic.com
And this demo only works on 95/98 machines:
My 95/98 demo
Impossible to do that under IE... requires user confirmation.
For those concerned about losing functionality with sites they frequent by disabling Javascript, IE supports the notion of trusted and untrusted sites. One could disable Javascript by default, and only enable it on sites in their trusted list. See Tools > Internet Options... > Security to access those settings.
moron - so whats the alteranative to the millions of users out there who arent geniuses or who are stuck with the product ?
This comment is the IT equivalent of 'i have a 12inch dick - what you dont ?"
try thinking of a solution not another random bash at MS and the evil empire
Hit his URL:o ns/javascript.html#7 for Netscape's guide to how to use JS to change user prefs...
http://developer.netscape.com/support/faqs/champi
Yeah, one time I ran into a stack of like 12 popup banners for pr0n. Afterwards, two shortcuts to websites had mysteriously appeared on my start menu and desktop... >_
It asked about changing my homepage, but I declined.
I personally use Pop-Up Killer, it does a good job of killing those annoying popups and popunders before they can do anything.
My guess is that the poster was prompted to change his homepage, but the window was hidden (it's a pop-under, remember?) and he hit enter without noticing that that clicked OK.
using namespace slashdot;
troll::post();
Now that I have a super fast computer I am beginning to like mozilla and some of its features of turning off things, like images from certain servers. Maybe someone will implement turning off JS from hostile sites (like mozilla's cookie rejecting) or prompting you for this.
NOTE I am NOT talking about turing off ALL javascript, just allowing users more control over it.
This user may want to try proximitron (sp) it is a proxy that allows you to set up some filters. Thus turing off pop ups and pop back....
Only 'flamers' flame!
So when somebody portscans my system, I can't prosecute them because they "did nothing illegal". Even if they root my box, I can't prosecute because they "were just exposing how flawed my security system is"...
;) and information wants to be free.
When somebody distributes a copy of an MP3 ripped from a licensed piece of music, it's OK because you would not have bought the album anyway
But somebody changes your homepage, and suddenly it's a job for the federal government.
BTW, the DCMA, as stupid and flawed as it is, probably gives you some legitimate avenues to address this sort of offensive behavior.
I know the DCMA is the only reason you won't be seeing those dreaded "smart links" in the next version of Internet Explorer.
Mathematically impossible requirements are technically not against policy.
It's your fault for letting the web sites change your home page and popping up windows. Since the default installation of IE set by Microsoft apparently lets this happen, you have to set your settings higher if you don't want these things from happening.
I've been to several pages with code that tries to alter my homepage and every time this little IE window pops up with a home icon and says "Such-And-Such is trying to make this your homepage, do you want to proceed? [OK][Cancel]"
This is on IE's Medium security level. On High I'm sure it is even more protective. So can we please be clear about this? Is this new trick able to bypass these kinds of protections? Is this a problem only on Netscape or IE or any JavaScript enable browser?
Keeping in mind that MS wants everyone's homepage to be MSN.com (the first thing IE goes to after installing is a page with code to make MSN your homepage) I can't believe they would allow any website to so easily snatch this setting without user interaction of some kind.
- JoeShmoe
-- I wonder which will go down in history as the bigger failure: the War on Drugs or the War on Filesharing
"Don't touch a hot stove, dear."
"But Mommy, what does a hot stove look like?"
"I can't tell you that, dear. You might touch one."
You cannot apply a technological solution to a sociological problem. (Edwards' Law)
I was pissed, but I don't blame the site owner, or really even keenspot for that loser online casinos action
I used to have a cool sig, back when I cared
A number of people are suggesting disabling javascript as a solution. The problem of course is that many sites use javascript for the forces of good rather than evil.
One solution is for browsers to have an option to disable javascript's ability to open new windows. I use OmniWeb on Mac OS X and it has exactly this option. In fact your choices are to allow javascript to open windows always, only in response to a link being clicked, or never. A very useful feature and one reason I will ultimately hand money over for this software.