2

I recently had a huge increase in visits of a website I manage. On deeper check I discovered I had a new referral. When I opened the website I was quite surprised.

It's not a just a referral, basically someon bought a domain and is opening my website from inside a full page frame like this:

frame name="main" noresize framespacing="0" frameborder="no" border="0" 
src="http://zzovq.voluumtrk.com/*****-*****-****-85c7-890*****?idade=35+"

Where * stands for numbers.

Through the url in src they get my website. Proxyed, apparently.

Besides the iframe they track visits on their page via Google analytics.

My question is: is this a new angle of attack? What are they trying?

I can think of a few possible attacks. They could be proxying the website and changing content (I didn't discover any evidence). Doing some JS injection (apparently not). In principle XSS is not possible like this. What's the point of this?

1

Note: My answer is on the basis that zzovq.voluumtrk.com is not your own domain, as you mention content is being proxied.

This is not clickjacking because the site is proxying your site via their own domain (zzovq.voluumtrk.com). Therefore normal defences such as including the X-Frame-Options header may not work as they could be stripping such a header via their proxy. It depends on how sophisticated they are and how willing they are to circumvent any defences you put up.

I would say this is more of a phishing style attack where the malicious website is trying to capture credentials or other sensitive information sent to or from your website.

Another possibility that this is some type of plagiarism where the site is trying to get paid for adverts for showing your content, or allowing use of your site's functionality via their proxy.

You should analyze any server logs you have and look for patterns. Is the content from this domain always from the same IP of their proxy server? If so you could block that IP as a temporary solution to see if this affects their service. Other than that there is little you can do other than reporting this to their ISP or taking some type of legal action.

  • It is clickjacking in case the domain in source was his. That's an assumption I made which apparently is wrong. Thanks. – Michael May 31 '15 at 17:05
1

Note: I assumed the domain in src referred directly to your website.

Possibly clickjacking

Clickjacking, also known as a "UI redress attack", is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they were intending to click on the the top level page.

An example:

For example, imagine an attacker who builds a web site that has a button on it that says "click here for a free iPod". However, on top of that web page, the attacker has loaded an iframe with your mail account, and lined up exactly the "delete all messages" button directly on top of the "free iPod" button. The victim tries to click on the "free iPod" button but instead actually clicked on the invisible "delete all messages" button. In essence, the attacker has "hijacked" the user's click, hence the name "Clickjacking".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.