27

I've come across the following website

hxxp://politie.nl.id169787298-7128265115.e2418.com/ [Possible malware]

Whenever I open it in Firefox it prevents me from closing it, I can't even close the browser without using the task manager. The site asks for money for an unlock and I can imagine some people could fall for it. How can this happen? I thought Firefox was a more or less secure browser?

I haven't checked it on other browsers.

Improve this question
10
  • 3
    I reported the site to Mozilla(and google)
    – blade19899
    Dec 1, 2013 at 0:22
  • 1
    for VirusTotal report see: virustotal.com/nl/url/…
    – blade19899
    Dec 1, 2013 at 0:24
  • 1
    I've also reported the domain name to the appropriate parties.
    – Nathan Osman
    Dec 1, 2013 at 0:40
  • Press leave 400 times, you will be ok ;)
    – Braiam
    Dec 1, 2013 at 0:47
  • The domain is down now, apparently.
    – Braiam
    Dec 1, 2013 at 5:12

2 Answers 2

Reset to default
25

Update: this is no longer a concern on Firefox (29+) and Chrome (version? not sure if it was ever an issue there). Firefox will only display a single dialog now.

Firefox 31 additionally makes the dialog non-modal, and will also close the window if you press the close button a second time.

Unfortunately, IE11 still shows multiple dialogs. I'm not sure if Microsoft is aware of this issue.

The method is pretty simple, actually. If you inspect the source, you'll see a lot of repetition of this line:

<iframe test="test" srcdoc="<script> window.onbeforeunload=function(env){ return 'YОUR BRОWSЕR HAS BЕЕN LОCKЕD. АLL PC DАTА WILL BЕ DЕTАINЕD АND CRIMINАL PRОCЕDURЕS WILL BЕ INITIАTЕD АGАINST YОU IF THЕ FINЕ WILL NОT BЕ PАID.';} </script>" src="au/close.php"></iframe>

Basically, they have a whole bunch of iframes and each iframe can trigger the 'are you sure you want to leave' message once. It's not infinite by any means (as Braiam said, you can just hold down enter on the leave page), but it's probably enough to trick some people.

This is arguably behaving as intended - though it may be better to add one of those "don't show again" checkboxes, much like they do for alert popups.

Another way to prevent this kind of thing is to disable JavaScript on sites you don't trust. NoScript works well. This can, however, be somewhat annoying and/or break sites at times.

For the interested: Chrome actually displays one long dialog. That comes with its own problems - and this is a browser bug - the buttons get pushed out of the bottom of the page (happens with any too-long Chrome popup). You can still hit enter. The Chrome dialog seems to be initiated by a different alert popup, and it actually doesn't seem to display the iframe unload text at all - it's likely they added this specifically to trap Chrome users:

<script type="text/javascript">window.onbeforeunload = function(env){var str = '\n\nUw br' + 'оws' + 'еr is gе' + 'blо' + 'kkе' + 'еrd.\n\nAl' + 'le P' + 'C dа' + 'tа zu' + 'lle' + 'n wо' + 'rde' + 'n vа' + 'stgе' + 'hou' + 'den e' + 'n st' + 'rаf' + 'rес' + 'htе' + 'li' + 'jk' + 'е pr' + 'ocе' + 'dur' + 'es zu' + 'lle' + 'n wо' + 'rd' + 'en ing' + 'еlе' + 'id te' + 'ge' + 'n u al' + 's d' + 'e bo' + 'еt' + 'е ni' + 'et wo' + 'rd' + 't be' + 'taa' + 'ld.\n\n';
        alert(str);
    return str;
}
</script>

Again, it's nothing more than a scary popup that seems to be impossible to get rid of. Malicious? Yes. Actually dangerous? Not really. As long as you don't fall for the scam.

Also of potential interest is that they do display your public IP and approximate location. This is a fairly standard scare tactic on these scam sites and really isn't anything special - any site you connect to can get your public IP, and public GeoIP databases can usually provide the approximate location. If you're really worried, go get a VPN or anonymous proxy to connect through.

Improve this answer
5
  • If Chrome doesn't actually display those iframe unloads, then it would be immune to that particular attack (though there are possible legitimate uses as well, in which case this is a disadvantage). I can't verify that, because the bottom of the popup is off the screen. It seems they may have added an alternative method to trap Chrome users anyway.
    – Bob
    Dec 1, 2013 at 1:19
  • I have worked with the Mozilla Security. Firefox has fixed vulnerabilities like this before. I am reporting this issue and it will be fixed, I am 100% on that.
    – rook
    Dec 1, 2013 at 17:52
  • @Rook: Please provide the bugzilla link if public.
    – Jan Schejbal
    Dec 13, 2013 at 13:54
  • 1
    @Jan Schejbal It is must worse than I expected: bugzilla.mozilla.org/show_bug.cgi?id=636374 . This bug maybe exploitable for a few more years :*(. Looks like I'll be using Chromium more often.
    – rook
    Dec 13, 2013 at 15:52
  • @Rook That bug was verified fixed as of FF29, and FF31 now makes those dialogs non-modal.
    – Bob
    Jul 25, 2014 at 2:09
0

You can go with loop of alert as well create function call on body I have added many event on body.

Here you can find a working example of this.

<script>
  var errormessage_text = "***System Alert***";
  var redirect_url = window.location;
</script></code>
<body onload="myFunction();" onmouseover="myFunction();" onclick="myFunction();" onkeydown="myFunction();" onunload="myFunction();">
<script>
    window.onbeforeunload=function(){
    window.location.href=redirect_url,'_blank';
    return errormessage_text;
  };
 for(i=0;i<99;i++){alert(errormessage_text);}<//script>
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .