Can somebody explain if there's something malicious in this HTML, The width and height of the iframe ares set to 1 and it's out of the view with top: -100px; statement. I believe it takes some some sort of permission from Google account authentication without the consent of the user?

<iframe name="oauth2relay255885454" idstrong text="oauth2relay255885454" 
        tabindex="-1" style="width: 1px; height: 1px; position: absolute; top: -100px;">

       <!DOCTYPE html>
            <meta http-equiv="content-type" content="text/html; charset=utf-8">
            <meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1, minimum-scale=1, maximum-scale=1, user-scalable=0">
            <script type="text/javascript" src="https://apis.google.com/js/api.js" gapi_processed="true"></script>
            <script type="text/javascript" src="https://oauth.googleusercontent.com/gadgets/js/core:rpc:shindig.random:shindig.sha1.js?c=2"></script>
            <script src="https://ssl.gstatic.com/accounts/o/3584451713-postmessagerelay.js"></script>
  • 1
    Where did you find this code? And what do you think is dangerous? All the code I see is hosted by Google. Nov 12 '15 at 9:16
  • Looks like it was taken from jankestauorg.blogspot.com judging by the iframe src value. Nov 12 '15 at 9:18
  • Yes that is correct @BenPoulson
    – Umar Iqbal
    Nov 12 '15 at 9:58
  • @NeilSmithline I believe it makes user like content on google plus without the consent.
    – Umar Iqbal
    Nov 12 '15 at 10:00
  • Looks like the usual google spyware. Nov 12 '15 at 11:27

It's from including a Google+ button. You're sort of right though - it's Google seeing if you have a Google+ account in order to let you share the page on Google+, or potentially show a different button if you've already shared it.

However, only Google gets to see the data.

The entire frame is generated by Google, including the positioning. It is placed off-screen in order to avoid messing up layout of the page.

  • Can you elaborate a bit more? or if you can tell how should I track the behavior? btw I found it on this link
    – Umar Iqbal
    Nov 12 '15 at 10:39
  • Not really sure what you mean - it's standard code for a Google+ button. When you put the code <script src="https://apis.google.com/js/platform.js" async defer></script> <g:plusone></g:plusone> (from developers.google.com/+/web/+1button/?hl=en) on a page, it generates the iframe for supported browsers. There isn't any obviously malicious behaviour here.
    – Matthew
    Nov 12 '15 at 10:47
  • I get that but I don't understand the reason for hiding it? If you see style="width: 1px; height: 1px; position: absolute; top: -100px; He's clearly trying to hide this iframe.
    – Umar Iqbal
    Nov 12 '15 at 10:51
  • @UmarIqbal This is probably not created by the site's owner but by Google's script. Due to the same origin policy, the google+ script cannot send data to google.com from a non-google domain; however, it can programmatically create an iframe which can communicate with google and JS running on the parent frame (e.g. with the postMessage API), hence the "postmessageRelay" in the url.
    – billc.cn
    Nov 12 '15 at 13:58
  • Is It possible to remove this iframe from loading ?
    – hayonj
    Nov 24 '16 at 20:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.