Doctor FourMy other vehicle is a TARDIS Premium Member join:2000-09-05 Dallas, TX
1 recommendation |
Malvertisement on MSNBC.com using clipboard (copy/paste)Sandi Hardmeier, in her Spyware Sucks blog, is warning of a new type of malvertisement that overwrites Windows' clipboard, hoping that its URL will be pasted into blog entries, email and so on. It appears to be hitting people who visit MSNBC.com: » msmvps.com/blogs/spyware ··· 062.aspxThe fraudware site is xp-vista-update.net, which is in the MVPS hosts file (probably a recent addition as it is near the bottom when I searched for it). |
|
|
Norton alert |
Here's a screenshot of what happens when you try the link posted in the MSNBC forum. Note: I notified MSNBC webmaster div contact about this post and added the URL to Sandi's warning and to your topic here as well. Thanks for posting this info, too !!! -amy- |
|
amysheehan |
to Doctor Four
Post has been recently edited |
NOTE: Link in post at MSNBC has recently been edited and made viewable in post - I expect it to be removed soon. -amy- |
|
BKayrac Premium Member join:2001-09-29
1 recommendation |
to Doctor Four
PLEASE DO NOT CLICK THESE LINKS UNLESS YOU KNOW WHAT YOUR DOING ----------------------------------------------------------- Okay so basically the website listed goes like so (this is currently they could very easily change the redirects at any given time) http://xp-vista-update.net/?id=91873534231
--->http://webscweb-scannerfree.com/soft.php?aid=011807&d=2&product=XPA
------->http://windows-defense.com/2009/1/freescan.php?aid=77011807
this variant has almost 0 detection btw » www.virustotal.com/anali ··· 57e443d0-Brian |
|
Doctor FourMy other vehicle is a TARDIS Premium Member join:2000-09-05 Dallas, TX |
This could be happening with one of Microsoft's ad providers, which means MSN might also have the malvertisement. This could explain one of the forum posts Sandi linked that said this kept coming back even after a reformat and reinstall of Windows - by default, the home page for IE 7 is MSN. |
|
AVDRespice, Adspice, Prospice Premium Member join:2003-02-06 Onion, NJ |
to Doctor Four
Virus Warningsaid by Doctor Four:It appears to be hitting people who visit MSNBC.com: » msmvps.com/blogs/spyware ··· 062.aspxThe fraudware site is xp-vista-update.net, which is in the MVPS hosts file (probably a recent addition as it is near the bottom when I searched for it). I hope you copied that link by hand... you didn't use cut/paste did you?? |
|
|
mysec Premium Member join:2005-11-29 |
to Doctor Four
Re: Malvertisement on MSNBC.com using clipboard (copy/paste)said by Doctor Four:Sandi Hardmeier, in her Spyware Sucks blog, is warning of a new type of malvertisement that overwrites Windows' clipboard, Has anyone seen the source code that shows how this is done? |
|
doppler join:2003-03-31 Blue Point, NY |
to Doctor Four
said by Doctor Four:Windows - by default, the home page for IE 7 is MSN. And this is the reason why I hate windows IE (pick any version) The Default page should be about:blank. If the homepage is taken over in some way, everybody is in danger. If I wish to be dangerous. I don't need microsofts help. |
|
AVDRespice, Adspice, Prospice Premium Member join:2003-02-06 Onion, NJ |
AVD
Premium Member
2008-Aug-13 7:59 am
said by doppler:said by Doctor Four:Windows - by default, the home page for IE 7 is MSN. And this is the reason why I hate windows IE (pick any version) The Default page should be about:blank. If the homepage is taken over in some way, everybody is in danger. If I wish to be dangerous. I don't need microsofts help. I don't get it. Every browser has a home page. All you have to do is shut off your internet and you can change a bad home page without opening it. (You might have to clear your cache first though.) |
|
doppler join:2003-03-31 Blue Point, NY |
said by AVD:said by doppler:said by Doctor Four:Windows - by default, the home page for IE 7 is MSN. And this is the reason why I hate windows IE (pick any version) The Default page should be about:blank. If the homepage is taken over in some way, everybody is in danger. If I wish to be dangerous. I don't need microsofts help. I don't get it. Every browser has a home page. All you have to do is shut off your internet and you can change a bad home page without opening it. (You might have to clear your cache first though.) What you don't realize is every new computer rolling off the countless assembly lines. Has MSN website as the default. Only .01% of users of computers these days know enough about using them. Let alone using them correctly. If it wasn't for the other 99.99% I would not be in the nice side business of fixing microsofts dumb marketing decisions. Yes, the homepage default of MSN.COM is a marketing driven decision. What better way to get eyes on your website than to make the default page be yours. Look at how many people ask for help. In fixing there hijacked browsers. HIJACKTHIS, would not exsist if the browser default was hard to change, from your preferred setting. |
|
therube join:2004-11-11 Randallstown, MD 1 edit |
to mysec
quote: This should be blocked by setting Internet Options, Security, Internet Zone, Scripting, "Allow programmatic Clipboard access" to Disable.
I would be curious if this setting failed to block this vector.
»msmvps.com/blogs/spyware ··· 062.aspx
So it appears this would be a vector in IE that is being exploited? In my case (& I don't use IE) Clipboard access is set to "prompt". (Wonder what a prompt looks like or how I would respond to it if I were prompted?) And then this, Rogue ads pushing malware -- how it works, describes simply Refreshing the MLB web page & the popups start appearing? Which kind of doesn't make sense? So combine the two & perhaps Flash related? JavaScript related? JS being allowed to run in Flash? And there must be some code somewhere on an infected web site that allows the clipboard overwrite to take place. Again perhaps via Flash & JavaScript? (How can anyone say that using a Mozilla browser & NoScript does not have the potential to help is browsing safely.) EDIT:So perhaps MLB was injected with code, using a META tag to force malware page to open. Something like this: <META NAME="Keywords" CONTENT="handycamz, videos, pictures, camz, adult, porn, bla, bla, bla"><meta http-equiv="Refresh" content="0; url=http://winantivirus2008.org/freescan/?id=68">
|
|
therube 2 edits |
therube
Member
2008-Aug-13 10:45 am
And it looks like we're coming back to ActiveX too. And IE. IE being a "trusted" application, of course. Why might one have "Clipboard access" enabled? Well, because MS tells you to do so. quote: ActiveX controls are used for certain functionality in Microsoft Office Project Professional 2007 and in Microsoft Office Project Web Access. In order for the ActiveX controls to work properly, the Office Project Web Access Web site must be added to the list of trusted sites in Internet Explorer. There are additional security settings that can be configured, but they are optional.
»technet.microsoft.com/en ··· 703.aspx
Perhaps this cannot even be disabled in IE6? Disable Allow This Webpage to Access Your Clipboard Pop-Up Warning Message in IE7Picture here of what the prompt would look like, » msdn.microsoft.com/en-us ··· 85).aspxAppears you can disable this in IE6 too, » forums.spybot.info/archi ··· 665.html. That post includes a link to a site that retrieves your clipboard information, » www.sourcecodesworld.com ··· oard.asp. |
|
mysec Premium Member join:2005-11-29 |
mysec
Premium Member
2008-Aug-13 11:34 pm
Thanks for the information. Unfortunately, links from this site explaining the script code for cut, copy, paste, bring up "Content not found" » msdn.microsoft.com/en-us ··· 85).aspx |
|
Doctor FourMy other vehicle is a TARDIS Premium Member join:2000-09-05 Dallas, TX 1 edit |
And it isn't just Windows/IE users that are being hit by this. Here's a nail in the coffin for those who think Apple and Firefox are more secure: » msmvps.com/blogs/spyware ··· 705.aspxThe incident Sandi describes involves a Mac user and the Firefox browser. Apparently this copy/paste malware is also hitting Facebook and Digg users, as posters to Apple Discussions have noted. I don't know about Facebook, but looking at the source of Digg's home page indicates something might be in common with MSN and MSNBC: Microsoft advertising. |
|
mysec Premium Member join:2005-11-29 4 edits |
mysec
Premium Member
2008-Aug-16 1:50 am
Thanks for the link. Meanwhile, a search around the internet reveals that various codes for this "feature" or "exploit" have been around for a long time. As a "feature" people put code into their web pages with buttons to activate the copy/paste. Or to auto-copy text in a form. As an "exploit" where you force something to be copied to the clipboard, here is one I found for IE5/6: <script>
// Place your text in a variable
var strMyText = "some test text";
// Copy to clipboard
window.clipboardData.setData( "Text", strMyText );
</script>
I tried it even with that feature disabled in Options as mentioned by therube or even if Scripting is disabled, but it works anyway. I might not be doing something right in Options -- I don't know IE that well. As far as exploiting other browsers -- unfortunately no one in the Mac forum kept the URL for the offending page, and theories ranged from Java and Flash to Ajax as being able to write continuously to the clipboard, forcing the user to reboot to clear the clipboard. By the way - what do you suppose was copied to the clipboard of the Mac user mentioned on the Apple forum? If you guessed the WinAntiVirus2009 freescan site URL, you win a prize! EDIT: Here is a site which tests IE for capturing your last clipboard entry. The code is different, and the paste fails if I have scripting disabled, or "Allow paste operations via script" disabled. » www.sourcecodesworld.com ··· oard.asp |
|
|
jeno
Anon
2008-Aug-16 8:18 am
Try disabling the "Clipbook" service and see if it works... |
|
swhx7 Premium Member join:2006-07-23 Elbonia 2 edits |
to Doctor Four
At first I was sure this couldn't be done Javascript alone in Mozilla browsers. On following some links, I found one poster saying he did it with 20 lines of Javascript but only if a default was changed in about:config. The only source for a claim that it happened on Firefox is this post ( »discussions.apple.com/th ··· =7768848 ) on a Mac forum. As other posters suggested there, it probably relied on a plugin such as Java or Flash. Only Microsoft counts it as a positive "feature" that web pages can overwrite the clipboard. At least IE now has a more nearly explanatory label on the means to turn it off (it used to be "Allow paste operations via script"). Is it on by default in IE7 or 8? |
|
Doctor FourMy other vehicle is a TARDIS Premium Member join:2000-09-05 Dallas, TX |
More on this from Sandi: » msmvps.com/blogs/spyware ··· 914.aspxAlso, according some comments on The Register, this is happening on Monster, as well as Digg and Facebook, which were previously mentioned. And one reader got hit while browsing Ars Technica. Taking a look at several pages' source code, I believe I might have found the vector for the clipboard hijack: edge.quantserve.com. In each case, it is pulling a bit of javascript. It might be time to temporarily disable the hosts file, run Fiddler (an HTTP debugging utility) and see if this can be confirmed. |
|
Doctor Four 1 edit |
This is getting to be a hot topic, as Sandi notes. Also, Firefox and NoScript do not block the clipboard hijack. So far, the only ways to prevent it are either to block flash, or close the browser when it occurs. » msmvps.com/blogs/spyware ··· 130.aspxSeems having a hosts file does work, though. I have tried several of the sites in question, and not once have I seen this occur. I did try Newsweek's site, and quantserve/quantcast showed up again in the page's source. I didn't see it on either MSN or MSNBC's home page, though. Edit: I tested FF and NoScript on the proof-of-concept site Sandi mentioned. It doesn't work unless you allow the site in NoScript. Seems that would still be effective at preventing the hijack as it is coming from a third party (and one which is likely to be marked as untrusted). |
|
1 edit |
to Doctor Four
Try setting Firefox's clipboard.autocopy to 'false' in about:config. Also, check setting noscript.allowClipboard to see if it is set to 'false'. NoScript Options > Advanced > Trusted tab - uncheck the 'Allow rich text copy and paste from external clipboard' preference. |
|
SUMware2 1 edit
1 recommendation |
to Doctor Four
Pwning the clipboard - latest trick in FakeAlert distribution» www.sophos.com/security/ ··· from=rss"The fact that victims report experiencing these issues after browsing legitimate, popular sites, suggests that malicious Flash is the culprit. The attackers are probably using the setClipboard() method within ActionScript embedded in Flash content. Maybe the attackers have poisoned some ad-stream as a way of hitting large volumes of users? I guess we should be glad the Adobe folks were wise enough to not provide the corresponding getClipboard() method!" |
|
SUMware2 1 edit |
to Doctor Four
Re: Malvertisement on MSNBC.com using clipboard (copy/paste) NoScript | Proxomitron |
Hijack demo prevented by NoScript and Proxo via Flash control (read about the demo at bottom of page here) . |
|
BinkVillains... knock off all that evil join:2006-05-14 Colorado |
to Doctor Four
I swear, Flash is becoming the scourge of the Internet. If you use Internet Explorer, do yourself a favor and leave Flash disabled» flash.melameth.com. |
|
Doctor FourMy other vehicle is a TARDIS Premium Member join:2000-09-05 Dallas, TX 1 edit |
I decided last night to see if I could duplicate this hijack, so I did something dangerous, security-wse: I disabled my hosts file temporarily.
I then went to several of the sites where the hijack was being reported, while using IE and Fiddler, and not once did I see it - no fraudware URLs showed up in Fiddler's capture logs.
I'll try again tonight, but I have to wonder if the ad network that was a vector for this hijack caught onto it and got rid of it. |
|
therube join:2004-11-11 Randallstown, MD 3 edits |
to SUMware2
Ha! That is only too funny. I'm trying to figure out why I can't get the testcase to work? It was not until I went to copy/paste a URL into another window that I see it DID work. Crafty. If that happened to me out of the blue, it would be disconcerting to say the least. Using NoScript (& assuming that Flash is blocked) thwarts the exploit. And even if you were to Temporarily Allow the Flash, once you Revoke Temporary Persmissions, the exploit again ends. So it looks like my earlier thoughts were partially correct. It does involve Flash & JavaScript, but it is not dependent upon IE or ActiveX. |
|
1 edit |
to Doctor Four
Adobe Product Security Incident Response Team (PSIRT)From Adobe August 19, 2008: Clipboard attack" We are aware of recent press reports about a potential Clipboard attack issue that involves Flash Player. Adobe is currently investigating potential solutions to this issue and will update customers as soon as we have more information to provide." |
|
Doctor FourMy other vehicle is a TARDIS Premium Member join:2000-09-05 Dallas, TX |
to therube
Re: Malvertisement on MSNBC.com using clipboard (copy/paste)said by therube:Using NoScript (& assuming that Flash is blocked) thwarts the exploit. And even if you were to Temporarily Allow the Flash, once you Revoke Temporary Persmissions, the exploit again ends. So it looks like my earlier thoughts were partially correct. It does involve Flash & JavaScript, but it is not dependent upon IE or ActiveX. Indeed it does thwart the hijacking. From the NoScript homepage: » noscript.net/?ver=1.7.9& ··· blockingLooks like third party flash is blocked by default unless specifically allowed. |
|
|
to Doctor Four
I would just like to point out that this happened to me in Vista with Google Chrome today.
Damn! |
|
JLevinworthJames Levinworth Premium Member join:2004-11-21 Muddy Field 2 edits |
to mysec
Removed my response/question from last night as no longer relevant.
Just realized this was an old thread brought to the top again. |
|
|
to Doctor Four
To Be Fixed in Flash Player 10From ZDNetSeptember 19th, 2008 - quote: Adobe moves to nuke clipboard hijack attacks
Adobe has announced plans to modify the next version of its Flash Player to use an allow/deny system to mitigate clipboard hijack attacks.
The change will be fitted into the final version of Flash Player 10 to demand user interaction when a Shockwave (.swf) file attempts to set data on a users clipboard. It follows news that malicious hackers are using booby-trapped Flash banner ads to hijack clipboards for use in rogue security software attacks.
(See Aviv Raffs proof-of-concept demo to show how easy it is to use Flash with ActionScript code to persistently load a malicious URL into a target clipboard).
Heres the skinny on the Flash Player 10 changes:In Flash Player 9, ActionScript could set data on the system Clipboard at any time. With Flash Player 10 beta, the System.setClipboard() method may be successfully called only through ActionScript that originates from user interaction. This includes actions such as clicking the mouse or using the keyboard. This user interaction requirement also applies to the new ActionScript 3.0 Clipboard.generalClipboard.setData() and Clipboard.generalClipboard.setDataHandler() methods.
This change can potentially affect any SWF file that makes use of the System.setClipboard() method. This change affects SWF files of all versions played in Flash Player 10 beta and later. This change affects all non-application content in Adobe AIRhowever, AIR application content itself is unaffected.
Any existing content that sets data on the system Clipboard using the System.setClipboard() method outside of an event triggered by user interaction will need to be updated. Setting the Clipboard will now have to be invoked through a button, keyboard shortcut, or some other event initiated by the user. Adobe already uses an allow/deny mechanism when a SWF file attempts to access a users camera or microphone using the Camera.get() or Microphone.get() methods.
|
|