1

Today I typed in a URL of a site I know. Unfortunately I missed one letter of the TLD. I typed .co instead of .com.

No problem, I'll quickly retype the URL. Unfortunately, this was not possible. The URL bar kept being reset because the page forwarded me over and over again. Ultimately I just closed the tab, because it was clearly not a benevolent website.

An hour later, I noticed I was logged out of Messenger. I didn't think anything of it at first, but shortly after I noticed I was also logged out of Google, YouTube, Stack Overflow, .... all my accounts. I started getting suspicious at this point. A quick check in the settings showed that all my cookies were still there. I cleared them just in case this last website injected something maliciously.

Now I wonder...

  1. Is this a pure coincidence, or might this strange website have got something to do with me being logged out of everything?
  2. Is this even possible? I'd think a website should not be able to access this kind of stuff.
  3. Is there still a risk of my browser being infected after me clearing my cookies?
  4. If applicable: what's the purpose of this "trick"? Letting me log in again, so a keylogger can catch my password? Something else?

FWIW: I use Firefox 110.0 on Arch Linux.

7
  • It's 99.999% unlikely you've been hacked, so I'd say it's just a coincidence or a Firefox bug. Firefox 110 was released just yesterday, so it must be pretty safe. To feel safer from now on, install uBlock Origin and NoScript. The latter needs some learning but it will make browsing safer and faster. Commented Feb 16, 2023 at 21:56
  • Good tips. Thanks @ArtemS.Tashkinov! Would you suggest replacing Ghostery with uBlock? Or run them next to each other?
    – Opifex
    Commented Feb 16, 2023 at 22:19
  • They can run next to each other AFAIK. Commented Feb 17, 2023 at 8:34
  • The real worry isn't that a website would inject something into a cookie (because it doesn't usually create a new attack), but that they try to steal (really, copy) a cookie, because it would have a login token. That's not generally possible, though - browsers only allow the domain that sets a cookie to retrieve it, unless the server passes certain flags about a particular cookie. Note that cookies are sent to the server, so it would already be "too late" after you actually reached the page, if the cookie was actually stolen. Commented Feb 18, 2023 at 5:30
  • @Clockwork-Muse do you think that's a possible scenario that it happened? I also wonder why all password cookies got deleted then, if it only wanted to retrieve it? I mean... if they wanted to do something malicious, it would be best not to set of any alarmbells, right?
    – Opifex
    Commented Feb 18, 2023 at 13:49

0

You must log in to answer this question.

Browse other questions tagged .