Doctor Four
My other vehicle is a TARDIS
Premium
join:2000-09-05
Dallas, TX
 ·AT&T U-Verse
|  Malvertisement on MSNBC.com using clipboard (copy/paste)
Sandi Hardmeier, in her Spyware Sucks blog, is warning of a
new type of malvertisement that overwrites Windows' clipboard,
hoping that its URL will be pasted into blog entries, email and
so on. It appears to be hitting people who visit MSNBC.com:
»msmvps.com/blogs/spywaresucks/ar···062.aspx
The fraudware site is xp-vista-update.net, which is in the
MVPS hosts file (probably a recent addition as it is near
the bottom when I searched for it).
--
"The trouble with computers, of course, is that they are very sophisticated idiots." - Doctor Who (from Robot)
|
|
amysheehan
Premium,VIP,MVM
join:1999-12-21
Huntington Beach, CA
 ·RoadRunner Cable
| 
Norton alert |
Note: I notified MSNBC webmaster div contact about this post and added the URL to Sandi's warning and to your topic here as well.
Thanks for posting this info, too !!!
-amy-
--
Proud Member of ASAP
DSLR Phishtracker |
|
amysheehan
Premium,VIP,MVM
join:1999-12-21
Huntington Beach, CA
·RoadRunner Cable
| reply to Doctor Four
Post has been recently edited |
-amy-
|
|
Kayrac
Premium
join:2001-09-29
Rochester, NH
| reply to Doctor Four
PLEASE DO NOT CLICK THESE LINKS UNLESS YOU KNOW WHAT YOUR DOING
-----------------------------------------------------------
Okay so basically the website listed goes like so
(this is currently they could very easily change the redirects at any given time)
this variant has almost 0 detection btw
»www.virustotal.com/analisis/48bb···57e443d0
-Brian |
|
Doctor Four
My other vehicle is a TARDIS
Premium
join:2000-09-05
Dallas, TX
·AT&T U-Verse
| reply to Doctor Four
This could be happening with one of Microsoft's ad providers,
which means MSN might also have the malvertisement. This
could explain one of the forum posts Sandi linked that said
this kept coming back even after a reformat and reinstall of
Windows - by default, the home page for IE 7 is MSN.
--
"The trouble with computers, of course, is that they are very sophisticated idiots." - Doctor Who (from Robot)
|
|
avd706
insert annoying animated gif here
Premium
join:2003-02-06
Union, NJ
| reply to Doctor Four
Virus Warning
said by Doctor Four  :It appears to be hitting people who visit MSNBC.com: » msmvps.com/blogs/spywaresucks/ar···062.aspxThe fraudware site is xp-vista-update.net, which is in the MVPS hosts file (probably a recent addition as it is near the bottom when I searched for it). I hope you copied that link by hand... you didn't use cut/paste did you?? |
|
mysec
Premium
join:2005-11-29
| reply to Doctor Four
Re: Malvertisement on MSNBC.com using clipboard (copy/paste)
said by Doctor Four :Sandi Hardmeier, in her Spyware Sucks blog, is warning of a new type of malvertisement that overwrites Windows' clipboard,
Has anyone seen the source code that shows how this is done?
|
|
doppler
join:2003-03-31
Blue Point, NY
| reply to Doctor Four
said by Doctor Four :Windows - by default, the home page for IE 7 is MSN. And this is the reason why I hate windows IE (pick any version)
The Default page should be about:blank. If the homepage
is taken over in some way, everybody is in danger. If I
wish to be dangerous. I don't need microsofts help. |
|
avd706
insert annoying animated gif here
Premium
join:2003-02-06
Union, NJ
| said by doppler :said by Doctor Four :Windows - by default, the home page for IE 7 is MSN. And this is the reason why I hate windows IE (pick any version) The Default page should be about:blank. If the homepage is taken over in some way, everybody is in danger. If I wish to be dangerous. I don't need microsofts help. I don't get it. Every browser has a home page. All you have to do is shut off your internet and you can change a bad home page without opening it. (You might have to clear your cache first though.) |
|
doppler
join:2003-03-31
Blue Point, NY
| said by avd706 :said by doppler :said by Doctor Four :Windows - by default, the home page for IE 7 is MSN. And this is the reason why I hate windows IE (pick any version) The Default page should be about:blank. If the homepage is taken over in some way, everybody is in danger. If I wish to be dangerous. I don't need microsofts help. I don't get it. Every browser has a home page. All you have to do is shut off your internet and you can change a bad home page without opening it. (You might have to clear your cache first though.) What you don't realize is every new computer rolling off
the countless assembly lines. Has MSN website as the
default. Only .01% of users of computers these days
know enough about using them. Let alone using them
correctly. If it wasn't for the other 99.99% I would
not be in the nice side business of fixing microsofts
dumb marketing decisions.
Yes, the homepage default of MSN.COM is a marketing driven
decision. What better way to get eyes on your website
than to make the default page be yours.
Look at how many people ask for help. In fixing there hijacked
browsers. HIJACKTHIS, would not exsist if the browser
default was hard to change, from your preferred setting. |
|
therube
join:2004-11-11
Randallstown, MD
1 edit | reply to mysec
quote:
This should be blocked by setting Internet Options, Security, Internet Zone, Scripting, "Allow programmatic Clipboard access" to Disable.
I would be curious if this setting failed to block this vector.
»msmvps.com/blogs/spywaresucks/ar···062.aspx
So it appears this would be a vector in IE that is being exploited? In my case (& I don't use IE) Clipboard access is set to "prompt". (Wonder what a prompt looks like or how I would respond to it if I were prompted?)
And then this, Rogue ads pushing malware -- how it works, describes simply Refreshing the MLB web page & the popups start appearing? Which kind of doesn't make sense?
So combine the two & perhaps Flash related? JavaScript related? JS being allowed to run in Flash?
And there must be some code somewhere on an infected web site that allows the clipboard overwrite to take place. Again perhaps via Flash & JavaScript?
(How can anyone say that using a Mozilla browser & NoScript does not have the potential to help is browsing safely.)
EDIT:
So perhaps MLB was injected with code, using a META tag to force malware page to open. Something like this:
|
|
therube
join:2004-11-11
Randallstown, MD
2 edits | And it looks like we're coming back to ActiveX too. And IE. IE being a "trusted" application, of course.
Why might one have "Clipboard access" enabled? Well, because MS tells you to do so.
quote:
ActiveX controls are used for certain functionality in Microsoft Office Project Professional 2007 and in Microsoft Office Project Web Access. In order for the ActiveX controls to work properly, the Office Project Web Access Web site must be added to the list of trusted sites in Internet Explorer. There are additional security settings that can be configured, but they are optional.
»technet.microsoft.com/en-us/libr···703.aspx
Perhaps this cannot even be disabled in IE6?
Disable Allow This Webpage to Access Your Clipboard Pop-Up Warning Message in IE7
Picture here of what the prompt would look like, »msdn.microsoft.com/en-us/library···85).aspx
Appears you can disable this in IE6 too, »forums.spybot.info/archive/index···665.html.
That post includes a link to a site that retrieves your clipboard information, »www.sourcecodesworld.com/special···oard.asp. |
|
mysec
Premium
join:2005-11-29
| Thanks for the information. Unfortunately, links from this site explaining the script code for cut, copy, paste, bring up "Content not found"
»msdn.microsoft.com/en-us/library···85).aspx
|
|
Doctor Four
My other vehicle is a TARDIS
Premium
join:2000-09-05
Dallas, TX
·AT&T U-Verse
1 edit | reply to Doctor Four
And it isn't just Windows/IE users that are being hit
by this. Here's a nail in the coffin for those who think
Apple and Firefox are more secure:
»msmvps.com/blogs/spywaresucks/ar···705.aspx
The incident Sandi describes involves a Mac user and the
Firefox browser.
Apparently this copy/paste malware is also hitting Facebook
and Digg users, as posters to Apple Discussions have noted.
I don't know about Facebook, but looking at the source of
Digg's home page indicates something might be in common with
MSN and MSNBC: Microsoft advertising.
--
"The trouble with computers, of course, is that they are very sophisticated idiots." - Doctor Who (from Robot)
|
|
mysec
Premium
join:2005-11-29
4 edits | Thanks for the link.
Meanwhile, a search around the internet reveals that various codes for this "feature" or "exploit" have been around for a long time.
As a "feature" people put code into their web pages with buttons to activate the copy/paste. Or to auto-copy text in a form.
As an "exploit" where you force something to be copied to the clipboard, here is one I found for IE5/6:
I tried it even with that feature disabled in Options as mentioned by therube or even if Scripting is disabled, but it works anyway. I might not be doing something right in Options -- I don't know IE that well.
As far as exploiting other browsers -- unfortunately no one in the Mac forum kept the URL for the offending page, and theories ranged from Java and Flash to Ajax as being able to write continuously to the clipboard, forcing the user to reboot to clear the clipboard.
By the way - what do you suppose was copied to the clipboard of the Mac user mentioned on the Apple forum? If you guessed the WinAntiVirus2009 freescan site URL, you win a prize!
EDIT:
Here is a site which tests IE for capturing your last clipboard entry. The code is different, and the paste fails if I have scripting disabled, or "Allow paste operations via script" disabled.
»www.sourcecodesworld.com/special···oard.asp
|
|
jeno
@bellsouth.net | Try disabling the "Clipbook" service and see if it works... |
|
swhx7
Premium
join:2006-07-23
Elbonia
·RoadRunner Cable
2 edits | reply to Doctor Four
At first I was sure this couldn't be done Javascript alone in Mozilla browsers. On following some links, I found one poster saying he did it with 20 lines of Javascript but only if a default was changed in about:config.
The only source for a claim that it happened on Firefox is this post ( »discussions.apple.com/thread.jsp···=7768848 ) on a Mac forum. As other posters suggested there, it probably relied on a plugin such as Java or Flash. Only Microsoft counts it as a positive "feature" that web pages can overwrite the clipboard. At least IE now has a more nearly explanatory label on the means to turn it off (it used to be "Allow paste operations via script").
Is it on by default in IE7 or 8? |
|
Doctor Four
My other vehicle is a TARDIS
Premium
join:2000-09-05
Dallas, TX
·AT&T U-Verse
| reply to Doctor Four
More on this from Sandi:
»msmvps.com/blogs/spywaresucks/ar···914.aspx
Also, according some comments on The Register, this is
happening on Monster, as well as Digg and Facebook, which
were previously mentioned. And one reader got hit while
browsing Ars Technica.
Taking a look at several pages' source code, I believe I
might have found the vector for the clipboard hijack:
edge.quantserve.com. In each case, it is pulling a bit of
javascript. It might be time to temporarily disable the
hosts file, run Fiddler (an HTTP debugging utility) and
see if this can be confirmed.
--
"The trouble with computers, of course, is that they are very sophisticated idiots." - Doctor Who (from Robot)
|
|
Doctor Four
My other vehicle is a TARDIS
Premium
join:2000-09-05
Dallas, TX
·AT&T U-Verse
1 edit | reply to Doctor Four
This is getting to be a hot topic, as Sandi notes. Also,
Firefox and NoScript do not block the clipboard
hijack. So far, the only ways to prevent it are either to
block flash, or close the browser when it occurs.
»msmvps.com/blogs/spywaresucks/ar···130.aspx
Seems having a hosts file does work, though. I have tried
several of the sites in question, and not once have I seen
this occur.
I did try Newsweek's site, and quantserve/quantcast showed
up again in the page's source. I didn't see it on either
MSN or MSNBC's home page, though.
Edit: I tested FF and NoScript on the proof-of-concept
site Sandi mentioned. It doesn't work unless you allow
the site in NoScript. Seems that would still be effective
at preventing the hijack as it is coming from a third party
(and one which is likely to be marked as untrusted).
--
"The trouble with computers, of course, is that they are very sophisticated idiots." - Doctor Who (from Robot)
|
|
SUMware
Premium
join:2002-05-21
1 edit | reply to Doctor Four
Try setting Firefox's clipboard.autocopy to 'false' in about:config.
Also, check setting noscript.allowClipboard to see if it is set to 'false'.
NoScript Options > Advanced > Trusted tab - uncheck the 'Allow rich text copy and paste from external clipboard' preference. |
|
