The Java Popup you Can't Stop

An anonymous reader writes "In his brand new hackademix.net blog, Giorgio Maone, known as the author of the NoScript security extension for Firefox, reveals how popup blockers can be easily circumvented using Java. Worse, popups opened this way are really evil, because they can be sized to cover the whole desktop (the wet dream of any phisher) and cannot be closed by user (the wet dream of any web advertiser). Impressive demos available, all cross-browser and cross-platform, in the best Java tradition: 'Write once, hack anywhere' "

Don't spread this!

For the love of all that is holy, please don't promote this story to the /. frontpage. The less advertisers that are made aware of this the better.

Re:Don't spread this!

NO WAY! Information is meant to be FREEEEEEEEEEEEEEEEEEE! YOU should keep your mouth shut, you fascist pig! I bet you voted for Bush!

Re:Don't spread this!

Information wants to be anthropomorphised and all that, but I'd still prefer this one to stay below the main stream media radar until Sun can get a fix out.

As for voting Bush. Since I'm not a US citizen, that would require use of the password '12345678'.

Re:Don't spread this!

Only promoting it and having it become a threat to them (i.e. lawsuits, users uninstalling Java on their systems, webpage designers moving away from it) will motivate them to fix the problem. If the threat is kept under wraps, they have no real motivation to move on it until phishers are already using it in the wild.

Re:Don't spread this!

I haven't had that in years and don't miss a damn thing.

Maybe you don't do any banking on the internet, then. Here in Australia, at least, it is quite common for banks to use Java in an attempt to make their products cross platforms politely. And I, for one, welc... am perfectly happy with that, since I spent many years (once I had got over some of my luddite tendencies) whining about those who coded only for Winbloze boxes.

I haven't found many other sites that go in for Java in such a big way, but if I came across one that loaded a popup like that, I would simply blacklist it permanently in my hosts file. It simply doesn't pay the advertiser to piss people off that much.

Re:Don't spread this!

True enough, but one should only allow active content such as Java on sites one explicitly trusts (like a bank).
Sadly, most are not as aware and leave their browsers in "whore mode".
-nB

Re:Don't spread this!

You mean their browsers will pretend to open each page the user pays for?

Re:Don't spread this!

True, full disclosure is needed as the ultimate Damocles sword to force companies to fix problems. If Sun acts slowly on this one, I'm all in favour of plastering it all over the front page of the WSJ.

Sun was made aware of this problem 10 days ago, and nothing seems to suggest that they don't take the issue seriously. The time it takes them to write a fix, do regression testing and push a patch out the door will likely not change due to this story reaching the /. frontpage or not. The only thing that will change is the number of people that are made aware of the issue before the fix is available, and in consequence the number of phishers/spammers/etc that have the opportunity to exploit it. That is, increasing the Window of Exposure [schneier.com]

Re:Don't spread this!

hey, we all know any exploit can be fixed in 10 f-ing days!!!

Re:Don't spread this!

To be honest I have no idea why it's not. It's such a blisteringly good idea, it seems ridiculously stupid to not include it in a browser.

I mean, popup blocking is included in the browser, why not NoScript?

It's the user's computer, not the advertiser's; the user should have full control over what goes on.

Re:Don't spread this!

I'd much prefer they filter malicious scripting,

The ghost of the Entscheidungsproblem [wikipedia.org] descends, with malice in its eyes.

*smack* Oof.

You are dealt 2501 hit points of damage.

Hint: there is no way to programatically determine whether a given program is malicious or not, for any sufficiently interesting system.

Re:Don't spread this!

You're setting up a false dichotomy, those are not the only two options available. In order to minimise the Window of Exposure, it is best to have it not blow up in media AND have it fixed as soon as possible.

I'm all for letting security issues blow up in media if the software vendor ignores them, there's nothing like a little public shaming to make public companies get their act together security-wise. But as long as the software vendor fixes reported problems in a timely fashion, the only thing that is achieved by a media blow up before a patch is available is that more potential exploiters are made aware of the issue.

Re:Why I love IE

I had finally gotten tired of cleaning Java-based viruses off my machines

I believe you mean JavaScript viruses (very common) not Java viruses (extremely rare). Javascript viruses tend to be mostly harmless (stuff like, a popup you can't close) and are generally overblown by virus software. That's why your autoprotect software wasn't catching it: It wasn't that important. And erasing the files from your browser's cache after the fact is not really helpful either. You're not really "infected" per se. (Though some of those JS files are vectors into bigger and badder viruses.)

So when I hear stuff like this article, it's another reason I love IE. Dumping Java was the best move MS ever made on the browser.

That has to be the worst reason in existence to use IE. If you don't want Java, don't install it. FireFox won't do it automatically, nor will Opera, nor will Safari. Sticking with IE because it doesn't install a JVM by default is nothing more than a false sense of security.

parent rating: -1 FUD

Re:Why I love IE

Well, there are a couple of things about CWS:

1. It merely used the JVM as a vector to install itself. As a virus, it was actually a Windows program and was reported as such by all virus tools in existence. Thus the original poster would not have known it as a "Java virus".

2. There are actually a wide variety of CWS variants. Some of them used the JVM vulnerability while others used other system vulnerabilities like a hole in the Windows Meta File [securiteam.com].

3. As another poster pointed out, it was a hole in Microsoft's VM that was exploited. Which would seem to be further evidence for moving away from IE.

Who'd have thought it?

There are people who still browse with java switched on?! That is SO 1990's.

Re:Who'd have thought it?

There are people who still browse with java switched on?! That is SO 1990's.

Didn't you read the headline? You can't stop these things. Heck, the demo popped up an unkillable window on my AmigaOS box, and no JVM even exists for that...

and the wet dream of any victim

is to get their phone number, call them up, and inform them that they will never buy/use whatever it is they are selling, and will be telling 25 of their closest friends in person because of this practice. Certainly, you aren't limited to 25, but that is the old saying.

Re:and the wet dream of any victim

The real wet dream of any victim would be to be able to disable java or any scriting technology in his browser and still be able to surf on most respectable sites.
I don't want to be a ludite, but on 9 sites times out of 10 that require those technologies, there is very little benefit for the user.

Re:and the wet dream of any victim

A distinction should be made between a website that can't function without client-side scripting, and websites that use it to support various functions but can work without it.

For instance, the multi-level menus on a website should not be the only means of browsing its pages. In fact, if the user were to turn off all of their scripting for their browser, the website should function minimally. Even with Gmail, you could change the site options to "basic HTML", which is found on the bottom of the page.

How about banking websites where you try to pay your bill and want to input the date? Most sites currently have a calendar pop-up for you to display a slick interface. But one should still be able to manually enter in a date that conforms to how the date is stored. (Or use server-side validation & conversion.) Again, inputting a date should not depend on a client-side calendar function since quite a few users use browsers that do not have any client-side scripting functionality.

I agree with your point that a lot of the sites we commonly use have features that depend on client-side scripting, but the website itself should still function if you choose to turn off the functionality on the browser level, and that is what the parent was talking about if I understood their point correctly.

Re:and the wet dream of any victim

I have to agree. I just returned from BlackHat and DefCon. Before I went I had tended to view "Web 2.0" as "Cross Site Scripting as a Feature". My view is now more negative and bleak. The combination of cross site scripting, cross site request forgery, DNS poisioning / anti pinning, and active content on the user's browser's is exceptionally powerful. There were a number of attacks discussed that were very serious. Since these vulnerabilities are server driven, there is essentially nothing that the user can do to protect themselves other than to block the functionality. Unfortunately, the state of the art in server deployments is very bad, not only do web masters deploy a lot of vulnerable web apps, but lots of web servers are compromised by attackers for the purpose of spreading their malware.

The smart web is the dangerous web -- the smarts are all too likely to be out to get you.

As for me, with a few exceptions, if a web site needs lots of scripting to make it work, I don't need it or use it.

Windows/Microsoft Update is in my trusted site zone

I use Firefox with noscript to enable only what I need for mapping functionality

Otherwise, Java, javascript, flash, multimedia, are all off.

so how do i know

this is a real slashdot article, and not some clever cross site full screen javascript faux article out to steal my cookies, hmmm? if i hit submit i might-

oh shit

pfft

Pringles has been doing this for years. They are the original pop you can't stop

don't be dense

When you pop Pringles you get chips... not cookies.

NoScript, but they don't work

In the meanwhile, NoScript [noscript.net]is your friend

As always, with script-related security flaws, the easiest solution is NoScript, of course.

However, FWIW, I couldn't get either of his demos, the Java or the JavaScript, to work on Firefox 2.0.0.6 on Windows XP, despite the fact that the author says that both work on Firefox.

Re:NoScript, but they don't work

However, FWIW, I couldn't get either of his demos, the Java or the JavaScript, to work on Firefox 2.0.0.6 on Windows XP, despite the fact that the author says that both work on Firefox.

It worked on my XP system and covered everything but the Start Menu and Task Bar. Getting it to close was simply a matter of right clicking on Firefox in the Task Bar and closing it down. It's certainly an annoyance, but it's not as bad as the article makes it seem to be. Anybody with a brain (which admittedly excludes about 60% of the population) can figure out how to close Firefox and thus the Java App.

Re:NoScript, but they don't work

Getting it to close was simply a matter of right clicking on Firefox in the Task Bar and closing it down. It's certainly an annoyance, but it's not as bad as the article makes it seem to be. Anybody with a brain (which admittedly excludes about 60% of the population) can figure out how to close Firefox and thus the Java App.

In my experience the vast majority of windows users don't right click on anything, unless they have been specifically instructed to.

And they certainly don't intuitively know that they can right click on task bar icons to do anything, let alone close the app.
For most regular users (no doubt the intended target of the sort of sleeze who would use this for advertising and other nefarious purposes)there is only one way to shut down an app, and that's the rex X in the top right corner.

Re:NoScript, but they don't work

Actually, it was a bit worse (for some reason on mine)

The start bar went behind the app, bringing up task manager and shutting down the app wasn't as easy as you would think because the java app eats focus and makes clicking the "End Process" and the Warning message difficult.

I managed it after a few mistypes and jabs at the button.

Its possible to close it, but it doesn't play nice at all.

Re:NoScript, but they don't work

Computer illiterate people aren't stupid, you know, just computer illiterate. Many of them would probably be able to patronize you in a similar manner if you were to encounter a trivial problem you were unable to solve in their field of study.

Some of the most computer literate people I've met are not from my field of study (Electrical Engineering). I've met guys who can easily match my coding skills from Chemistry, English, Music, Math, and Industrial Engineering. Many of them, for whatever reason, had to use the campus super computer as part of their research and were at least attempting to write massively parallel applications, something I've never stepped anywhere near. The English guy was just a straight up geek, and the Musician was coding his own audio filter plug ins to improve his desktop audio software.

That said, I've met many in fields directly relating to computing (CS, Computer Engineering, etc) who were basically computer illiterate. I'd contend they didn't have brains, as they weren't useful for much outside their field from my observations either... (I worked tech support in college, so I was all over campus working on computers.)

Re:NoScript, but they don't work

This demo didn't work on my iPhone either. Just another reason to use the Superior JesusPhone over standard web technologies... no annoying Java, Flash, or third party apps to exploit!

Firefox

I have the newest version of firefox (vanilla, no extensions, only a few custom settings to increase speed) and his demo completely didn't work on my computer...

Re:Why?

Indeed. That sort of thing usually doesn't end well. Ask the guys behind X10 [wikipedia.org] for example.

Re:Why?

You'd think so, but spam is apparently still worth the risk and effort too.

Re:Why?

The problem with ads is that, apparently, the annoying ones are exactly the ones that work. People like you and me hate them, but we're never going to buy their **** anyway. Those irritating jingles that get played endlessly on TV ads irritate the **** out of us, but they attract the attention (and memory) of those gullible enough to buy the goods.

I'm not sure how much this is really backed up by evidence and how much is just "accepted wisdom" in the marketing community, though. There was a particular local firm advertising on the biggest local radio station in these parts a few years ago. They basically took traditional melodies from things like popular nursery rhymes, and rewrote the lyrics to mention their company name repeatedly and the product they were pitching. After a while, they even ran an ad that had the lyrics "We know the songs get on your nerves", which I remember all too well, perhaps making the point for them. That was, however, the last ad they ever ran on that radio station as far as I can tell. I'm not sure what happened to the company...

To bring this back to the current context, though, the theory seems entirely reasonable. Most of us will never support spammers or get caught by phishing, but those stupid enough to reply to bank password checks or ads for legal software downloads are probably also the ones stupid enough to click on the slightly odd-looking dialog warning about a virus attempting to install itself through your web browser. Sadly, given the tiny running costs, it only take a very small proportion of people to be idiots for the spammers/adware merchants to make an awful lot of money.

Re:Obvious solution?

The whole point of Java was that it was super-sandboxed when running applets and you could enable it for all sites. To prevent phishing, any windows created by a Java applet would have to show 'Warning: Applet window' and a big red border or something like that. I wonder what went wrong to allow this attack, and whether it has been in Java since the beginning (i.e. would work even with Netscape 2.0) or takes advantage of some recently added kewl feature that forgot to do sandboxing properly.

Re:Obvious solution?

From a quick look at the code, the bug seems to be that you can resize the popup to be bigger than the screen size. So the warning disappears off the bottom of the screen.

Silly article

Under MacOS, the dock and top bar are still visible, and it's trivial to kill the browser.

There's virtually no chance anyone would be fooled into doing anything but killing their browser, and Java is by no means alone in causing that kind of issue.

Nothing to see here, move along...

Re:An interesting markettign technique...

If he were selling his software commercially, or people were being directed from the Slashdot front page to a page full of ads, then you might have a point, but that's not the case here. The guy has made an obviously useful tool, gives it away for free, and is warning about an obviously relevant threat. The most he's likely to get out of this is a few small donations or a few more page hits on his site, perhaps making enough to cover the server costs for hosting a popular Firefox extension for a while and a bit of beer money. I think your post is way over the top.

So how about how to stop this?

I'd really like to see counter methods posted as (special) comments under articles like these. "Links to: How to prevent this". It would be really nice if we could use our mod points to "mark" a comment as a solution that an administrator could then move it to the top. Why the administrator involvement? Simple, to prevent the teams of people who go around and exploit this type of function on Yahoo. This would still allow Slashdot to work off the same random moderator point system it has while keeping some semblance of order. They could play around with how many mod points a comment needs before it can before an admin is notified.

Just a thought.

Can't even switch Workspaces

FF on Ubuntu 7.04 using Sun's Java (1.5 I believe). The Java one works wonderfully(?) not only filling my full dual monitor setup, but preventing me from clearing it using any method I tried, including hitting the hotkey to change Gnome workspaces. The only thing that did work was switching to a virtual console at which point I could kill firefox-bin.

Dont worry, I'll turn off the lights on my way out

No need to worry folks, us handful of BeOS users will switch off the lights and the internet on our way out, since we'll be the last ones to leave. Every now and then I'm actually relieved to be running a non mainstream OS.

Remind me: Why do we have applets again?

Seriously, name me one "house-hold" name website that uses Java applets anyway. Can't we just have it switched off by default? I like Java as a broad technology, but I'm finding applets increasingly irrelevant - interactive rich sites are being taken over by flash, ajax, and the probably-to-be-mainstream-soon Silverlight/Moonlight.

This isn't a flame....Java on the desktop is awesome and I love it.

*runs to the hills*

Re:Remind me: Why do we have applets again?

1. Yahoo.com

Done.

Yahoo uses Java for many of their online games. You might not play them, but a lot of people do. And that "lot of people" will probably leave Java enabled and be victim to this crap.

Layne

Re:Interesting

NO

Ban them from going full screen unless I, the owner of the machine where it wants to go full screen, agree to applications having the right to go full screen.

I don't care about signed code. I do care about my preferences!

This, of course, assume you allow Java

This, of course, assumes that you allow Java to run without asking first.

If you, like me, don't allow Java or any other plug-in to run without the browser first asking you if it is OK to run, and if you don't allow plug-ins to run without having a VERY CLEAR idea of where they are coming from and what they will do, and do not run any such plug-in save from a VERY trusted source, then this will be very hard for an advertiser to exploit.

All the more reason why ALL plug-ins should be "user interaction required before use" BY DEFAULT.

Obligatory Linux Elitism

"Worse, popups opened this way are really evil, because they can be sized to cover the whole desktop and cannot be closed by user"

Thing #397 That You Can Do In Linux But Can't In Other Popular Desktop OS's:

1. Ctrl+Atl+F1
2. Log In
3. missile-launch -f --target-from-process java
4. killall java
4a. killall firefox-bin (if necessary)

Actually this story is strangely coincidental; just a few minutes ago, I was trying to show a coworker a cool graphical demo of different sorting algorithm efficiencies, but I didn't have the Java plugin installed. Still don't.

Adblock works, too

Putting http://evil.hackademix.net/fullscreen/FullScreen.c lass [hackademix.net] in AdBlock Plus' kill list worked like a charm. Make a generic kill for *.class and *.jar and then whitelist the sites that need java.

Popups, Wet Dreams...

Popups, Wet Dreams, and no napkins. What a mess.

Lovely

The one sure way to endear me to a product and cause me to whip out my credit card is to pop up a window over my entire screen that I cannot remove. This type of "in your face" advertising is exactly what reluctant consumers like myself need.

flashblock - javablock

I have Flashblock. Is there a Javablock? I'm surprised advertisers don't use Java more often. Java is one of those things that I would probably want to enable manually anyway, there's no need for it to be on all the time.

Analysis of the "hack", or how sum of parts breaks

Would like to share some specifics. Disassembled the bytecode using javap and used my rusty JRE assembler 'skillz' to understand it, but well, since he seems to have compiled it with full debug options, any idiot can find it ut by staring at the output for a sec.

1. It doesn't use any "go fullscreen" API
2. It's a failure of assuming sum of parts of software is as secure is as its components. It can be "less" secure than any of the component taken in isolation. Point in case is the set of APIs used:

a) Toolkit.getScreenSize(): Used to find size of desktop. Nothing evil here
b) Window.setBounds(): Used to set size of window. Nothing evil, except set it larger than screen size, hence hiding the applet warning by moving it "off screen"
c) Window.setAlwaysOnTop(): Used to set the window on top. Essential for displaying "Modal" dialog boxed like error boxes. Nothing sinister here.

However, the shit happens because all the things taken together can be dangerous. Specially, passing "System Modal" to setAlwaysOnTop().

I don't see an obvious "fix" except the following hurdles that can be presented to unsigned applets (and hence breaking a lot of hobby games, apps etc)-

1. Validate applet size to be always significantly less than screen size
2. Remove support for "System Modal" for unsigned applets for "setAlwaysOnTop". Application modal is fine, system modal is not.

Any more ideas shall be appreciated.

Oh, and I again despise him for an irresponsible disclosure and presenting the hack in easily reverse engineered, fully functional code.

Re:Analysis of the "hack", or how sum of parts bre

I don't see an obvious "fix" except the following hurdles that can be presented to unsigned applets (and hence breaking a lot of hobby games, apps etc)-
1. Validate applet size to be always significantly less than screen size
2. Remove support for "System Modal" for unsigned applets for "setAlwaysOnTop". Application modal is fine, system modal is not.

I would expect that "System Modal" should be forbidden from any applet, even if it is signed. After all, it is running in a browser, not directly in the OS, so Application modal should be sufficient. In fact, one can argue that if you are writing an applet and you need System Modal functionality, then you are probably using the wrong technology anyways and should consider alternatives.

Applets were designed to be sandboxed. System Modal should have been forbidden from the beginning anyways.

Flash

Is having a full screen window in java any different from having a full screen window in Flash? If so, wouldn't it just be as easy to use Flah, since it is likely installed on more systems than Java is.

Re:Hence why I don't use java

It really is very bad language to use online,

Why is that? What is "worse" about it than Ecmascript?

For extra credit, explain why Java Web Start is worse than downloading a traditional application and installing it...

Lemmings...gotta love 'em.

Re:Doesn't work..

That might be why the author wrote "In the meanwhile, NoScript is your friend ;)" in his blog.