The Java Popup you Can't Stop

An anonymous reader writes "In his brand new hackademix.net blog, Giorgio Maone, known as the author of the NoScript security extension for Firefox, reveals how popup blockers can be easily circumvented using Java. Worse, popups opened this way are really evil, because they can be sized to cover the whole desktop (the wet dream of any phisher) and cannot be closed by user (the wet dream of any web advertiser). Impressive demos available, all cross-browser and cross-platform, in the best Java tradition: 'Write once, hack anywhere' "

Comments

NoScript, but they don't work

[morgan_greywolf]

In the meanwhile, NoScriptis your friend

As always, with script-related security flaws, the easiest solution is NoScript, of course.

However, FWIW, I couldn't get either of his demos, the Java or the JavaScript, to work on Firefox 2.0.0.6 on Windows XP, despite the fact that the author says that both work on Firefox.

Re:NoScript, but they don't work

[Luscious868]

However, FWIW, I couldn't get either of his demos, the Java or the JavaScript, to work on Firefox 2.0.0.6 on Windows XP, despite the fact that the author says that both work on Firefox.

It worked on my XP system and covered everything but the Start Menu and Task Bar. Getting it to close was simply a matter of right clicking on Firefox in the Task Bar and closing it down. It's certainly an annoyance, but it's not as bad as the article makes it seem to be. Anybody with a brain (which admittedly excludes about 60% of the population) can figure out how to close Firefox and thus the Java App.

Re:NoScript, but they don't work

[LiquidCoooled]

Actually, it was a bit worse (for some reason on mine)

The start bar went behind the app, bringing up task manager and shutting down the app wasn't as easy as you would think because the java app eats focus and makes clicking the "End Process" and the Warning message difficult.

I managed it after a few mistypes and jabs at the button.

Its possible to close it, but it doesn't play nice at all.

Re:Remind me: Why do we have applets again?

[SQLGuru]

1. Yahoo.com

Done.

Yahoo uses Java for many of their online games. You might not play them, but a lot of people do. And that "lot of people" will probably leave Java enabled and be victim to this crap.

Layne

Re:Obvious solution?

[badfish99]

From a quick look at the code, the bug seems to be that you can resize the popup to be bigger than the screen size. So the warning disappears off the bottom of the screen.

Analysis of the "hack", or how sum of parts breaks

[mritunjai]

Would like to share some specifics. Disassembled the bytecode using javap and used my rusty JRE assembler 'skillz' to understand it, but well, since he seems to have compiled it with full debug options, any idiot can find it ut by staring at the output for a sec.

1. It doesn't use any "go fullscreen" API
2. It's a failure of assuming sum of parts of software is as secure is as its components. It can be "less" secure than any of the component taken in isolation. Point in case is the set of APIs used:

a) Toolkit.getScreenSize(): Used to find size of desktop. Nothing evil here
b) Window.setBounds(): Used to set size of window. Nothing evil, except set it larger than screen size, hence hiding the applet warning by moving it "off screen"
c) Window.setAlwaysOnTop(): Used to set the window on top. Essential for displaying "Modal" dialog boxed like error boxes. Nothing sinister here.

However, the shit happens because all the things taken together can be dangerous. Specially, passing "System Modal" to setAlwaysOnTop().

I don't see an obvious "fix" except the following hurdles that can be presented to unsigned applets (and hence breaking a lot of hobby games, apps etc)-

1. Validate applet size to be always significantly less than screen size
2. Remove support for "System Modal" for unsigned applets for "setAlwaysOnTop". Application modal is fine, system modal is not.

Any more ideas shall be appreciated.

Oh, and I again despise him for an irresponsible disclosure and presenting the hack in easily reverse engineered, fully functional code.

Re:Don't spread this!

[BrokenHalo]

I haven't had that in years and don't miss a damn thing.

Maybe you don't do any banking on the internet, then. Here in Australia, at least, it is quite common for banks to use Java in an attempt to make their products cross platforms politely. And I, for one, welc... am perfectly happy with that, since I spent many years (once I had got over some of my luddite tendencies) whining about those who coded only for Winbloze boxes.

I haven't found many other sites that go in for Java in such a big way, but if I came across one that loaded a popup like that, I would simply blacklist it permanently in my hosts file. It simply doesn't pay the advertiser to piss people off that much.

Re:and the wet dream of any victim

[Clandestine_Blaze]

A distinction should be made between a website that can't function without client-side scripting, and websites that use it to support various functions but can work without it.

For instance, the multi-level menus on a website should not be the only means of browsing its pages. In fact, if the user were to turn off all of their scripting for their browser, the website should function minimally. Even with Gmail, you could change the site options to "basic HTML", which is found on the bottom of the page.

How about banking websites where you try to pay your bill and want to input the date? Most sites currently have a calendar pop-up for you to display a slick interface. But one should still be able to manually enter in a date that conforms to how the date is stored. (Or use server-side validation & conversion.) Again, inputting a date should not depend on a client-side calendar function since quite a few users use browsers that do not have any client-side scripting functionality.

I agree with your point that a lot of the sites we commonly use have features that depend on client-side scripting, but the website itself should still function if you choose to turn off the functionality on the browser level, and that is what the parent was talking about if I understood their point correctly.