4

Can somebody explain if there's something malicious in this HTML, The width and height of the iframe ares set to 1 and it's out of the view with top: -100px; statement. I believe it takes some some sort of permission from Google account authentication without the consent of the user?

<iframe name="oauth2relay255885454" idstrong text="oauth2relay255885454" 
        src="https://accounts.google.com/o/oauth2/postmessageRelay?parent=http%3A%2F%2Fjankestauorg.blogspot.com#rpctoken=831371525&amp;forcesecure=1" 
        tabindex="-1" style="width: 1px; height: 1px; position: absolute; top: -100px;">

       <!DOCTYPE html>
         <html>
            <head><title></title>
            <meta http-equiv="content-type" content="text/html; charset=utf-8">
            <meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1, minimum-scale=1, maximum-scale=1, user-scalable=0">
            <script type="text/javascript" src="https://apis.google.com/js/api.js" gapi_processed="true"></script>
            <script type="text/javascript" src="https://oauth.googleusercontent.com/gadgets/js/core:rpc:shindig.random:shindig.sha1.js?c=2"></script>
            <script src="https://ssl.gstatic.com/accounts/o/3584451713-postmessagerelay.js"></script>
           </head><body></body>
        </html>
</iframe>
5
  • 1
    Where did you find this code? And what do you think is dangerous? All the code I see is hosted by Google. Nov 12, 2015 at 9:16
  • Looks like it was taken from jankestauorg.blogspot.com judging by the iframe src value. Nov 12, 2015 at 9:18
  • Yes that is correct @BenPoulson
    – Umar Iqbal
    Nov 12, 2015 at 9:58
  • @NeilSmithline I believe it makes user like content on google plus without the consent.
    – Umar Iqbal
    Nov 12, 2015 at 10:00
  • Looks like the usual google spyware. Nov 12, 2015 at 11:27

1 Answer 1

5

It's from including a Google+ button. You're sort of right though - it's Google seeing if you have a Google+ account in order to let you share the page on Google+, or potentially show a different button if you've already shared it.

However, only Google gets to see the data.

The entire frame is generated by Google, including the positioning. It is placed off-screen in order to avoid messing up layout of the page.

5
  • Can you elaborate a bit more? or if you can tell how should I track the behavior? btw I found it on this link
    – Umar Iqbal
    Nov 12, 2015 at 10:39
  • Not really sure what you mean - it's standard code for a Google+ button. When you put the code <script src="https://apis.google.com/js/platform.js" async defer></script> <g:plusone></g:plusone> (from developers.google.com/+/web/+1button/?hl=en) on a page, it generates the iframe for supported browsers. There isn't any obviously malicious behaviour here.
    – Matthew
    Nov 12, 2015 at 10:47
  • I get that but I don't understand the reason for hiding it? If you see style="width: 1px; height: 1px; position: absolute; top: -100px; He's clearly trying to hide this iframe.
    – Umar Iqbal
    Nov 12, 2015 at 10:51
  • @UmarIqbal This is probably not created by the site's owner but by Google's script. Due to the same origin policy, the google+ script cannot send data to google.com from a non-google domain; however, it can programmatically create an iframe which can communicate with google and JS running on the parent frame (e.g. with the postMessage API), hence the "postmessageRelay" in the url.
    – billc.cn
    Nov 12, 2015 at 13:58
  • Is It possible to remove this iframe from loading ?
    – hayonj
    Nov 24, 2016 at 20:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .