Slashdot Mirror
Adobe Flash Ads Launching Clipboard Hijack Attacks
bullyBEEF writes "Malicious hackers are using booby-trapped Flash banner ads to hijack clipboards for use in rogue security software attacks. In the Web attacks, which affect Mac, Windows, and Linux users running Firefox, IE, and Safari, bad guys are seizing control of the machine's clipboard (probably using the Flash command setClipboard) and inserting a hard-to-delete URL that points to a fake anti-virus program. A number of legitimate sites have been seen to host ads carrying the attack — including Newsweek, Digg, and MSNBC.com. Researcher Aviv Raff offers a harmless demo of how it's done."
But although the flash launched, that wasn't enough to get the attack going.
And given how much it takes for me to do even that, I don't think NoScript users have much to be worried about.
-- perl -e'print pack"H*","6e656d6f406d38792e6f7267"'
"Malicious hackers are using booby-trapped Flash banner ads to hijack clipboards..."
booby flash?
as though we really need yet another reason to use flashblock...
This one small piece of technology has made browsing the web bearable again. I can't ever thank its developers enough.
it copied "http://www.evil.com/ to my clipboard. Any app I pasted into pasted that url. I tried many apps to copy something to the clipboard but it remained evil.
The article says in one place you have to restart, and in another you have to close your browser window. I found that closing safari was not sufficient, and I had to quit safari to successfully copy different data into my clipboard with other apps.
I work for the Department of Redundancy Department.
Good thing my laptop runs EWF drivers. Any changes made to the C volume (a solid state drive) made in memory instead. Everything works like you'd expect it to - delete a file and it's gone - until you reboot, that is, and all of your in-memory changes are discarded.
I'd like to see XP Antivirus Pro 2008 thoroughly embed its tendrils... and then survive a restart. No changes are committed unless I manually force it.
Considering that Circuit City will sell you a PC with 6 GB of RAM for $999, I wonder why EWF isn't a standard feature. Probably because somebody would forget that defragging your hard disk would exhaust available RAM and then die, or wonder where that program they just installed went after they rebooted...
Linux has a similar filesystem, I believe it's used for boot CDs. It pairs the read-only volume with a RAM drive, and all writes are cached there and discarded.
DATABASE WOW WOW
But I fail to see how you can leverage this to gain privs.
If that's possible, then maybe that should be the subject of the article.
How we know is more important than what we know.
I'll bet you can do it too in Shockwave with copyToClipboard. It is a little trickier though as copytoClipboard holds the reference to the Director member copied IIRC. Thinking about it, any web service that supports the clipboard should be able to do this.
- Zav - Imagine a Beowulf cluster of insensitive clods...
http://adblockplus.org/en/
Problem solved!
Seriously, blocking ads and javascript and flash stuff is like a game for me now, I get a little thrill of victory every time I block one of those things, it's great.
Well I accessed the page under Linux and Firefox 2 and the following things happened:
The middle mouse button pastes as usual.
The hijacked content only appeared with CTRL-V.
All I need to do is to close the page tab and it's gone.
Disappointing.
... on this old system with SuSE 9.1, FF 2.0.014, flash 7.
Hoorah for lazy upgrading ;)
---
"The chances of a demonic possession spreading are remote -- relax."
If you are using FF3 and beta Firebug, then you are probably seeing the DOM corruption bug that I see when ads are inserting into the DOM. The symptom is that the whole page disappears except for that ad. I've seen this behavior on several sites, including /. I haven't figured out a remedy yet except to disable Firebug, and we all know that's not going to happen!
~ I am logged on, therefore I am.
I closed the demo window
The average user is not going to know that they have been hijacked and they won't necessarily know which window is doing it. The clipboard hijacker could even wait until you copy a url before modifying it.
I realize its probably not the latest version of Opera...
"His name was James Damore."
Just further proof that Adobe Flash is evil.
Fool me once, shame on you. Fool me twice, watch it -- I'm huge!
I enabled the object in Firefox 3.0.1 with NoScript 1.7.8, Flash version is 9.0r124, and yes, it did set my clipboard.
Tried with Opera 9.51 on gOs/Ubuntu 7.10 and it did copy the url to my clipboard which I was unable to replace (with ctrl+c) until I closed the tab. After closure, I regained control of my clipboard.
I tried using a user javascript file that would block all flash content and allow me to individually activate the various flash files, but I had problems with things like YouTube, and eventually I abandoned it when certain websites I frequented used Flash for the most obsurd reasons (don't remember which, this was over a year ago). Might be worthwhile to bring it back.
Eggs
Milk
Bread
Cat Litter
Soda
Now we know why the iPhone has no copy/paste support. It's a security issue!
Its about time they start making software that runs on Linux too.
These days you have to go out of your way to avoid flash by learning about and installing less popular Web browsers like Firefox and installing extensions (Add-ons) like NoScript that you have to educate yourself about. These days even browsers like Firefox come pre-installed with crapware and bloatware like Microsoft DRM and Shockwave Flash. These things I have manually disabled.
I often hear people on Slashdot claiming that Flash is safe, but I also constantly hear about flash-based exploits as well. To most Slashdot users I would think Flash would be relatively safe, however most people are not Slashdot users.
The Internet is becoming less accessible to me as the years go by. There is no need for Flash or Java or JavaScript (to navigate to a URL for example). I can only perceive malicious reasons why Web developers would try to force people to use these technologies.
When a Web site says Flash, JavaScript, Silverlight, Internet Explorer or anything else is required then that Website is never again visited. One must separate the wheat from the chaff.
Okay so the flash ad just copies something to the clipboard in a loop. Closing the tab or browser stops this. I suppose if you are running your browser in the background this would be very annoying and you wouldn't know.
Today firefox and IE prompt if you want to use the clipboard from javascript, but it used to not be this way. I'm sure Adobe will patch this soon enough.
This is like old popups...and oversight that is being exploited by the annoying "internet bully". It's like getting a wet willing or you head stuffed in a toilet.
The issue is here that both Flash and the underlying operating system don't have any kind of cut and paste protection. X, Mac OS X, and XP/Vista should not allow a program to copy and paste the same dam string to the clipboard over and over. Really kind of annoying that we have to spend so many human hours fixing "problems" like this...but such is life I suppose.
I am visiting the test site using Firefox with Flashblock on Ubuntu 8.04. I press Ctrl+V, and there it is, http://www.evil.com.
This only happens sporadically, though, and I can always just Ctrl+C something else. I believe this is because Flashblock blocks ads as they are loaded, not before they load (not 100% sure about this).
Does anybody else have this issue?
So now it seems that Linux's nonintegrated multiple clipboards and their UIs (Ctrl-c, and select/middle-click) are a security feature, not a bug.
--
make install -not war
> When a Web site says Flash, JavaScript, Silverlight, Internet Explorer or anything else is required then that Website is never again visited. One must separate the wheat from the chaff.
This maybe is true, except if you want to do a real web application. Loading a whole HTML-page, just to change some state of an (non-form-element) interface element... That's insanity. ;)
You've done the same that someone in a trauma does. You're created false associations. It's not the technology or even the virtual machine that's bad. It's the implementation.
Your argument is the same, as if someone who had only bad experiences with x86, while having good ones with his old 86000s, argues that "if an application requires x86, then that application is never again used."
The same is true for OSes. Someone could implement Windows XP in a proper manner, and make it a very safe system. (I did not say that someone would want, tough
Or in short:
Someone can crack a bad JavaScript VM and contaminate the rest of the system. And someone could crack a bad OS, and contaminate the rest of the system. There are even examples for this on virtualization VMs. (Heck, the system's clipboard is accessible to all 3 of them, on modern VMs!)
So my vote goes for Replacing the JavaScript VM with a hardened generic VM, with a fixed interface to the outside world, and adding JavaScript, Python, Ruby, Haskel, Ocaml and more as languages to it (via add-ons, or pre-compiled?)
Okay, I think one should remove at least one layer of abstraction/VM and harden the OS so that even OpenGL on JavaScript would not have a performance loss. (Yes, this would be useful. Eg. for quick dynamic data visualization or entertainment applications.)
Any sufficiently advanced intelligence is indistinguishable from stupidity.
I got hit with this last night and it was a bitch trying to figure out what it was. I literally spent hours trying to find what had hijacked my computer. I finally said screw it and reinstalled Linux, because the only game I play regularly can be loaded in Wine.
"Ubuntu" -- an African word, meaning "Slackware is too hard for me". - stolen from Dan C alt.os.linux.slackware
I used to have ZoneAlarm as well. IMHO it is much better at configuring things like JavaScript access, etc. It has a very intuitive interface and is easily customizable.
Yea, I loved how ZoneAlarm was configurable. I had it set by default to block all Java, objects, and scripts then when I came across a website I wanted to allow them I could quickly configure it. If I wanted to, and I did a number of tymes, I could temporarily let a website use them. How well do NoScript and Flashblock work though in Firefox 2.0.0.6? That's what I'm using. I could upgrade to Firefox 3 but I wonder if I can still use my current version.
Falcon
Should there be a Law?
I just use SWFDec. It avoids the Flash problem by failing to play about 50% of the stuff out there.
The demo hijack page doesn't work, either. Surprise!
Just kidding. I like SWFDec much better than Flash + nspluginwrapper on my 64-bit Lenny.
Put identity in the browser.
Once again we see the serious consequences of allowing a single company to serve a proprietary solution which opens up browsers and the platforms they run on to serious security flaws. This is ActiveX Part Deux, or perhaps Son of ActiveX.
To some extent I blame the guys writing the browsers. They're the ones letting plugins and extensions to have this much control over clipboards. The solution here is obvious, though Adobe may not like it, but at this point I think Adobe's concerns shouldn't even enter the equation.
The world's burning. Moped Jesus spotted on I50. Details at 11.
I often hear people on Slashdot claiming that Flash is safe
Well sir you must view /. at a much lower threshold then I do!
On the Oregon Cost born and raised, On the beach is where I spent most of my days
After a decade of horrors visited upon the world by Internet Explorer, you'd think everyone would view such a large proportion of content being delivered via a proprietary format and software (one, mind you, that renders via software and doesn't even have a functioning 64 bit version) as so incredibly dangerous and foolish as to dismiss it.
If just as much effort were put into a better streamlined and functional Javascript/ECMAscript interpreter based on open specs as is being put into reverse engineering Flash and now trying to figure out ways to secure it, we wouldn't even need the goddamn thing to begin with. There are better scripting engines than flash, there are better video formats than Flash, so why the fuck is so much attention paid to something that's so inherently flawed?
The world's burning. Moped Jesus spotted on I50. Details at 11.
Yeah, I know. I saw that they released an update today, which I'm not sure if it addresses the issue or not, but it was happening to me if the extension was enabled at all—regardless of whether I had the panels enabled or not.
~ I am logged on, therefore I am.
you can in KDE just open k;ipper, In windows I'd imagine I'd open wordpad and ctrl-v to see what was there.
Apocalypse Cancelled, Sorry, No Ticket Refunds
Worked here as well. One more point against flash, what on *earth* were they thinking when they put that 'feature' in there ?
MP3 Search Engine
... yea, or you can RTFA and reach the following conclusion.
Demo:
(BEWARE: If you click on the demo link, your clipboard is automatically hijacked and will only be released if the browser window is closed).
Exploit:
From TFA
My clipboard has been hijacked with this:
[ malicious URL deleted ]
And once it's in the clipboard, I can't copy anything else over it until I've restarted the machine.
So basically, real exploit != demo exploit.
Yes flash block do have a list of allowed site, and it alone can stop the attack.
[]'s Victor Bogado da Silva Lins
^[:wq
Never assume malice when stupidity will suffice.
Congrats. Now imagine that you don't know which window of a dozen well-known webpages has the malicious ad hidden in it.
Well, there's also video cam support - it is supposed to ask your permission first, but perhaps there are unexplored features/vulnerabilities in it too :
http://www.macromedia.com/support/documentation/en/flashplayer/help/help04.html#117089
If I was a hacker^^^^^^security researcher, I'd be looking there first.
One of the reasons why I surf with Flash off.
As with everything in life, you have to find the happy medium. Flash has legitimate purposes (repid e-learning development and delivery, for example) that far outweigh the risks of clicking on a rogue advert. Do I want to disable Flash to feel "safe" and prevent unpleasantries, such as flashing/blinking/buy-me ads at the cost of not being able to conduct the mandatory training module I have to complete for work?
Why you have to do it, why this is not the default? The problem is that you started with a faulty concept and then to fix without breaking every other application is hard.
As I said before, I know MS is trying hard to fix this, but that was not my point, I was only pointing out that concepts can be broken independently of their implementation.
[]'s Victor Bogado da Silva Lins
^[:wq