1

Today I typed in a URL of a site I know. Unfortunately I missed one letter of the TLD. I typed .co instead of .com.

No problem, I'll quickly retype the URL. Unfortunately, this was not possible. The URL bar kept being reset because the page forwarded me over and over again. Ultimately I just closed the tab, because it was clearly not a benevolent website.

An hour later, I noticed I was logged out of Messenger. I didn't think anything of it at first, but shortly after I noticed I was also logged out of Google, YouTube, Stack Overflow, .... all my accounts. I started getting suspicious at this point. A quick check in the settings showed that all my cookies were still there. I cleared them just in case this last website injected something maliciously.

Now I wonder...

  1. Is this a pure coincidence, or might this strange website have got something to do with me being logged out of everything?
  2. Is this even possible? I'd think a website should not be able to access this kind of stuff.
  3. Is there still a risk of my browser being infected after me clearing my cookies?
  4. If applicable: what's the purpose of this "trick"? Letting me log in again, so a keylogger can catch my password? Something else?

FWIW: I use Firefox 110.0 on Arch Linux.

Improve this question
7
  • It's 99.999% unlikely you've been hacked, so I'd say it's just a coincidence or a Firefox bug. Firefox 110 was released just yesterday, so it must be pretty safe. To feel safer from now on, install uBlock Origin and NoScript. The latter needs some learning but it will make browsing safer and faster.
    – Artem S. Tashkinov
    Feb 16 at 21:56
  • Good tips. Thanks @ArtemS.Tashkinov! Would you suggest replacing Ghostery with uBlock? Or run them next to each other?
    – Opifex
    Feb 16 at 22:19
  • They can run next to each other AFAIK.
    – Artem S. Tashkinov
    Feb 17 at 8:34
  • The real worry isn't that a website would inject something into a cookie (because it doesn't usually create a new attack), but that they try to steal (really, copy) a cookie, because it would have a login token. That's not generally possible, though - browsers only allow the domain that sets a cookie to retrieve it, unless the server passes certain flags about a particular cookie. Note that cookies are sent to the server, so it would already be "too late" after you actually reached the page, if the cookie was actually stolen.
    – Clockwork-Muse
    Feb 18 at 5:30
  • @Clockwork-Muse do you think that's a possible scenario that it happened? I also wonder why all password cookies got deleted then, if it only wanted to retrieve it? I mean... if they wanted to do something malicious, it would be best not to set of any alarmbells, right?
    – Opifex
    Feb 18 at 13:49

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .