What browser feature is this exploiting and how to stop it?

http://raffa991[dot]ra[dot]funpic[dot]de/lol/
Warning: It is some kind of an annoying "you are an idiot" sign combined with a lot of popup message boxes. Open with care!

In any case, it crashed my firefox 3.5.4. (or to be more precise, made it unusable) ... I don't know about other browsers.

Since it's been a while since something that stupid did something like that, I'm wondering ... what weakness is that thing using (Javascript ?), and how to protect oneself from it ?

Rook

Posted 2010-03-21T15:28:31.303

Reputation: 21 622

@Nifle - what was the point of that edit ? I don't mind, I just think it was more clear the way it was. – Rook – 2010-03-21T18:38:34.033

Answers

Looking at the page source (using a text-mode downloader), it seems it is mostly Javascript.

The best way to avoid these kinds of annoyances is to use NoScript.

It also seems to have a Flash object somewhere in the page. Flashblock can help with that.

There is also some code which moves windows all over the screen. Firefox has a preference which allows you to disable moving and resizing windows (dom.disable_window_move_resize); you should enable it (you do not need to use about:config for it, it is somewhere in the preferences dialog). While at that, also disable blocking the context menu (dom.event.contextmenu.enabled); it is in the same place in the preferences dialog.

Finally, the relevant bug report is Bug 61098 – Exit all currently active scripts (allow aborting modal window.alert() loops in javascript (js)) (warning: over 200 comments on that bug report). Finding a solution to bug 61098 (and coding it) will be a large step on avoiding this problem.

Edit: an even better bug report is bug 432687, which is the meta-bug tracking all bug reports relevant to this problem.

CesarB

Posted 2010-03-21T15:28:31.303

Reputation: 4 480

NoScript deals with flash as well. – John T – 2010-03-21T15:36:33.970

The flash object is the sound. NoScript blocks flash objects by default. – Josh K – 2010-03-21T15:37:05.047

Beat by 31 seconds! – Josh K – 2010-03-21T15:38:01.347

@John T: not if you temporarily allow Javascript on a page. When you do that, Flashblock takes over. – CesarB – 2010-03-21T15:41:57.703

I cURL'ed the page and put it up (raw text, no worries) on pastebin.ca.

I also deleted ~400 blank lines that started off the page.

It looks to be pure javascript, switching between several arrays to make the title move and the text change.

NoScript soundly defeats this. It won't however defeat stuff like http://tinyurl.com/y8qdwsv without some ahead thinking.

Warning. Clicking that link can be hazardous to your computer's health.

Josh K

Posted 2010-03-21T15:28:31.303

Reputation: 11 754

The problem with that tinyurl link is https://bugzilla.mozilla.org/show_bug.cgi?id=167475 (it uses several IFRAMEs with SRC="mailto:...")

– CesarB – 2010-03-21T16:05:05.600

Correct, however it's still not fixed. 3.6 is vulnerable to this along with al the major browsers I've tested it in. It would also be a pain if you injected a <iframe src="http://path/to/page" /> into an include file in a site, thus making every page an attack page. Not sure how you would do that but I think it's a decently sized problem. – Josh K – 2010-03-21T16:10:42.890

@Mechanicalsnail So did the tinyurl. It's been a while :) – Nonny Moose – 2017-08-31T22:43:16.413

The pastebin died. – Mechanical snail – 2012-06-30T21:09:59.737

Yep, it's javascript alright. Check out the NoScript extension, it's great for blocking annoying things like this.

John T

Posted 2010-03-21T15:28:31.303

Reputation: 149 037

Just a regular old JavaScript prank site, it looks like. (Pointed cURL at the address :P)

As you're using Firefox, you can disable the window movement in Preferences ->Content ->Javascript ->Advanced, though there's no way to stop the messagebox spam built in, you could use NoScript to kill it before it has a chance to run.

Phoshi

Posted 2010-03-21T15:28:31.303

Reputation: 22 001