Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've come across the following website

hxxp://politie.nl.id169787298-7128265115.e2418.com/ [Possible malware]

Whenever I open it in Firefox it prevents me from closing it, I can't even close the browser without using the task manager. The site asks for money for an unlock and I can imagine some people could fall for it. How can this happen? I thought Firefox was a more or less secure browser?

I haven't checked it on other browsers.

share|improve this question
    
I reported the site to Mozilla(and google) –  blade19899 Dec 1 '13 at 0:22
    
for VirusTotal report see: virustotal.com/nl/url/… –  blade19899 Dec 1 '13 at 0:24
    
I've also reported the domain name to the appropriate parties. –  Nathan Osman Dec 1 '13 at 0:40
    
Press leave 400 times, you will be ok ;) –  Braiam Dec 1 '13 at 0:47
    
The domain is down now, apparently. –  Braiam Dec 1 '13 at 5:12
show 5 more comments

1 Answer

up vote 17 down vote accepted

The method is pretty simple, actually. If you inspect the source, you'll see a lot of repetition of this line:

<iframe test="test" srcdoc="<script> window.onbeforeunload=function(env){ return 'YОUR BRОWSЕR HAS BЕЕN LОCKЕD. АLL PC DАTА WILL BЕ DЕTАINЕD АND CRIMINАL PRОCЕDURЕS WILL BЕ INITIАTЕD АGАINST YОU IF THЕ FINЕ WILL NОT BЕ PАID.';} </script>" src="au/close.php"></iframe>

Basically, they have a whole bunch of iframes and each iframe can trigger the 'are you sure you want to leave' message once. It's not infinite by any means (as Braiam said, you can just hold down enter on the leave page), but it's probably enough to trick some people.

It's not really a browser bug, per se - though it may be better to add one of those "don't show again" checkboxes, much like they do for alert popups.

Another way to prevent this kind of thing is to disable JavaScript on sites you don't trust. NoScript works well. This can, however, be somewhat annoying and/or break sites at times.


For the interested: Chrome actually displays one long dialog. That comes with its own problems - and this is a browser bug - the buttons get pushed out of the bottom of the page (happens with any too-long Chrome popup). You can still hit enter. The Chrome dialog seems to be initiated by a different alert popup, and it actually doesn't seem to display the iframe unload text at all - it's likely they added this specifically to trap Chrome users:

<script type="text/javascript">window.onbeforeunload = function(env){var str = '\n\nUw br' + 'оws' + 'еr is gе' + 'blо' + 'kkе' + 'еrd.\n\nAl' + 'le P' + 'C dа' + 'tа zu' + 'lle' + 'n wо' + 'rde' + 'n vа' + 'stgе' + 'hou' + 'den e' + 'n st' + 'rаf' + 'rес' + 'htе' + 'li' + 'jk' + 'е pr' + 'ocе' + 'dur' + 'es zu' + 'lle' + 'n wо' + 'rd' + 'en ing' + 'еlе' + 'id te' + 'ge' + 'n u al' + 's d' + 'e bo' + 'еt' + 'е ni' + 'et wo' + 'rd' + 't be' + 'taa' + 'ld.\n\n';
        alert(str);
    return str;
}
</script>

Again, it's nothing more than a scary popup that seems to be impossible to get rid of. Malicious? Yes. Actually dangerous? Not really. As long as you don't fall for the scam.


Also of potential interest is that they do display your public IP and approximate location. This is a fairly standard scare tactic on these scam sites and really isn't anything special - any site you connect to can get your public IP, and public GeoIP databases can usually provide the approximate location. If you're really worried, go get a VPN or anonymous proxy to connect through.

share|improve this answer
    
If Chrome doesn't actually display those iframe unloads, then it would be immune to that particular attack (though there are possible legitimate uses as well, in which case this is a disadvantage). I can't verify that, because the bottom of the popup is off the screen. It seems they may have added an alternative method to trap Chrome users anyway. –  Bob Dec 1 '13 at 1:19
    
I have worked with the Mozilla Security. Firefox has fixed vulnerabilities like this before. I am reporting this issue and it will be fixed, I am 100% on that. –  Rook Dec 1 '13 at 17:52
    
@Rook: Please provide the bugzilla link if public. –  Jan Schejbal Dec 13 '13 at 13:54
1  
@Jan Schejbal It is must worse than I expected: bugzilla.mozilla.org/show_bug.cgi?id=636374 . This bug maybe exploitable for a few more years :*(. Looks like I'll be using Chromium more often. –  Rook Dec 13 '13 at 15:52
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.