Slashdot Mirror
Adobe Flash Ads Launching Clipboard Hijack Attacks
bullyBEEF writes "Malicious hackers are using booby-trapped Flash banner ads to hijack clipboards for use in rogue security software attacks. In the Web attacks, which affect Mac, Windows, and Linux users running Firefox, IE, and Safari, bad guys are seizing control of the machine's clipboard (probably using the Flash command setClipboard) and inserting a hard-to-delete URL that points to a fake anti-virus program. A number of legitimate sites have been seen to host ads carrying the attack — including Newsweek, Digg, and MSNBC.com. Researcher Aviv Raff offers a harmless demo of how it's done."
But although the flash launched, that wasn't enough to get the attack going.
And given how much it takes for me to do even that, I don't think NoScript users have much to be worried about.
-- perl -e'print pack"H*","6e656d6f406d38792e6f7267"'
as though we really need yet another reason to use flashblock...
This one small piece of technology has made browsing the web bearable again. I can't ever thank its developers enough.
it copied "http://www.evil.com/ to my clipboard. Any app I pasted into pasted that url. I tried many apps to copy something to the clipboard but it remained evil.
The article says in one place you have to restart, and in another you have to close your browser window. I found that closing safari was not sufficient, and I had to quit safari to successfully copy different data into my clipboard with other apps.
I work for the Department of Redundancy Department.
Good thing my laptop runs EWF drivers. Any changes made to the C volume (a solid state drive) made in memory instead. Everything works like you'd expect it to - delete a file and it's gone - until you reboot, that is, and all of your in-memory changes are discarded.
I'd like to see XP Antivirus Pro 2008 thoroughly embed its tendrils... and then survive a restart. No changes are committed unless I manually force it.
Considering that Circuit City will sell you a PC with 6 GB of RAM for $999, I wonder why EWF isn't a standard feature. Probably because somebody would forget that defragging your hard disk would exhaust available RAM and then die, or wonder where that program they just installed went after they rebooted...
Linux has a similar filesystem, I believe it's used for boot CDs. It pairs the read-only volume with a RAM drive, and all writes are cached there and discarded.
DATABASE WOW WOW
I'll bet you can do it too in Shockwave with copyToClipboard. It is a little trickier though as copytoClipboard holds the reference to the Director member copied IIRC. Thinking about it, any web service that supports the clipboard should be able to do this.
- Zav - Imagine a Beowulf cluster of insensitive clods...
http://adblockplus.org/en/
Problem solved!
Seriously, blocking ads and javascript and flash stuff is like a game for me now, I get a little thrill of victory every time I block one of those things, it's great.
Well I accessed the page under Linux and Firefox 2 and the following things happened:
The middle mouse button pastes as usual.
The hijacked content only appeared with CTRL-V.
All I need to do is to close the page tab and it's gone.
Disappointing.
... on this old system with SuSE 9.1, FF 2.0.014, flash 7.
Hoorah for lazy upgrading ;)
---
"The chances of a demonic possession spreading are remote -- relax."
If you are using FF3 and beta Firebug, then you are probably seeing the DOM corruption bug that I see when ads are inserting into the DOM. The symptom is that the whole page disappears except for that ad. I've seen this behavior on several sites, including /. I haven't figured out a remedy yet except to disable Firebug, and we all know that's not going to happen!
~ I am logged on, therefore I am.
I realize its probably not the latest version of Opera...
"His name was James Damore."
I enabled the object in Firefox 3.0.1 with NoScript 1.7.8, Flash version is 9.0r124, and yes, it did set my clipboard.
Tried with Opera 9.51 on gOs/Ubuntu 7.10 and it did copy the url to my clipboard which I was unable to replace (with ctrl+c) until I closed the tab. After closure, I regained control of my clipboard.
I tried using a user javascript file that would block all flash content and allow me to individually activate the various flash files, but I had problems with things like YouTube, and eventually I abandoned it when certain websites I frequented used Flash for the most obsurd reasons (don't remember which, this was over a year ago). Might be worthwhile to bring it back.
Eggs
Milk
Bread
Cat Litter
Soda
Now I'm pissed why on earth are flash applications allowed to even go near our clipboards without explicit permission?
I remember a decade ago there were javascript functions to manipulate the clipboard but at least browser vendors have the common sense to disallow such actions without at least explict permissions.
Apparently security and privacy are second class citizen to Adobe. I'm very concerned.. this whole issue was addressed years ago..WTF?!?
I used to have ZoneAlarm as well. IMHO it is much better at configuring things like JavaScript access, etc. It has a very intuitive interface and is easily customizable.
Yea, I loved how ZoneAlarm was configurable. I had it set by default to block all Java, objects, and scripts then when I came across a website I wanted to allow them I could quickly configure it. If I wanted to, and I did a number of tymes, I could temporarily let a website use them. How well do NoScript and Flashblock work though in Firefox 2.0.0.6? That's what I'm using. I could upgrade to Firefox 3 but I wonder if I can still use my current version.
Falcon
Should there be a Law?
No thats happening in Auckland New Zealand
http://www.stuff.co.nz/4662948a11.html
Yeah, I know. I saw that they released an update today, which I'm not sure if it addresses the issue or not, but it was happening to me if the extension was enabled at all—regardless of whether I had the panels enabled or not.
~ I am logged on, therefore I am.
"The thing is, there are legitimate reasons why Flash, or any other web app, may access the clipboard"
Yep, which is why I actually have the browser ask me if an attempt is made whether to allow it. But, flash adverts shouldn't mess with your clipboard, which is why I believe the banner companies should do the screening/filtering, not that flash should have the functionality removed.
The revolution will not be televised... but it will have a page on Wikipedia
you can in KDE just open k;ipper, In windows I'd imagine I'd open wordpad and ctrl-v to see what was there.
Apocalypse Cancelled, Sorry, No Ticket Refunds
... yea, or you can RTFA and reach the following conclusion.
Demo:
(BEWARE: If you click on the demo link, your clipboard is automatically hijacked and will only be released if the browser window is closed).
Exploit:
From TFA
My clipboard has been hijacked with this:
[ malicious URL deleted ]
And once it's in the clipboard, I can't copy anything else over it until I've restarted the machine.
So basically, real exploit != demo exploit.
Yes flash block do have a list of allowed site, and it alone can stop the attack.
[]'s Victor Bogado da Silva Lins
^[:wq
Never assume malice when stupidity will suffice.