Slashdot Mirror
The Java Popup you Can't Stop
An anonymous reader writes "In his brand new hackademix.net blog, Giorgio Maone, known as the author of the NoScript security extension for Firefox, reveals how popup blockers can be easily circumvented using Java. Worse, popups opened this way are really evil, because they can be sized to cover the whole desktop (the wet dream of any phisher) and cannot be closed by user (the wet dream of any web advertiser).
Impressive demos available, all cross-browser and cross-platform, in the best Java tradition: 'Write once, hack anywhere' "
As always, with script-related security flaws, the easiest solution is NoScript, of course.
However, FWIW, I couldn't get either of his demos, the Java or the JavaScript, to work on Firefox 2.0.0.6 on Windows XP, despite the fact that the author says that both work on Firefox.
My blog
I have the newest version of firefox (vanilla, no extensions, only a few custom settings to increase speed) and his demo completely didn't work on my computer...
You can still use firefox to keep popups contained in tabbed browsing, and prevent window resizing. Not-news, move along.
There's virtually no chance anyone would be fooled into doing anything but killing their browser, and Java is by no means alone in causing that kind of issue.
Nothing to see here, move along...
Galileo: "The Earth revolves around the Sun!"
Score: -1 100% Flamebait
Indeed. That sort of thing usually doesn't end well. Ask the guys behind X10 for example.
That might be why the author wrote "In the meanwhile, NoScript is your friend ;)" in his blog.
This guy's the limit!
1. Yahoo.com
Done.
Yahoo uses Java for many of their online games. You might not play them, but a lot of people do. And that "lot of people" will probably leave Java enabled and be victim to this crap.
Layne
From a quick look at the code, the bug seems to be that you can resize the popup to be bigger than the screen size. So the warning disappears off the bottom of the screen.
yeah, is this a joke? i tried disabling everything i could think of while keeping java enabled - nothing.
btw, i am a dedicated proxomitron user (disabled for a moment to try the demo). never see any ads or pop-ups ...
Actually, I've seen it a few times. I just downloaded NoScript so I can limit it to the pages wehre I need it. Kinda wish I had downloaded this one sooner.
34486853790
Connection too slow for X forwarding? Try "ssh -CX user@host"
Putting http://evil.hackademix.net/fullscreen/FullScreen.c lass in AdBlock Plus' kill list worked like a charm. Make a generic kill for *.class and *.jar and then whitelist the sites that need java.
Would like to share some specifics. Disassembled the bytecode using javap and used my rusty JRE assembler 'skillz' to understand it, but well, since he seems to have compiled it with full debug options, any idiot can find it ut by staring at the output for a sec.
1. It doesn't use any "go fullscreen" API
2. It's a failure of assuming sum of parts of software is as secure is as its components. It can be "less" secure than any of the component taken in isolation. Point in case is the set of APIs used:
a) Toolkit.getScreenSize(): Used to find size of desktop. Nothing evil here
b) Window.setBounds(): Used to set size of window. Nothing evil, except set it larger than screen size, hence hiding the applet warning by moving it "off screen"
c) Window.setAlwaysOnTop(): Used to set the window on top. Essential for displaying "Modal" dialog boxed like error boxes. Nothing sinister here.
However, the shit happens because all the things taken together can be dangerous. Specially, passing "System Modal" to setAlwaysOnTop().
I don't see an obvious "fix" except the following hurdles that can be presented to unsigned applets (and hence breaking a lot of hobby games, apps etc)-
1. Validate applet size to be always significantly less than screen size
2. Remove support for "System Modal" for unsigned applets for "setAlwaysOnTop". Application modal is fine, system modal is not.
Any more ideas shall be appreciated.
Oh, and I again despise him for an irresponsible disclosure and presenting the hack in easily reverse engineered, fully functional code.
- mritunjai
It would have worked if you were British.
Gerald Ratner is the head of Ratners, a jewelers here in GB.
Gerald made some comment to the press about not understanding why anyone would buy the crap his shops sold as it was all second rate, tasteless junk (It is, he was being honest). Aparrently there was some outcry over this when the great unwashed who actually bought crap from his shops realised they were being ripped off.
(Disclaimer - I have not been into a Ratners in at least 20 years and have no intention of doing so, ever)
I dont read
Then it's a non issue on Unix-Boxen: by holding the alt-key you can drag windows without having a visible border. At least on usual window managers, that is.
In Firefox, click on Options > Content and uncheck the Java Enabled checkbox. Then click on OK, and you're safe...
Think of the Irony!
I haven't had that in years and don't miss a damn thing.
Maybe you don't do any banking on the internet, then. Here in Australia, at least, it is quite common for banks to use Java in an attempt to make their products cross platforms politely. And I, for one, welc... am perfectly happy with that, since I spent many years (once I had got over some of my luddite tendencies) whining about those who coded only for Winbloze boxes.
I haven't found many other sites that go in for Java in such a big way, but if I came across one that loaded a popup like that, I would simply blacklist it permanently in my hosts file. It simply doesn't pay the advertiser to piss people off that much.
A distinction should be made between a website that can't function without client-side scripting, and websites that use it to support various functions but can work without it.
For instance, the multi-level menus on a website should not be the only means of browsing its pages. In fact, if the user were to turn off all of their scripting for their browser, the website should function minimally. Even with Gmail, you could change the site options to "basic HTML", which is found on the bottom of the page.
How about banking websites where you try to pay your bill and want to input the date? Most sites currently have a calendar pop-up for you to display a slick interface. But one should still be able to manually enter in a date that conforms to how the date is stored. (Or use server-side validation & conversion.) Again, inputting a date should not depend on a client-side calendar function since quite a few users use browsers that do not have any client-side scripting functionality.
I agree with your point that a lot of the sites we commonly use have features that depend on client-side scripting, but the website itself should still function if you choose to turn off the functionality on the browser level, and that is what the parent was talking about if I understood their point correctly.
Best "String" Ever!
The Javascript launched one can't be closed by clicking. You have to alt+tab to the main browser window and click the close link. That said, I didn't get the Javascript launched one working on my GNU/Linux box, just the windows machine at work.
AFAIK, both of these require JAVA in order to work. One of the demos is launched by a JAVA applet and the other is launched by a JAVASCRIPT function of some sort, but I believe the full screen window that appears is JAVA regardless of which you use. I come to that conclusion because on WinXP, (where the Javascript launched one works) the Java icon appears as the icon when I Alt+Tab and because both of these use LiveConnect, according to the Maone's website, which is a technology that allows interoperability between Java and Javascript.
Also, on the "Applet" page, it says "Works in any Java-enabled browser" whereas the "Javascript" page states it works only if both "Java and JavaScript are enabled"
Note that the link for the Javascript launched method is broken. You have to add the l to html. Here's a direct link. Remember, alt tab to close.
Well, there are a couple of things about CWS:
1. It merely used the JVM as a vector to install itself. As a virus, it was actually a Windows program and was reported as such by all virus tools in existence. Thus the original poster would not have known it as a "Java virus".
2. There are actually a wide variety of CWS variants. Some of them used the JVM vulnerability while others used other system vulnerabilities like a hole in the Windows Meta File.
3. As another poster pointed out, it was a hole in Microsoft's VM that was exploited. Which would seem to be further evidence for moving away from IE.
Javascript + Nintendo DSi = DSiCade
Once again for those in the cheap seats: "information wants to be free" is roughly equivalent to the statement, "a gas wants to expand to fill its container." It's not wishful thinking. It's not a political statement. It's not an assertion of an ethical point of view. It's just a fairly easily demonstrated fact that no matter how hard you work to contain information (and arguably as a RESULT of how hard you work at it), said information will "seek" ways to be communicated to the widest possible audience.
Of course, this is an anthropomorphization of what is more in the realm of math or physics. It's just a simplification for the masses.