Slashdot Mirror

← Back to Stories (view on slashdot.org)

Google Fixes Chrome 'Evil Cursor' Bug Abused by Tech Support Scam Sites (zdnet.com)

Posted by msmash on from the security-woes dept.

Google has patched a Chrome bug that was being abused in the wild by tech support scammers to create artificial mouse cursors and lock users inside browser pages by preventing them from closing and leaving browser tabs. From a report: The trick was first spotted in September 2018 by Malwarebytes analyst Jerome Segura. Called an "evil cursor," it relied on using a custom image to replace the operating system's standard mouse cursor graphic. A criminal group that Malwarebytes called Partnerstroka operated by switching the standard OS 32-by-32 pixels mouse cursor with one of 128 or 256 pixels in size. A normal cursor would still appear on screen, but in the corner of a bigger transparent bounding box. [...] The "evil cursor" fix is currently live for Google Canary users, and is scheduled to land in the Chrome 75 stable branch, to be released later this spring.

56 comments

  1. de facto standard by Anonymous Coward · · Score: 4, Funny

    I'm so happy that Chrome is the new Internet Explorer. Looks at all of the great reasons to use Chrome.

    1. Re:de facto standard by Anonymous Coward · · Score: 1

      Browsers support custom mouse cursor images for the sake of web games and to allow browsers to build immersive experiences

      Bullshit. There is ZERO reason for a website to fuck with your cursor. Fuck you and your "web games" and "immersive experience" bullshit.

      so disallowing over-sized cursors wasn't an ideal solution

      No, preventing websites from fucking with your cursor is EXACTLY the right solution.

      as it would have negatively impacted thousands of sites, if not more.

      Oh, boo-fucking-ho. If you can't do things with a normal cursor you need to fuck off and die.

    2. Re:de facto standard by omnichad · · Score: 3, Insightful

      Win32 apps change your cursor. And it's functional, not just cute crap. A web-based photo editor needs dragging handles, I-beam cursor, brush size indication, etc. The problem isn't the existence of the feature.

    3. Re:de facto standard by Anonymous Coward · · Score: 0

      Try rdesktop -M and see how little you actually need this anymore.

    4. Re:de facto standard by tepples · · Score: 1

      [Expletive] you and your "web games" and "immersive experience" [nonsense].

      In what way would a reasonable person consider a "SORRY! This game is not yet available for your platform." screen superior to a web game?

    5. Re: de facto standard by Anonymous Coward · · Score: 0

      What the fuck are you babbling about, fool?

    6. Re:de facto standard by The+MAZZTer · · Score: 2

      I'm so happy that Chrome is the new Internet Explorer. Looks at all of the great reasons to use Chrome.

      Actually this exact same exploit should work fine in IE too, including really old versions back to IE6 if not further.

    7. Re:de facto standard by Anonymous Coward · · Score: 0

      In what way would a reasonable person consider a "SORRY! This game is not yet available for your platform." screen superior to a web game?

      I'm looking around on GOG and have yet to see a single "web game". Because...

      "Web games" are Skinner box designed to extract money from idiots. Good games run locally, at least in large part, and are typically written in C#, C++, or sometimes C if they are very old. Once in a great while, even Java, but in a mere handful of cases. Mostly C# and C++.

    8. Re:de facto standard by nazsco · · Score: 1

      A huge LOL at everyone even thinking google did something to improve online games.

      Their business depends on Ads. Some Ad agency called them and said "we need huge ass cursors for our new Ad masterpiece", and google rushed to comply.

      You can have fun reading their public emails on the thousands of cases that they were required to provide emails as evidence, and i guarantee you will find one department's mass-email congratulating team so and so for the win of enabling big ass cursors on Chrome and unlocking many dollars from some Ad agency doing a campaign for some big name brand on AdWords or something.

      Online games (and scammers) just scrape by, picking whatever falls on the floor from the mouth of Ads.

    9. Re:de facto standard by Anonymous Coward · · Score: 0

      why is it that people are too stupid to just use ALT+F4, ALT+TAB or what ever shortcut the browser uses to close a page?

      or even to use backspace to go to a previous page or map a mouse button for that purpose? there are SO many ways to avoid stupid crap like that... how dumb have the average computer user become since this is even remotely a problem?

    10. Re:de facto standard by tepples · · Score: 1

      Good games run locally, at least in large part

      Provided that 1. the game is ported to your platform (it often isn't, particularly for minority platforms like X11/Linux and macOS) and 2. you have permission from the device's owner or in some cases the device's manufacturer to install the game (a user often doesn't).

  2. Why was this possible again? by Anonymous Coward · · Score: 0

    The trick was first spotted in September 2018 by Malwarebytes analyst Jerome Segura. Called an "evil cursor," it relied on using a custom image to replace the operating system's standard mouse cursor graphic.

    So, what useful feature was this meant to support?

    We live in a world where it has been well known the web is full of malicious actors for 20 years. So why is it we keep making browsers able to do more and more stupid shit which cause problems?

    Sorry, but I'm already using blockers to block the third party assholes, scripts, cookies, web-bugs, and the countless list of assholes and parasites I don't want as part of my browsing experience.

    Why the hell are we letting a fucking browser change the OS cursor again?

    Oh, wait, it's in Chrome, I'm sure the assholes in marketing had some useless shiny bullshit in mind.

    Sorry, it's bullshit like this why I don't let most sites run scripts, and the third parties who add nothing to the page experience get blocked -- it's impossible to know which are merely greedy assholes, and which are malicious assholes so the only solution is block them all.

    1. Re:Why was this possible again? by Anonymous Coward · · Score: 0

      Oh, wait, it's in Chrome, I'm sure the assholes in marketing had some useless shiny bullshit in mind.

      Hey guys, did you see this ad? This one right here. Let me point it out to you so you don't miss it.

      I'm just going to go ahead and click it for you if you don't mind...

    2. Re:Why was this possible again? by Anonymous Coward · · Score: 0

      Wait till you see the web-USB extension.

    3. Re:Why was this possible again? by omnichad · · Score: 2

      How do you know when you're at a resizable corner of an object? Your cursor changes. Designing web based software, you need these sorts of things as part of your visual language. The only thing that needs fixed is the security of it.

    4. Re:Why was this possible again? by Anonymous Coward · · Score: 0

      I can't wait to use my ePenis online!

    5. Re:Why was this possible again? by olsmeister · · Score: 1

      Designing web based software, you need these sorts of things as part of your visual language.

      No. Just fucking NO

    6. Re:Why was this possible again? by Anonymous Coward · · Score: 0

      my mouse ARROW changed to a pointing HAND when I went to click on "Reply to This"
      Wonder why that might be.....

    7. Re:Why was this possible again? by Anonymous Coward · · Score: 0

      , you need these sorts of things

      No.

      No, you don't. Random Web Site does not need to fuck with my cursor.

      Or my clipboard.

      Or my browsing history.

      Or my back button.

      Or my speaker.

    8. Re: Why was this possible again? by Anonymous Coward · · Score: 0

      Who even uses chrome for anything serious or fun anymore? I keep hearing the name but I don't even remember what the chrome logo looks like or the names of anyone who works at Google.

    9. Re:Why was this possible again? by Anonymous Coward · · Score: 1

      The problem here is fully custom pointers. It's highly unlikely any non-game "web-based software" would be significantly affected by being restricted to only the non-url forms of this.

      Your software can have access to system standard cursors without a security issue.

    10. Re:Why was this possible again? by Anonymous Coward · · Score: 0

      The problem here is javascript.

      FTFY.

    11. Re:Why was this possible again? by Red_Forman · · Score: 1

      The problem here is people.

      FTFY.

    12. Re:Why was this possible again? by Anonymous Coward · · Score: 0

      Not all of them. Just the "web developers".

    13. Re:Why was this possible again? by omnichad · · Score: 1

      Paint brushes with variable size and hardness.

    14. Re: Why was this possible again? by Anonymous Coward · · Score: 0

      That's your problem, you self absorb piece of turd.

      Someone else wants it and if you don't you can go fuck yourself. Obviously google agrees with those comments and not you and will continue fucking you over.

      I don't want this feature ... I don't want to read this comment.... you have the right to stop using anything like chrome or the internet. Exercise that right and fuck off.

    15. Re:Why was this possible again? by Anonymous Coward · · Score: 0

      You could make the BORDER of the object change to show you that you're at the corner, without changing the cursor at all. What a crazy idea!
      You could make the BORDER display some small arrows along the corners, showing it's selected when the cursor is over it.

  3. Repeat after me... by Anonymous Coward · · Score: 0

    Repeat it after me: Do not run random unknown and untrusted scripts by default.

    Time after time after time we see the same story. Vulnerability after vulnerability is exploited, malicious behavior after malicious behavior, blocking cut and paste, blocking back buttons, delivering malware, demonstrated attacks against Spectre and Meltdown, scraping data you didn't want scraped, annoy-ware, auto-playing audios, auto-playing videos, it's literally a weekly event that we see some new form of shitware delivered by Javascript from some weird domain as one of the hundred or more used by some site.

    JUST SAY NO.

    Running scripts given to you by sources who do not have your interests in mind is idiotic. It was not a good idea when it started, and it is not a good idea now.

    How much shit-ware do we need, before we learn that giving such a massive attack surface to any of a hundred random domains used by some site you connect to is not a good idea? How much malware packaged up with ads? Why would you allow some random ad from some unknown source to run code on your system?

    Turn that shit off. It's time.

    But Anonymous Coward! The web is broken like that!!one! Partially, but only because all of you idiots with JS enabled by default taught those sites that you would happily do anything they wanted you to do. If they said "jump" you asked "how high sir?"

    But Anonymous Coward! I need to use JS to give you my crapware! I don't care. It's my computer, and I will decide what it does. Not you.

    It's time to start teaching them the opposite lesson. Turn it off. If a site is broken that way when all it had to do was show you some text and pictures, or link to a video or two, that site was not your friend.

    I'm getting real sorely tempted to save this message and paste it in every time we hear of Yet Another Malicious Use Of Web Delivered Scripts.

    AC out.

  4. System-defined resize cursor by tepples · · Score: 1

    How do you know when you're at a resizable corner of an object? Your cursor changes

    Ideally, one of the following would be the case:

    A. The user hasn't yet whitelisted JavaScript on the domain and therefore the site neither knows nor cares where the user is "at".
    B. The user has whitelisted JavaScript on the domain but not site-supplied cursor images. The site changes the cursor to a system-defined resize cursor, not an image supplied by the site.
    C. The user has whitelisted cursor theming for this site. This would rarely happen except for games.

    1. Re:System-defined resize cursor by omnichad · · Score: 1

      Cursor can also be set by CSS

    2. Re:System-defined resize cursor by tepples · · Score: 1

      If an HTML document on a given domain is using CSS to set a cursor, but the user hasn't opted in to showing site-supplied cursors on that domain, it would start in state B.

  5. Left hand, meet right hand by Anonymous Coward · · Score: 0

    Ok Google now please stop advertising those scams!

  6. Chat, Web 1.0 style by tepples · · Score: 1

    It's time to start teaching them the opposite lesson. Turn it off. If a site is broken that way when all it had to do was show you some text and pictures, or link to a video or two, that site was not your friend.

    Without script, how would an HTML document representing a chat channel pull in new messages? As far as I can tell, it'd need to rely on an iframe that sends <meta http-equiv="refresh" content="10;url=http://example.com/" /> which would cause an annoying flash every 10 seconds as the entire message pane reloads from scratch.

    Or would you instead prefer that the website offer a companion native app? Some sites do, but rarely for all relevant platforms (Windows, macOS, X11/Linux AMD64, X11/Linux ARM, iOS, and Android). And even on platforms where the companion native app is available, it's rarely RAM-efficient; I measured the Electron-based Skype for Linux app as using over 500 MB of RAM.

    Or would you instead prefer that the website offer service using a standard protocol, such as IRC, to which the user can connect using an existing native application that the user can easily obtain for all major platforms? Limits of the IRC protocol include no avatar images, no chat history (even if a channel wants to use it), no sending files from a device behind NAT, and no reactions to a message.

    1. Re:Chat, Web 1.0 style by aybiss · · Score: 2

      Yeah, we actually don't want applications to run in web browsers. That's what you need to wrap your head around.

      --
      It's OK Bender, there's no such thing as 2.
    2. Re:Chat, Web 1.0 style by Anonymous Coward · · Score: 0

      Without script, how would an HTML document representing a chat channel pull in new messages?

      Ah, I see the problem. You appear to think that I want your shitty "web software".

      I don't. Have a perfectly good chat system that runs locally and beats the shit out of whatever your "web chat" is doing. It works with every OS I've ever heard of. It doesn't require Javascript to be enabled thus opening up a gaping huge attack surface for the kind of malicious actors that inhabit the web.

      Electron-based Skype

      Again, I see your problem. "Electron based". Do not want.

      Repeat after me until you understand: I. Do. Not. Want. Your. Shitty. Web. Software.

      Go the fuck away, and take your "web software" with you. It sucks. It rarely works well. It's slow. It has enabled the massive security clusterfuck we have been suffering now for decades. It's annoying. It doesn't even look and feel like a proper application should.

      You are what's wrong with the modern internet. Just go away.

    3. Re:Chat, Web 1.0 style by mattventura · · Score: 2

      It’s almost like Electron apps aren’t actually native apps, they’re just a web browser with less UI. Which is even worse than running it in an actual browser, because then you have the memory overhead of two browser runtimes and less sandboxing.

    4. Re:Chat, Web 1.0 style by Anonymous Coward · · Score: 0

      they’re just a web browser with less UI. Which is even worse than running it in an actual browser, because then you have the memory overhead of two browser runtimes and less sandboxing.

      Exactly.

      People pretending "electron" apps are "native apps" in order to complain about the 500 MB memory use are either fools, or disingenuous. Or both.

    5. Re:Chat, Web 1.0 style by tepples · · Score: 1

      Have a perfectly good chat system that runs locally and beats the shit out of whatever your "web chat" is doing. It works with every OS I've ever heard of.

      How does a small team go about making "a perfectly good chat system that runs locally" on all desktop and mobile operating systems? And how do prospective users go about obtaining permission to install "a perfectly good chat system that runs locally" on the computers that they use?

  7. WTF? by Anonymous Coward · · Score: 0

    Have these people not heard of ALT-F4? CTRL-W? CTRL-SHIFT-ESC? ALT-M? ALT-D?
    I mean pretty much any random combination of key presses will get you out.
    Reminds me of the good old days when we used to replace the cursor with a 1 pixel dot on the school computers.

    1. Re:WTF? by darkain · · Score: 4, Informative

      Average users? Not so much. Not everyone grew up in the Win3.1 era where keyboard shortcuts were pretty much required to do anything meaningful in the OS.

    2. Re: WTF? by Anonymous Coward · · Score: 0

      Bye

    3. Re:WTF? by PPH · · Score: 1
      > kill `pidof google-chrome`

      Gets me out. Every time.

      --
      Have gnu, will travel.
  8. Misconceptions by The+MAZZTer · · Score: 3, Insightful
    Let me clear some things up:
    1. Being able to change the cursor is a pretty important thing. You know how links turn into a hand when you hover over them? That's the main use. I myself have used custom cursors to provide intuitive help when the user hovers over a UI element. It shows you how to use it. Is it a resizer? What directions can it resize? Does it move something? Can you not interact with it at all? Is it a hyperlink? Is it text I can select?
    2. This is something that could be exploited waaaay back to IE6 and probably earlier, and should work in every browser. Chrome is particularly vulnerable because alert boxes are not popup boxes which block the whole browser, to prevent pages from locking up the browser with alert boxes, so the cursors still show even when an alert box is up as the user has their mouse over the webpage. I presume at least part of the fix will be to disable custom cursors when an alert box is shown, since the user can't interact with the page anyway until it's dismissed.
    3. This is pretty easy to get yourself out of once you realize what is going on. It works mostly by confusion. Users move their cursor up to close the tab or click OK on the alert, but the cursor is actually still inside the webpage. Once you move the cursor outside of the webpage, the custom cursor is correctly changed back to a standard one. However users see the cursor outside the webpage and think it is there (understandably) but it's actually inside, so the custom cursor remains in play. Chrome could potentially detect cursors where the hotspot is transparent and simply block those entirely, fixing this problem altogether, and I hope they do.
    4. Custom cursors or standard cursor changes are entirely CSS and require no JavaScript to implement on a webpage, though of course JavaScript can be used to add or modify CSS at runtime. Blocking JavaScript will not completely protect you from this exploit.
    5. If you think custom cursors are terrible, you are welcome to go to Windows Mouse settings and change all the cursor types to the default, and see how long it takes you to give up and change them back.
    1. Re:Misconceptions by Anonymous Coward · · Score: 1

      Ah, there's two different issues:

      1. Allowing the application/css to chose from a selection of approved cursors (e.g., resize, zoom-in, i-beam, hand, arrow); and
      2. Allowing the application/css to load any arbitary SVG/PNG file and use that as a cursor.

      Restricting (web) application to the cursors that have been set in Windows Mouse settings (i.e., allowing option one) is fine by me. Option two is where the trouble lies.

    2. Re: Misconceptions by Anonymous Coward · · Score: 0

      Absolutely not. There is no valid need for a browser to change a cursor. And no, image editors in html are not image editors, make a native app and ship it. And no, native does not mean an electron dreck.

  9. did you see rabbi shmuley's ad? by Anonymous Coward · · Score: 0

    did you see rabbi shmuley's full page ad?

    why would henry ford and ilhan omar agree on the nature of jews... other than because they see the same thing, aka the truth?

    the goyim know~!

  10. "locked in a browser tab"? by JustAnotherOldGuy · · Score: 2

    "...and lock users inside browser pages by preventing them from closing and leaving browser tabs."

    Ummm, is it soooo hard to use CTRL-F4 to close a tab on Windows or Linux?

    Locked in a browser tab, oh noes! So scary.

     

    --
    Just cruising through this digital world at 33 1/3 rpm...
    1. Re:"locked in a browser tab"? by DamonHD · · Score: 1

      Why the snark? Do you get off on making other people feel small?

      If people don't understand what's going on it can be worrying or worse. I suspect from your ID (if not your handle) that I may have been programming in assembler and using multiple OSes since before you were born, and don't happen to know that hot-key sequence.

      --
      http://m.earth.org.uk/
    2. Re:"locked in a browser tab"? by Anonymous Coward · · Score: 0

      Alt-F4 goes way back at least on Windows. Not sure what programming in assembler has to do with not knowing how to force close an app in Windows.

    3. Re:"locked in a browser tab"? by DamonHD · · Score: 1

      Maybe Windows is not all I (or these other people) use or do all day so why should we happen to remember obscure commands for the least nice and most flaky ones?

      Can you tell me the equivalent for (say) C/PM, M/PM, the BBC Micro and a bunch of very common home computers, several mainframe OSes including some uni homebrews, several dozen flavours of UNIX with varying terminal settings since the 80s, Mac OS up to 9 and the current macOS, etc, etc? Plus embedded systems of various types from the 80s onwards? And (say) the common debugging tools in each? And some X.25 PAD escapes, and ssh, screen? Why not, it's obvious!

      Just because you know one thing that's important to you, does not make it important or obvious to people with other priorities in life... Nor does it make it right to attempt to shame someone for not knowing,

      --
      http://m.earth.org.uk/
  11. Leaves the client area by Anonymous Coward · · Score: 0

    ... lock users inside browser pages ...

    There's de-maximizing the application to increase cursor mobility, using the tab-element context menu to close a tab, or for really clever people, using the Windows keyboard-shortcut to close a tab. Why is a custom cursor allowed on a Windows UI element? That's the problem, how about unloading a custom cursor when it leaves the client area?

  12. How about fixing the Evil Company problem by Anonymous Coward · · Score: 0

    Hey, Google,
    How about fixing the "You have become a massively Evil company" problem.

    Google is the new Microsoft.

  13. So web pages can change browser chrome? by Anonymous Coward · · Score: 0

    I agree that custom cursors are a very useful feature. But if I understand this correctly, web pages could previously change the cursor shown when hovering over the Googlechrome chrome, i.e. addressbar, tabs, scrollbar, borders and alerts. I thought for a webpage to change the browser UI (outside the content pane) is a big no-no. Does the CSS spec really call for this?

  14. Fix Android Evil Cursor by Anonymous Coward · · Score: 0

    Now fix android. That evil cursor keeps jumping around when I type, adding letters, deleting entire words, before slowing down excruciatingly and spitting out a handful of letters as I wait for it to catch up to my typing.

    What the fuck Google, this is very basic input

  15. 128x128 and 256x256 cursors? by Anonymous Coward · · Score: 0

    Where can I get me some of those extra-large cursors the article is referring to?

    I have a 4K monitor, and while I run it without rescaling anything, sometimes I find myself searching for the cursor (which could very well be on one of my secondary monitors), and wouldn't mind a larger one. I realize rescaling to 125, 150 or even 200% would take care of that, but that would resize *everything*. I just need larger than 32x32 cursors.