Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Code: http://pastebin.com/kJ8ZGP82

That code gets retrived from http://ui.sidepage.co for every HTTP page I visit (not HTTPS) and load it into the body tag of the page.

Is it harmful in any way? Please review.

Which part declares it's harmful nature?

One more thing...every HTTP request(not HTTPS requests) i make via browser goes though the following link... http: //intad.pag2p.co/dva1/int.php?s=1&c=5&u=http%3A%2F%2Fwww.google.co.in%2F

In above, i was trying to visit http: //google.com

Don't know why all this happening.

var blacklistCheck;
(function () {
    function r(e, t) {
        for (var n in t) t.hasOwnProperty(n) && (e[n] = t[n])
    }
    function i(e, t, n, r) {
        if (e.addEventListener) return e.addEventListener(t, n, r), !0;
        if (e.attachEvent) {
            var i = e.attachEvent("on" + t, n);
            return i
        }
    }
    function s(t) {
        function r(e) {
            return Math.pow(e, .6)
        }
        var n = new Date,
            i = this,
            s = e.transitionSpeed,
            o = setInterval(function () {
                var e = new Date - n,
                    u = e / s;
                u > 1 && (u = 1), t.call(i, r(u)), u === 1 && clearInterval(o)
            }, 10)
    }
    var e = {
        baseDir: "http://ui.sidepage.co",
        version: "4",
        element: "S1D3P4G3",
        loadDelay: 3e3,
        displayDelay: 1e4,
        transitionSpeed: 300
    };
    e.location = e.baseDir + "/" + e.version + "/";
    var t = {
        hasInner: typeof window.innerWidth == "number",
        hasElement: document.documentElement !== null && document.documentElement.clientWidth,
        windowWidth: function () {
            return this.hasElement ? document.documentElement.clientWidth : document.body.clientWidth
        },
        computeShifts: function () {
            this.shiftX = this.hasInner ? pageXOffset : this.hasElement ? document.documentElement.scrollLeft : document.body.scrollLeft, this.centerX === !0 ? this.shiftX += this.windowWidth() / 2 : this.targetLeft > 0 ? this.shiftX += this.targetLeft : this.shiftX += (this.hasElement ? document.documentElement.clientWidth : this.hasInner ? window.innerWidth - 20 : document.body.clientWidth) - this.targetRight - this.node.offsetWidth, this.shiftY = this.hasInner ? pageYOffset : this.hasElement ? document.documentElement.scrollTop : document.body.scrollTop, this.targetTop > 0 ? this.shiftY += this.targetTop : this.shiftY += (this.hasElement ? document.documentElement.clientHeight : this.hasInner ? window.innerHeight - 20 : document.body.clientHeight) - this.targetBottom - this.node.offsetHeight
        },
        moveElem: function () {
            this.computeShifts();
            if (this.currentX !== this.shiftX || this.currentY !== this.shiftY) this.currentX = this.shiftX, this.currentY = this.shiftY, document.layers ? (this.node.left = this.currentX, this.node.top = this.currentY) : (this.node.style.left = this.currentX + "px", this.node.style.top = this.currentY + "px");
            this.node.style.right = "", this.node.style.bottom = ""
        },
        floatElem: function () {
            this.moveElem();
            var e = this;
            setTimeout(function () {
                e.floatElem()
            }, 50)
        },
        supportsFixed: function () {
            var e = document.createElement("div");
            e.id = "testingPositionFixed", r(e.style, {
                position: "fixed",
                top: "0px",
                right: "0px"
            }), document.body.appendChild(e);
            var t = 1;
            return typeof e.offsetTop == "number" && e.offsetTop !== null && e.offsetTop !== "undefined" && (t = parseInt(e.offsetTop, 10)), t === 0 ? !0 : !1
        },
        init: function (e, t) {
            this.centerX = t, this.node = e, this.currentX = this.shiftX = this.hasInner ? pageXOffset : this.hasElement ? document.documentElement.scrollLeft : document.body.scrollLeft, this.currentY = this.shiftY = this.hasInner ? pageYOffset : this.hasElement ? document.documentElement.scrollTop : document.body.scrollTop;
            if (this.supportsFixed()) this.node.style.position = "fixed";
            else {
                var n = this.node.style;
                r(this, {
                    targetLeft: parseInt(n.left, 10),
                    targetTop: parseInt(n.top, 10),
                    targetRight: parseInt(n.right, 10),
                    targetBottom: parseInt(n.bottom, 10)
                });
                var s = this;
                i(window, "scroll", function () {
                    s.moveElem()
                }, !1), this.floatElem()
            }
        }
    }, n = {
        init: function () {
            this.closeClicked = !1, this.transitionStatus = !1, this.buildElements(), this.buildLayout(), this.styleElements(), t.init(this.sp, this.centerX), this.registerMouseEvents(), this.finalize();
            var n = this;
            this.transitionTimeoutId = setTimeout(function () {
                n.initialTransition()
            }, e.loadDelay)
        },
        buildElements: function () {
            this.sp = document.getElementById(e.element), this.sp.style.cssText = "z-index: 2147483647; overflow: hidden; position: absolute; display: none;", this.side = document.createElement("div"), this.side.id = "sp_side", this.side.style.cssText = "position: relative; width: 20px; float: left;", this.open = document.createElement("a"), this.open.id = "sp_open", this.open.style.cssText = "background: url('" + e.location + "sp_sprite.jpg') no-repeat; display: block; opacity: 0.5;", this.close = document.createElement("a"), this.close.id = "sp_close", this.close.style.cssText = "background: url('" + e.location + "sp_sprite.jpg') no-repeat; display: block; opacity: 0.5;", this.bottomHover = document.createElement("div"), this.bottomHover.id = "sp_bottom_hover", this.container = document.createElement("div"), this.container.id = "sp_container", this.container.style.cssText = "position: relative; float: left;", this.iframe = document.createElement("iframe"), this.iframe.style.cssText = "position: relative; border: 0px;", r(this.iframe, {
                id: "sp_frame",
                frameborder: 0,
                marginWidth: 0,
                marginHeight: 0,
                scrolling: "no",
                allowTransparency: "true"
            })
        },
        registerMouseEvents: function () {
            function t() {
                this.style.opacity = 1
            }
            function n() {
                this.style.opacity = .5
            }
            var e = this;
            this.open.onmouseover = t, this.open.onmouseout = n, this.open.onclick = function () {
                return clearTimeout(e.transitionTimeoutId), e.transitionIn(), !1
            }, this.close.onmouseover = t, this.close.onmouseout = n, this.close.onclick = function () {
                return e.closeClicked = !0, clearTimeout(e.transitionTimeoutId), e.transitionOut(), !1
            }, this.iframe.onmouseover = function () {
                !e.transitionStatus && !e.closeClicked && e.initialTransition()
            }
        },
        finalize: function () {
            this.sp.style.display = "", t.supportsFixed() === !0 ? this.hasFixedSupport = !0 : this.hasFixedSupport = !1
        },
        initialTransition: function () {
            if (!this.closeClicked) {
                this.transitionStatus = !0, this.transitionIn();
                var t = this;
                this.transitionTimeoutId = setTimeout(function () {
                    t.transitionOut(), t.transitionStatus = !1
                }, e.displayDelay)
            }
        }
    };
    i(window, "load", function () {
        if (window.top === window.self) {
            n.centerX = !0, n.styleElements = function () {
                r(this.sp.style, {
                    left: "50%",
                    bottom: "-90px",
                    height: "90px",
                    marginLeft: "-374px",
                    marginRight: "-374px",
                    width: "748px"
                }), r(this.close.style, {
                    backgroundPosition: "-20px -40px",
                    height: "20px",
                    opacity: "0",
                    overflow: "hidden",
                    marginTop: "0px",
                    width: "20px"
                }), r(this.container.style, {
                    height: "90px",
                    width: "728px"
                }), r(this.iframe.style, {
                    height: "90px",
                    width: "728px"
                }), this.iframe.src = e.location + "page_old.html?t=" + this.sp.className, this.side.style.height = "90px"
            }, n.buildLayout = function () {
                this.sp.appendChild(this.container), this.sp.appendChild(this.side), this.side.appendChild(this.close), this.container.appendChild(this.iframe)
            }, n.transitionIn = function () {
                this.close.style.opacity = 1, this.iframe.style.opacity = 1, this.sp.style.bottom = 0
            }, n.transitionOut = function () {
                this.close.style.opacity = 0, this.iframe.style.opacity = 0, this.sp.style.bottom = "-85px"
            }, blacklistCheck = function (e) {
                e.value === "NO" && n.init();
                if (e.category) {
                    var t = document.createElement("img");
                    t.src = "http://c7.zedo.com/img/bh.gif?n=1668&g=20&a=" + e.category + "&s=1&t=i&f=1", t.width = "1", t.height = "1", t.border = "0";
                    var r = document.getElementsByTagName("body")[0];
                    r && r.appendChild && r.appendChild(t)
                }
            };
            var i = document.createElement("script");
            i.type = "text/javascript", i.src = "http://bl.sidepage.co/?location=" + encodeURIComponent(window.location) + "&t=" + document.getElementById(e.element).className + "&callback=blacklistCheck", document.body.appendChild(i)
        }
    })
})();
share|improve this question
3  
My biggest concern would be why on earth it is being loaded into every HTTP page... who's injecting this content? –  Polynomial Jan 22 '13 at 9:09
2  
As @Poly says - this code could be changed at will serverside, so its content is almost irrelevant here. What is important is why and how it is getting loaded, and by who. –  Rory Alsop Jan 22 '13 at 9:19
    
@RoryAlsop that's what i don't know exactly. It get's loaded both in firefox & chrome. I use Avast AV, SuperAntiSpyware, MalwareBytesAntiMalware & ran a HijackThis analyser on my system. My HijackThis analysis is here @ hjt.iamnotageek.com/log-1050735.html –  abhisekp Jan 22 '13 at 9:42
    
@Polynomial I've started a discussion about this problem in Google Chrome user group in Google groups but to know help. Here is the discussion page productforums.google.com/d/topic/chrome/B7YYIWAzBcE/discussion –  abhisekp Jan 22 '13 at 9:44
    
Please visit iamsrijit.wordpress.com/2012/09/14/… about a detailed report on this problem. It's a ad-injection campaign served by ISP. See the article for more i –  abhisekp Jan 22 '13 at 14:20
add comment

1 Answer

up vote 8 down vote accepted

The code doesn't look particularly malicious - it's some kind of ad injection / tracking. It almost certainly isn't trying to hit you with browser 0-days or steal your banking credentials. However, the big concern is that it's there in the first place, and that it's subject to change.

There are a few possibilities:

  1. Your box is infected, and code is being injected at the socket level. There was a recent rootkit for Linux that does this quite cleverly, but since you're on Windows I guess it could be any number of different pieces of malware.
  2. You have a dodgy toolbar or browser plugin that's doing this. If you've disabled all of that, this one's ruled out.
  3. Your browser has been modified, either at the original source base or by a 3rd party, to inject this content. I highly doubt this, though there was a case like this with some Redhat package repo that got penetrated.
  4. Your ISP is injecting the traffic.

I'd guess the 4th option is the most likely, if you've ruled out the first two. You should test this on other people's computers that also use the same ISP. If you can correlate the injection, you have evidence. At that point it's up to you as to what you do about it. You could complain to the ISP, but I doubt that would do much. Best option is to vote with your cash - switch ISP and make sure they know why, and be vocal about the issue on social media sites. You may even have legal recourse (depending on local laws and the ISP's contract) but you'd have to ask a lawyer about that.

share|improve this answer
    
Using firefox & it's freshly installed (no addons or toolbar). Checked the adbout:config too. But no mention of that domain. –  abhisekp Jan 22 '13 at 11:57
    
I'd guess that it's the ISP then. –  Polynomial Jan 22 '13 at 12:01
2  
A quick Google search for "ISP sidepage.co" shows that a few people have been complaining about it online. Contact your ISP and ask them if they're injecting it, and if so ask them to opt you out. –  Polynomial Jan 22 '13 at 12:03
1  
Thanks all. It's an ISP ad-injection issue. –  abhisekp Jan 22 '13 at 12:11
1  
It might be worth mentioning that a similar technique was used by the Tunisian government to collect Facebook passwords sent via HTTPS. In my experience, having Javascript injected in your HTTP pages is almost always the work of your ISP. –  Adnan Jan 22 '13 at 14:18
show 5 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.