Slashdot Mirror

← Back to Stories (view on slashdot.org)

The Java Popup you Can't Stop

Posted by CmdrTaco on from the once-you-pop dept.

An anonymous reader writes "In his brand new hackademix.net blog, Giorgio Maone, known as the author of the NoScript security extension for Firefox, reveals how popup blockers can be easily circumvented using Java. Worse, popups opened this way are really evil, because they can be sized to cover the whole desktop (the wet dream of any phisher) and cannot be closed by user (the wet dream of any web advertiser). Impressive demos available, all cross-browser and cross-platform, in the best Java tradition: 'Write once, hack anywhere' "

91 of 480 comments (clear)

  1. Don't spread this! by LarsG · · Score: 5, Funny

    For the love of all that is holy, please don't promote this story to the /. frontpage. The less advertisers that are made aware of this the better.

    --
    If J.K.R wrote Windows: Puteulanus fenestra mortalis!
    1. Re:Don't spread this! by Anonymous Coward · · Score: 5, Funny

      NO WAY! Information is meant to be FREEEEEEEEEEEEEEEEEEE! YOU should keep your mouth shut, you fascist pig! I bet you voted for Bush!

    2. Re:Don't spread this! by LarsG · · Score: 4, Funny

      Information wants to be anthropomorphised and all that, but I'd still prefer this one to stay below the main stream media radar until Sun can get a fix out.

      As for voting Bush. Since I'm not a US citizen, that would require use of the password '12345678'.

      --
      If J.K.R wrote Windows: Puteulanus fenestra mortalis!
    3. Re:Don't spread this! by elrous0 · · Score: 4, Insightful

      Only promoting it and having it become a threat to them (i.e. lawsuits, users uninstalling Java on their systems, webpage designers moving away from it) will motivate them to fix the problem. If the threat is kept under wraps, they have no real motivation to move on it until phishers are already using it in the wild.

      --
      SJW: Someone who has run out of real oppression, and has to fake it.
    4. Re:Don't spread this! by LarsG · · Score: 3, Insightful

      True, full disclosure is needed as the ultimate Damocles sword to force companies to fix problems. If Sun acts slowly on this one, I'm all in favour of plastering it all over the front page of the WSJ.

      Sun was made aware of this problem 10 days ago, and nothing seems to suggest that they don't take the issue seriously. The time it takes them to write a fix, do regression testing and push a patch out the door will likely not change due to this story reaching the /. frontpage or not. The only thing that will change is the number of people that are made aware of the issue before the fix is available, and in consequence the number of phishers/spammers/etc that have the opportunity to exploit it. That is, increasing the Window of Exposure

      --
      If J.K.R wrote Windows: Puteulanus fenestra mortalis!
    5. Re:Don't spread this! by AVee · · Score: 2, Insightful

      Only promoting it and having it become a threat to them (i.e. lawsuits, users uninstalling Java on their systems, webpage designers moving away from it) will motivate them to fix the problem.

      I'm all with you on forcing vendors to fixs security problems, but you make a rather blunt statement about SUN. So far I haven't seen any examples of security issues in Java being ignored by SUN so you'd better back up an accusation like that with some facts.

    6. Re:Don't spread this! by Anonymous Coward · · Score: 3, Funny

      Eh don't worry, by the time the Java Virtual Machine loads up, you'll probably be doing something else. It should make for a good screensaver though!

    7. Re:Don't spread this! by LarsG · · Score: 4, Insightful

      You're setting up a false dichotomy, those are not the only two options available. In order to minimise the Window of Exposure, it is best to have it not blow up in media AND have it fixed as soon as possible.

      I'm all for letting security issues blow up in media if the software vendor ignores them, there's nothing like a little public shaming to make public companies get their act together security-wise. But as long as the software vendor fixes reported problems in a timely fashion, the only thing that is achieved by a media blow up before a patch is available is that more potential exploiters are made aware of the issue.

      --
      If J.K.R wrote Windows: Puteulanus fenestra mortalis!
    8. Re:Don't spread this! by BrokenHalo · · Score: 4, Informative

      I haven't had that in years and don't miss a damn thing.

      Maybe you don't do any banking on the internet, then. Here in Australia, at least, it is quite common for banks to use Java in an attempt to make their products cross platforms politely. And I, for one, welc... am perfectly happy with that, since I spent many years (once I had got over some of my luddite tendencies) whining about those who coded only for Winbloze boxes.

      I haven't found many other sites that go in for Java in such a big way, but if I came across one that loaded a popup like that, I would simply blacklist it permanently in my hosts file. It simply doesn't pay the advertiser to piss people off that much.

    9. Re:Don't spread this! by networkBoy · · Score: 3, Funny

      True enough, but one should only allow active content such as Java on sites one explicitly trusts (like a bank).
      Sadly, most are not as aware and leave their browsers in "whore mode".
      -nB

      --
      whois gawk date unzip strip find touch finger mount join nice man top fsck grep eject more yes exit umount sleep dump
    10. Re:Don't spread this! by Kadin2048 · · Score: 3, Interesting

      To be honest I have no idea why it's not. It's such a blisteringly good idea, it seems ridiculously stupid to not include it in a browser.

      I mean, popup blocking is included in the browser, why not NoScript?

      It's the user's computer, not the advertiser's; the user should have full control over what goes on.

      --
      "Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
    11. Re:Don't spread this! by BorgCopyeditor · · Score: 3, Funny

      You mean their browsers will pretend to open each page the user pays for?

      --
      Shop as usual. And avoid panic buying.
    12. Re:Don't spread this! by jank1887 · · Score: 4, Funny

      hey, we all know any exploit can be fixed in 10 f-ing days!!!

    13. Re:Don't spread this! by JM78 · · Score: 3, Insightful

      HA! but N00bs will click on stuff, SO WHAT, their computer will still not be infected...

      You're right, N00bs WILL click on stuff. You've missed the point. There are plenty of ways to take advantage of people on the net without infecting their machine with a local virus. Not to mention that not everyone knows how to use CTL/ALT/DELETE and end processes (cause N00bs really need to be screwing with the task manager... riiight). EVERYONE is a N00b at some point - which leads me to my next point...

      1. They deserve whatever they get.

      That's an ignorant and callous statement. Just because someone focuses their learning on a subject other than computers/networking doesn't mean they deserve to get screwed. I hope your wife/grandma/parents/friends/yourself end up getting taken - maybe then you'll have a little respect for those who have other interests in life than learning everything there is to know about tech.

      2. I'm pretty sure their computers (presuming they deserve to be called that) are already turned into spam zombies

      So be part of the solution and help educate rather than whine about how dumb everyone else is. The worst kind of geek is the one who thinks somehow they're super-human and everyone else is dumb. Did you get beaten up by too many jocks in school?

      --
      I am Jack's smirking revenge.
    14. Re:Don't spread this! by BobPaul · · Score: 2, Insightful

      NoScript is extremely annoying. I've found that I have to enable it on almost every site I browse to, such that it's no longer worth my time for the perceived protection I gain. Blocking scripts that are able to do this sort of thing, though, should be added to the standard pop-up blocking capability.

    15. Re:Don't spread this! by Cougem · · Score: 2, Insightful

      You're pathetic. 99% of viruses and vulnerabilities only are a problem because of uneducated people using computers. Should we therefore settle for unstable OSes and browsers? Of course not. Do you want to HAVE to go to the task manager when you're browsing the net? Of course not, so stop spouting bullshit.

      And your philosophy on people deserving shit is frankly disgusting. My mother has spent her life trying to help people in the caring profession, and is now just getting to grips with IT. I can see her being tricked into clicking one of those stupid adverts saying she's infected with a virus, or something, does she deserve to have massive ads pop up that she doesn't know how to close, full of pornography etc.? She'd be too embarrassed to ask me how to close it probably, and it would probably scare her from using the computer.

      You're a disgusting slashdot user and no doubt quite a stupid person.

    16. Re:Don't spread this! by kestasjk · · Score: 2, Insightful

      Because JavaScript is used everywhere, and it's being used more and more. It's easy for you and me who can recognize that if buttons aren't working, or if the menu bars/java applet/flash vid isn't appearing, it's because NoScript is preventing some script from running, but laypeople might not realize, might think it's a broken site, and might not think to right click and enable JavaScript.

      NoScript is great, but I wouldn't want to have to add "See the 'S' in the corner, right click it, blah blah, .." to all my JavaScript using site's FAQs.

      --
      // MD_Update(&m,buf,j);
    17. Re:Don't spread this! by polymath69 · · Score: 5, Funny

      I'd much prefer they filter malicious scripting,

      The ghost of the Entscheidungsproblem descends, with malice in its eyes.

      *smack* Oof.

      You are dealt 2501 hit points of damage.

      Hint: there is no way to programatically determine whether a given program is malicious or not, for any sufficiently interesting system.

      --

      --
      I don't want to rule the world... I just want to be in charge of mayonnaise.
    18. Re:Don't spread this! by Buran · · Score: 2, Interesting

      Because FF is designed to be bare-bones and the user adds whatever they want on their own. It's exactly as designed.

      Now if the damn thing would stop opening a tab on its own every time it's updated -- that annoys me that an extension designed to stop unwanted stuff from running on your computer forces something to open that you don't want!

      I filed a bug report/complaint. Nice to see this guy has time to shove stuff like this through instead of actually fix his software's rude behavior.

      --
      i am a soviet space shuttle
    19. Re:Don't spread this! by Paperkirin · · Score: 3, Insightful

      All the online banking systems I've used in the UK are also (X)HTML and JS over SSH. Methinks the Australian banks might have over-thought this one a little too much...

    20. Re:Don't spread this! by ajs · · Score: 2, Informative

      Information is meant to be FREEEEEEEEEEEEEEEEEEE! Are we still confused about this phrase? I thought that was so 1990s....

      Once again for those in the cheap seats: "information wants to be free" is roughly equivalent to the statement, "a gas wants to expand to fill its container." It's not wishful thinking. It's not a political statement. It's not an assertion of an ethical point of view. It's just a fairly easily demonstrated fact that no matter how hard you work to contain information (and arguably as a RESULT of how hard you work at it), said information will "seek" ways to be communicated to the widest possible audience.

      Of course, this is an anthropomorphization of what is more in the realm of math or physics. It's just a simplification for the masses.
    21. Re:Don't spread this! by polymath69 · · Score: 2, Insightful

      Really. The AC is right; there can be no general solution. See also this article; search for Turing.

      The approach you suggest, of "search for X, Y, and Z known bad things and don't allow them" is also a loser. For more on that, see Gödel, Escher, Bach, especially the part about "This record cannot be played on record player X."

      --

      --
      I don't want to rule the world... I just want to be in charge of mayonnaise.
    22. Re:Don't spread this! by whitehatlurker · · Score: 2, Insightful

      Opera will let you turn off Java globally and permit on a per-site basis. The No-Script add-on will allow you to do something similar for Firefox (as per TFA). There really is no reason to be caught by this.

      --
      .. paranoid crackpot leftover from the days of Amiga.
    23. Re:Don't spread this! by cbiltcliffe · · Score: 2, Insightful

      ....leave their browsers in "whore mode".
      It's not "whore mode". Whores get paid. It's actually "promiscuous slut mode".
      --
      "City hall" in German is "Rathaus" Kinda explains a few things......
  2. Who'd have thought it? by nagora · · Score: 3, Funny

    There are people who still browse with java switched on?! That is SO 1990's.

    --
    "Encyclopedia" is to "Wikipedia" what "Library" is to "Some people at a bus stop"
    1. Re:Who'd have thought it? by amigabill · · Score: 5, Funny

      There are people who still browse with java switched on?! That is SO 1990's.

      Didn't you read the headline? You can't stop these things. Heck, the demo popped up an unkillable window on my AmigaOS box, and no JVM even exists for that...

    2. Re:Who'd have thought it? by Anonymous Coward · · Score: 3, Funny

      Wow you can run Java even without a JVM??

      I had no idea Java was so powerful.

    3. Re:Who'd have thought it? by BobPaul · · Score: 2, Informative

      The Javascript launched one can't be closed by clicking. You have to alt+tab to the main browser window and click the close link. That said, I didn't get the Javascript launched one working on my GNU/Linux box, just the windows machine at work.

    4. Re:Who'd have thought it? by BobPaul · · Score: 2, Informative

      AFAIK, both of these require JAVA in order to work. One of the demos is launched by a JAVA applet and the other is launched by a JAVASCRIPT function of some sort, but I believe the full screen window that appears is JAVA regardless of which you use. I come to that conclusion because on WinXP, (where the Javascript launched one works) the Java icon appears as the icon when I Alt+Tab and because both of these use LiveConnect, according to the Maone's website, which is a technology that allows interoperability between Java and Javascript.

      Also, on the "Applet" page, it says "Works in any Java-enabled browser" whereas the "Javascript" page states it works only if both "Java and JavaScript are enabled"

      Note that the link for the Javascript launched method is broken. You have to add the l to html. Here's a direct link. Remember, alt tab to close.

  3. and the wet dream of any victim by Raleel · · Score: 3, Insightful

    is to get their phone number, call them up, and inform them that they will never buy/use whatever it is they are selling, and will be telling 25 of their closest friends in person because of this practice. Certainly, you aren't limited to 25, but that is the old saying.

    --
    -- Who is the bigger fool? The fool or the fool who follows him? --
    1. Re:and the wet dream of any victim by 91degrees · · Score: 2, Insightful

      There's no such thing as bad publicity.

      Actually that's not totally true, but telling people not to use a product may backfire if it means more people have heard of the product.

    2. Re:and the wet dream of any victim by aadvancedGIR · · Score: 4, Insightful

      The real wet dream of any victim would be to be able to disable java or any scriting technology in his browser and still be able to surf on most respectable sites.
      I don't want to be a ludite, but on 9 sites times out of 10 that require those technologies, there is very little benefit for the user.

    3. Re:and the wet dream of any victim by mgblst · · Score: 2, Funny

      Two words: Gerald Ratner


      Who?

       
      Exactly!
    4. Re:and the wet dream of any victim by Ash+Vince · · Score: 2, Informative

      It would have worked if you were British.

      Gerald Ratner is the head of Ratners, a jewelers here in GB.

      Gerald made some comment to the press about not understanding why anyone would buy the crap his shops sold as it was all second rate, tasteless junk (It is, he was being honest). Aparrently there was some outcry over this when the great unwashed who actually bought crap from his shops realised they were being ripped off.

      (Disclaimer - I have not been into a Ratners in at least 20 years and have no intention of doing so, ever)

      --
      I dont read /. to RTFA, I read /. to offend people in ignorance.
    5. Re:and the wet dream of any victim by foniksonik · · Score: 2, Funny

      Yes... lets' disable PHP, JSP, Ruby, Python, ASP and all those other evil scripting languages. OH you meant Browser Scripting languages?

      OK then, let's disable multi-level menus, client side form validation, any sort of calculator, date pickers, multi-dimensional form inputs (where one choice branches the rest of the form), tree-menus, AJAX (which does have it's uses), font-size controllers, style switchers and all the other UI elements that make web sites even remotely usable.

      Let's just do away with Gmail and all other Google apps, Netvibes and all other personal portals, any instant feedback you might get on a social site, no more firehose for /. and any number of useful tools out there that need client side scripting to even be feasible.

      Down with scripting, long live dumb content.

      --
      A fool throws a stone into a well and a thousand sages can not remove it.
    6. Re:and the wet dream of any victim by secPM_MS · · Score: 3, Insightful
      I have to agree. I just returned from BlackHat and DefCon. Before I went I had tended to view "Web 2.0" as "Cross Site Scripting as a Feature". My view is now more negative and bleak. The combination of cross site scripting, cross site request forgery, DNS poisioning / anti pinning, and active content on the user's browser's is exceptionally powerful. There were a number of attacks discussed that were very serious. Since these vulnerabilities are server driven, there is essentially nothing that the user can do to protect themselves other than to block the functionality. Unfortunately, the state of the art in server deployments is very bad, not only do web masters deploy a lot of vulnerable web apps, but lots of web servers are compromised by attackers for the purpose of spreading their malware.

      The smart web is the dangerous web -- the smarts are all too likely to be out to get you.

      As for me, with a few exceptions, if a web site needs lots of scripting to make it work, I don't need it or use it.

      Windows/Microsoft Update is in my trusted site zone

      I use Firefox with noscript to enable only what I need for mapping functionality

      Otherwise, Java, javascript, flash, multimedia, are all off.

    7. Re:and the wet dream of any victim by Clandestine_Blaze · · Score: 4, Informative

      A distinction should be made between a website that can't function without client-side scripting, and websites that use it to support various functions but can work without it.

      For instance, the multi-level menus on a website should not be the only means of browsing its pages. In fact, if the user were to turn off all of their scripting for their browser, the website should function minimally. Even with Gmail, you could change the site options to "basic HTML", which is found on the bottom of the page.

      How about banking websites where you try to pay your bill and want to input the date? Most sites currently have a calendar pop-up for you to display a slick interface. But one should still be able to manually enter in a date that conforms to how the date is stored. (Or use server-side validation & conversion.) Again, inputting a date should not depend on a client-side calendar function since quite a few users use browsers that do not have any client-side scripting functionality.

      I agree with your point that a lot of the sites we commonly use have features that depend on client-side scripting, but the website itself should still function if you choose to turn off the functionality on the browser level, and that is what the parent was talking about if I understood their point correctly.

      --
      Best "String" Ever!
  4. so how do i know by circletimessquare · · Score: 5, Funny

    this is a real slashdot article, and not some clever cross site full screen javascript faux article out to steal my cookies, hmmm? if i hit submit i might-

    oh shit

    --
    intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
  5. NoScript, but they don't work by morgan_greywolf · · Score: 4, Informative

    In the meanwhile, NoScriptis your friend


    As always, with script-related security flaws, the easiest solution is NoScript, of course.

    However, FWIW, I couldn't get either of his demos, the Java or the JavaScript, to work on Firefox 2.0.0.6 on Windows XP, despite the fact that the author says that both work on Firefox.

    --
    My blog
    1. Re:NoScript, but they don't work by Luscious868 · · Score: 4, Informative

      However, FWIW, I couldn't get either of his demos, the Java or the JavaScript, to work on Firefox 2.0.0.6 on Windows XP, despite the fact that the author says that both work on Firefox.

      It worked on my XP system and covered everything but the Start Menu and Task Bar. Getting it to close was simply a matter of right clicking on Firefox in the Task Bar and closing it down. It's certainly an annoyance, but it's not as bad as the article makes it seem to be. Anybody with a brain (which admittedly excludes about 60% of the population) can figure out how to close Firefox and thus the Java App.

    2. Re:NoScript, but they don't work by Professor_UNIX · · Score: 4, Funny

      This demo didn't work on my iPhone either. Just another reason to use the Superior JesusPhone over standard web technologies... no annoying Java, Flash, or third party apps to exploit!

    3. Re:NoScript, but they don't work by kent_eh · · Score: 3, Insightful

      Getting it to close was simply a matter of right clicking on Firefox in the Task Bar and closing it down. It's certainly an annoyance, but it's not as bad as the article makes it seem to be. Anybody with a brain (which admittedly excludes about 60% of the population) can figure out how to close Firefox and thus the Java App.

      In my experience the vast majority of windows users don't right click on anything, unless they have been specifically instructed to.

      And they certainly don't intuitively know that they can right click on task bar icons to do anything, let alone close the app.
      For most regular users (no doubt the intended target of the sort of sleeze who would use this for advertising and other nefarious purposes)there is only one way to shut down an app, and that's the rex X in the top right corner.

      --

      ---
      "I can't complain, but sometimes still do..." Joe Walsh
    4. Re:NoScript, but they don't work by LiquidCoooled · · Score: 4, Informative

      Actually, it was a bit worse (for some reason on mine)

      The start bar went behind the app, bringing up task manager and shutting down the app wasn't as easy as you would think because the java app eats focus and makes clicking the "End Process" and the Warning message difficult.

      I managed it after a few mistypes and jabs at the button.

      Its possible to close it, but it doesn't play nice at all.

      --
      liqbase :: faster than paper
    5. Re:NoScript, but they don't work by BobPaul · · Score: 3, Interesting

      Computer illiterate people aren't stupid, you know, just computer illiterate. Many of them would probably be able to patronize you in a similar manner if you were to encounter a trivial problem you were unable to solve in their field of study. Some of the most computer literate people I've met are not from my field of study (Electrical Engineering). I've met guys who can easily match my coding skills from Chemistry, English, Music, Math, and Industrial Engineering. Many of them, for whatever reason, had to use the campus super computer as part of their research and were at least attempting to write massively parallel applications, something I've never stepped anywhere near. The English guy was just a straight up geek, and the Musician was coding his own audio filter plug ins to improve his desktop audio software.

      That said, I've met many in fields directly relating to computing (CS, Computer Engineering, etc) who were basically computer illiterate. I'd contend they didn't have brains, as they weren't useful for much outside their field from my observations either... (I worked tech support in college, so I was all over campus working on computers.)
    6. Re:NoScript, but they don't work by ZachPruckowski · · Score: 2, Insightful

      I do use Session Manager (or the Safari equivalent). But then the page that loaded the ad comes back, and the cycle repeats...

  6. Firefox by CogDissident · · Score: 2, Informative

    I have the newest version of firefox (vanilla, no extensions, only a few custom settings to increase speed) and his demo completely didn't work on my computer...

  7. Why? by techiemikey · · Score: 2, Interesting

    yes, but who would want their product to become associated with what would quickly become the most annoying ad basis ever invented?

    1. Re:Why? by Von+Helmet · · Score: 3, Informative

      Indeed. That sort of thing usually doesn't end well. Ask the guys behind X10 for example.

    2. Re:Why? by mwvdlee · · Score: 4, Insightful

      You'd think so, but spam is apparently still worth the risk and effort too.

      --
      Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
    3. Re:Why? by Anonymous+Brave+Guy · · Score: 4, Interesting

      The problem with ads is that, apparently, the annoying ones are exactly the ones that work. People like you and me hate them, but we're never going to buy their **** anyway. Those irritating jingles that get played endlessly on TV ads irritate the **** out of us, but they attract the attention (and memory) of those gullible enough to buy the goods.

      I'm not sure how much this is really backed up by evidence and how much is just "accepted wisdom" in the marketing community, though. There was a particular local firm advertising on the biggest local radio station in these parts a few years ago. They basically took traditional melodies from things like popular nursery rhymes, and rewrote the lyrics to mention their company name repeatedly and the product they were pitching. After a while, they even ran an ad that had the lyrics "We know the songs get on your nerves", which I remember all too well, perhaps making the point for them. That was, however, the last ad they ever ran on that radio station as far as I can tell. I'm not sure what happened to the company...

      To bring this back to the current context, though, the theory seems entirely reasonable. Most of us will never support spammers or get caught by phishing, but those stupid enough to reply to bank password checks or ads for legal software downloads are probably also the ones stupid enough to click on the slightly odd-looking dialog warning about a virus attempting to install itself through your web browser. Sadly, given the tiny running costs, it only take a very small proportion of people to be idiots for the spammers/adware merchants to make an awful lot of money.

      --
      If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
    4. Re:Why? by neersign · · Score: 2, Funny

      screen on, apply directly to the computer screen...

  8. move along, nothing to see here. by jsldub · · Score: 2, Informative

    You can still use firefox to keep popups contained in tabbed browsing, and prevent window resizing. Not-news, move along.

    1. Re:move along, nothing to see here. by teknikl · · Score: 2, Informative

      right -- the pop-up worked for me but came up as a distinct tab on only one of my two monitors... fairly simple to spot and close.

  9. winkey and ctrl alt del seemed to work fine by postermmxvicom · · Score: 2, Interesting

    So...did I miss something? But winkey and ctrl alt delete did fine for me. Still, I *am* impressed...it just seemed to be billed as more than it was. Or is the joke on me for clicking the link in the first place? ::runs away to sign up for lifelock::

    --
    One last thing: Sometimes I wonder; "Is that someone's signature? Or do they type that at the end of each post?"
  10. Silly article by Glock27 · · Score: 2, Informative
    Under MacOS, the dock and top bar are still visible, and it's trivial to kill the browser.

    There's virtually no chance anyone would be fooled into doing anything but killing their browser, and Java is by no means alone in causing that kind of issue.

    Nothing to see here, move along...

    --
    Galileo: "The Earth revolves around the Sun!"
    Score: -1 100% Flamebait
  11. An interesting markettign technique... by solevita · · Score: 2, Insightful

    No, I'm not talking about advertising via popups, I'm talking about Giorgio Maone's method of pushing NoScript. Whatever next? McAfee will release a super virus that only their product will stop? Or Microsoft start releasing IE exploits and paid-for patches?

    I already use NoScript, but this sort of behaviour doesn't enamour me to the lead author.

    1. Re:An interesting markettign technique... by Anonymous+Brave+Guy · · Score: 5, Insightful

      If he were selling his software commercially, or people were being directed from the Slashdot front page to a page full of ads, then you might have a point, but that's not the case here. The guy has made an obviously useful tool, gives it away for free, and is warning about an obviously relevant threat. The most he's likely to get out of this is a few small donations or a few more page hits on his site, perhaps making enough to cover the server costs for hosting a popular Firefox extension for a while and a bit of beer money. I think your post is way over the top.

      --
      If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
  12. So how about how to stop this? by RaigetheFury · · Score: 5, Interesting

    I'd really like to see counter methods posted as (special) comments under articles like these. "Links to: How to prevent this". It would be really nice if we could use our mod points to "mark" a comment as a solution that an administrator could then move it to the top. Why the administrator involvement? Simple, to prevent the teams of people who go around and exploit this type of function on Yahoo. This would still allow Slashdot to work off the same random moderator point system it has while keeping some semblance of order. They could play around with how many mod points a comment needs before it can before an admin is notified.

    Just a thought.

  13. Re:Hence why I don't use java by Glock27 · · Score: 2, Insightful
    It really is very bad language to use online,

    Why is that? What is "worse" about it than Ecmascript?

    For extra credit, explain why Java Web Start is worse than downloading a traditional application and installing it...

    Lemmings...gotta love 'em.

    --
    Galileo: "The Earth revolves around the Sun!"
    Score: -1 100% Flamebait
  14. Can't even switch Workspaces by BobPaul · · Score: 2, Interesting

    FF on Ubuntu 7.04 using Sun's Java (1.5 I believe). The Java one works wonderfully(?) not only filling my full dual monitor setup, but preventing me from clearing it using any method I tried, including hitting the hotkey to change Gnome workspaces. The only thing that did work was switching to a virtual console at which point I could kill firefox-bin.

    1. Re:Can't even switch Workspaces by Aetuneo · · Score: 2, Funny

      It completely covered both of my monitors, but, luckily, I've got Firefox (and pretty much everything else) set up to crash whenever I switch desktops. A feature which finally has a use! (And than I disabled Java, which completely fixed the issue).

      --
      Everything is subjective.
  15. Dont worry, I'll turn off the lights on my way out by smallstepforman · · Score: 2, Funny

    No need to worry folks, us handful of BeOS users will switch off the lights and the internet on our way out, since we'll be the last ones to leave. Every now and then I'm actually relieved to be running a non mainstream OS.

    --
    Revolution = Evolution
  16. Frontier justice on the fringes of the web by Philotechnia · · Score: 2

    If marketing clowns are allowed to do this to my PC, or more to the point, the PCs of people who DON'T know what to do to secure their PCs, I think DoS attacks on individuals or companies that engage in this behavior should be perfectly legal. It amounts to the same thing, really. You interrupt my ability to conduct my business, and I will return the favor...

  17. Remind me: Why do we have applets again? by Toreo+asesino · · Score: 4, Interesting

    Seriously, name me one "house-hold" name website that uses Java applets anyway. Can't we just have it switched off by default? I like Java as a broad technology, but I'm finding applets increasingly irrelevant - interactive rich sites are being taken over by flash, ajax, and the probably-to-be-mainstream-soon Silverlight/Moonlight.

    This isn't a flame....Java on the desktop is awesome and I love it.

    *runs to the hills*

    --
    throw new NoSignatureException();
    1. Re:Remind me: Why do we have applets again? by Megane · · Score: 2, Interesting

      You've got a good point. I'm going to turn off Java in my Mozilla and see what the result is. I can't remember the last time I saw java-man showing that the plug-in was being loaded, and I blame Flash. Flash is faster to load the plug-in, and it supports lots of graphical and multi-media stuff inherently, not as an add-on library.

      --
      #naabhaprzrag, #sverubfr-000, #agi-fcbafberq, negvpyr[pynff*=' negvpyr-ary-'] { qvfcynl: abar !vzcbegnag; }
    2. Re:Remind me: Why do we have applets again? by SQLGuru · · Score: 4, Informative

      1. Yahoo.com

      Done.

      Yahoo uses Java for many of their online games. You might not play them, but a lot of people do. And that "lot of people" will probably leave Java enabled and be victim to this crap.

      Layne

    3. Re:Remind me: Why do we have applets again? by jonathan3003 · · Score: 2, Interesting

      Yahoo uses Java for many of their online games. You might not play them, but a lot of people do. And that "lot of people" will probably leave Java enabled and be victim to this crap.

      This actually demonstrates the whole point of using noscript - site specific control of scripts, flash and Java.

  18. Re:Doesn't work.. by gEvil+(beta) · · Score: 3, Informative

    That might be why the author wrote "In the meanwhile, NoScript is your friend ;)" in his blog.

    --
    This guy's the limit!
  19. Re:Redux by mritunjai · · Score: 2, Insightful

    The bug was filed on 29 JUL

    Fixed.

    --
    - mritunjai
  20. Re:Obvious solution? by Ed+Avis · · Score: 4, Interesting

    The whole point of Java was that it was super-sandboxed when running applets and you could enable it for all sites. To prevent phishing, any windows created by a Java applet would have to show 'Warning: Applet window' and a big red border or something like that. I wonder what went wrong to allow this attack, and whether it has been in Java since the beginning (i.e. would work even with Netscape 2.0) or takes advantage of some recently added kewl feature that forgot to do sandboxing properly.

    --
    -- Ed Avis ed@membled.com
  21. This will lead to by alexj33 · · Score: 2, Funny

    This Java discovery will lead to the following:

    1. Java Popups 1.0

    2. Java Popups on Struts

    3. Java Popups 1.1. (Not compatible with 1.0 or struts, needs a patch to SunOS to work)

    4. JPEE. (Java Popups, Enterprise Edition- Not compatible with 1.1)

    5. Java Popups for Mobile Devices.

    6. Java Popups for Mobile Devices, Enterprise Edition.

    HA, and you thought that Java was going to make this easy for Phishers and Advertizers.

  22. This, of course, assume you allow Java by wowbagger · · Score: 2, Insightful

    This, of course, assumes that you allow Java to run without asking first.

    If you, like me, don't allow Java or any other plug-in to run without the browser first asking you if it is OK to run, and if you don't allow plug-ins to run without having a VERY CLEAR idea of where they are coming from and what they will do, and do not run any such plug-in save from a VERY trusted source, then this will be very hard for an advertiser to exploit.

    All the more reason why ALL plug-ins should be "user interaction required before use" BY DEFAULT.

    --
    www.eFax.com are spammers
  23. Re:Obvious solution? by badfish99 · · Score: 4, Informative

    From a quick look at the code, the bug seems to be that you can resize the popup to be bigger than the screen size. So the warning disappears off the bottom of the screen.

  24. Firefox (and Proxomitron) by Potor · · Score: 2, Informative

    yeah, is this a joke? i tried disabling everything i could think of while keeping java enabled - nothing.

    btw, i am a dedicated proxomitron user (disabled for a moment to try the demo). never see any ads or pop-ups ...

  25. Obligatory Linux Elitism by ticklejw · · Score: 4, Funny

    "Worse, popups opened this way are really evil, because they can be sized to cover the whole desktop and cannot be closed by user"

    Thing #397 That You Can Do In Linux But Can't In Other Popular Desktop OS's:

    1. Ctrl+Atl+F1
    2. Log In
    3. missile-launch -f --target-from-process java
    4. killall java
    4a. killall firefox-bin (if necessary)

    Actually this story is strangely coincidental; just a few minutes ago, I was trying to show a coworker a cool graphical demo of different sorting algorithm efficiencies, but I didn't have the Java plugin installed. Still don't.

    --
    "Software is like sex; it's better when it's free." -Linus Torvalds
  26. Adblock works, too by gpinzone · · Score: 2, Informative

    Putting http://evil.hackademix.net/fullscreen/FullScreen.c lass in AdBlock Plus' kill list worked like a charm. Make a generic kill for *.class and *.jar and then whitelist the sites that need java.

  27. Popups, Wet Dreams... by Chineseyes · · Score: 2, Funny

    Popups, Wet Dreams, and no napkins. What a mess.

    --
    I think the invisible hand of the market has its middle finger extended

    --A wise old fart named SC0RN
  28. Lovely by dgun · · Score: 5, Funny

    The one sure way to endear me to a product and cause me to whip out my credit card is to pop up a window over my entire screen that I cannot remove. This type of "in your face" advertising is exactly what reluctant consumers like myself need.

    --
    FAQs are evil.
  29. Re:Interesting by Opportunist · · Score: 4, Insightful

    NO

    Ban them from going full screen unless I, the owner of the machine where it wants to go full screen, agree to applications having the right to go full screen.

    I don't care about signed code. I do care about my preferences!

    --
    We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
  30. flashblock - javablock by MobyDisk · · Score: 2, Insightful

    I have Flashblock. Is there a Javablock? I'm surprised advertisers don't use Java more often. Java is one of those things that I would probably want to enable manually anyway, there's no need for it to be on all the time.

  31. Analysis of the "hack", or how sum of parts breaks by mritunjai · · Score: 5, Informative

    Would like to share some specifics. Disassembled the bytecode using javap and used my rusty JRE assembler 'skillz' to understand it, but well, since he seems to have compiled it with full debug options, any idiot can find it ut by staring at the output for a sec.

    1. It doesn't use any "go fullscreen" API
    2. It's a failure of assuming sum of parts of software is as secure is as its components. It can be "less" secure than any of the component taken in isolation. Point in case is the set of APIs used:

    a) Toolkit.getScreenSize(): Used to find size of desktop. Nothing evil here
    b) Window.setBounds(): Used to set size of window. Nothing evil, except set it larger than screen size, hence hiding the applet warning by moving it "off screen"
    c) Window.setAlwaysOnTop(): Used to set the window on top. Essential for displaying "Modal" dialog boxed like error boxes. Nothing sinister here.

    However, the shit happens because all the things taken together can be dangerous. Specially, passing "System Modal" to setAlwaysOnTop().

    I don't see an obvious "fix" except the following hurdles that can be presented to unsigned applets (and hence breaking a lot of hobby games, apps etc)-

    1. Validate applet size to be always significantly less than screen size
    2. Remove support for "System Modal" for unsigned applets for "setAlwaysOnTop". Application modal is fine, system modal is not.

    Any more ideas shall be appreciated.

    Oh, and I again despise him for an irresponsible disclosure and presenting the hack in easily reverse engineered, fully functional code.

    --
    - mritunjai
  32. Re:Doesn't work.. by lhorn · · Score: 2, Interesting

    Iceweasel 2.0.0.6 seems to stop it with the 'Warn me when sites try to install add-ons' option enabled, even if I have Java enabled.

    --
    accept no limits but time
  33. Flash by Midnight+Thunder · · Score: 2, Insightful

    Is having a full screen window in java any different from having a full screen window in Flash? If so, wouldn't it just be as easy to use Flah, since it is likely installed on more systems than Java is.

    --
    Jumpstart the tartan drive.
  34. pfft by porkThreeWays · · Score: 3, Funny

    Pringles has been doing this for years. They are the original pop you can't stop

    --
    If an officer ever threatens to taze you, say you have a pacemaker.
  35. don't be dense by the_skywise · · Score: 3, Funny

    When you pop Pringles you get chips... not cookies.

  36. Re:Why I love IE by AKAImBatman · · Score: 4, Insightful

    I had finally gotten tired of cleaning Java-based viruses off my machines

    I believe you mean JavaScript viruses (very common) not Java viruses (extremely rare). Javascript viruses tend to be mostly harmless (stuff like, a popup you can't close) and are generally overblown by virus software. That's why your autoprotect software wasn't catching it: It wasn't that important. And erasing the files from your browser's cache after the fact is not really helpful either. You're not really "infected" per se. (Though some of those JS files are vectors into bigger and badder viruses.)

    So when I hear stuff like this article, it's another reason I love IE. Dumping Java was the best move MS ever made on the browser.

    That has to be the worst reason in existence to use IE. If you don't want Java, don't install it. FireFox won't do it automatically, nor will Opera, nor will Safari. Sticking with IE because it doesn't install a JVM by default is nothing more than a false sense of security.

    parent rating: -1 FUD
    --
    Javascript + Nintendo DSi = DSiCade
  37. To stop this technique, just.... by JRHodel · · Score: 2, Informative

    In Firefox, click on Options > Content and uncheck the Java Enabled checkbox. Then click on OK, and you're safe...

    --
    Think of the Irony!
  38. Re:Analysis of the "hack", or how sum of parts bre by jonathan3003 · · Score: 5, Insightful

    I don't see an obvious "fix" except the following hurdles that can be presented to unsigned applets (and hence breaking a lot of hobby games, apps etc)-
    1. Validate applet size to be always significantly less than screen size
    2. Remove support for "System Modal" for unsigned applets for "setAlwaysOnTop". Application modal is fine, system modal is not.

    I would expect that "System Modal" should be forbidden from any applet, even if it is signed. After all, it is running in a browser, not directly in the OS, so Application modal should be sufficient. In fact, one can argue that if you are writing an applet and you need System Modal functionality, then you are probably using the wrong technology anyways and should consider alternatives.

    Applets were designed to be sandboxed. System Modal should have been forbidden from the beginning anyways.

  39. Hail to the Troll by dsanfte · · Score: 2, Insightful

    That was quite possibly the finest example of elitist, childish, trolling bullshit I have read under this story so far.

    --
    occultae nullus est respectus musicae - originally a Greek proverb
  40. Default SecurityManager preventing worst-case? by jpavel · · Score: 2, Interesting

    I'm running a default 1.5.0_07 build on PPC OS X, with the MRJ plugin for Firefox, and I was watching the Java console when I tried his sample evil popup; I've put the stack trace below, but the gist is that

    java.security.AccessControlException: access denied (java.awt.AWTPermission setWindowAlwaysOnTop)

    it wouldn't let the window be always on top, and indeed it wasn't; I could use my desktop and other apps pretty normally. This isn't the default security policy?

    ~Jesse

    Wed Aug 08 11:57:08 EDT 2007 JEP creating applet FullScreen (http://evil.hackademix.net/fullscreen/classes/)
    java.security.AccessControlException: access denied (java.awt.AWTPermission setWindowAlwaysOnTop)
            at java.security.AccessControlContext.checkPermission (AccessControlContext.java:264)
            at java.security.AccessController.checkPermission(Acc essController.java:427)
            at java.lang.SecurityManager.checkPermission(Security Manager.java:532)
            at java.awt.Window.setAlwaysOnTop(Window.java:1358)
            at FullScreen.start(FullScreen.java:30)
            at sun.applet.AppletPanel.run(AppletPanel.java:418)
            at jep.AppletFramePanel.run(AppletFramePanel.java:176 )
            at java.lang.Thread.run(Thread.java:613)

  41. Re:Why I love IE by AKAImBatman · · Score: 3, Informative

    Well, there are a couple of things about CWS:

    1. It merely used the JVM as a vector to install itself. As a virus, it was actually a Windows program and was reported as such by all virus tools in existence. Thus the original poster would not have known it as a "Java virus".

    2. There are actually a wide variety of CWS variants. Some of them used the JVM vulnerability while others used other system vulnerabilities like a hole in the Windows Meta File.

    3. As another poster pointed out, it was a hole in Microsoft's VM that was exploited. Which would seem to be further evidence for moving away from IE.

    --
    Javascript + Nintendo DSi = DSiCade