4 ms·

For anyone that wants to see this in action: - Open a website, let's say google.com - Open a console and type in `window.open("http://xkcd.com")` http://xk

by Cpoll 10y ago

For anyone that wants to see this in action: - Open a website, let's say google.com - Open a console and type in `window.open("http://xkcd.com")` http://xkcd.com")` - Disable your popup blocker and do it again. - Open a console in the new xkcd window and type in `window.opener.location = "https://news.ycombinator.com/user?id=Cpoll"` https://news.ycombinator.com/user?id=Cpoll"` Note that Google quietly turned into my profile page. Now, imagine that it instead turned into maliciousgoogle.com, which looks just like Google, and you can see the attack vector.

k__ 10y ago
Saw this a few times. First we had pop-ups that opened on top of the current window Then we had pop-unders that opened behind the current window Now we have... what? pop-switches? that open your link target in a new window and change the source page to the "pop(-up)" behind your back. Impressive idea, I opened both windows on purpose so they couldn't be blocked or else I wouldn't get to my content and one was transmogrified to an ad page behind my back.
gcr 10y ago
How is this any different in principle than $.get("page", function(result){document.body = result;}); ? If the attacker can run the javascript you mentioned, they've already run.
- biggerfisch 10y ago
  The "benefit" is that it causes a "trusted" tab to change, not a new one that a user might expect to be tainted. If I open a link from HN (for example), read it, and close the tab, I'd expect to be back at HN. If the link changed my `window.opener` url to a fake-HN, I could do some action that asks for a password or some similar data. It's more likely to succeed since the user already trusts the existing window/tab/site.
userbinator 10y ago
For anyone who wants to see this defeated: - Disable JavaScript. Seriously, seeing all these interesting behaviours just makes me advocate even more strongly browsing the "open Web" with JS off by default. The power of JavaScript is not to be underestimated, and while it makes for some very good things that would be otherwise impossible, I think users should be more aware of and understand the risks that allowing any page to run JS can imply. I only allow JS for a very small number of sites which I thoroughly trust and require it, and haven't missed it one bit; the fact that it automatically rids a lot of other surprising and annoying things pages can do, besides phishing or exploiting you, is a nice bonus.
- UIZealot 10y ago
  Couldn't agree more. I don't even enable JavaScript for google.com, not since they integrated the pile of crap that is/was Google+ which added 10% usage load on my CPUs.
- lomnakkus 10y ago
  (Assuming I'm understanding the exploit correctly, obviuosly:) Limiting JS to a few sites won't protect you fully from this attack, though it will obviously limit your exposure. If one of your trusted sites, A, has been compromised by, say, an XSS attack, with the ability to inject JS then this attack can be leveraged to also compromise your access credentials to site B by redirecting your login attempt on site B to a malicious imitation of site B's login page. (Of course this assumes that you already have B open in a tab somewhere and that you opened site A through a _blank link on site B. Mostly I would think that would be a plausible scenario for sites mostly based on user-generated content such as forums, social media, and such.) AFAICT always explicitly force-reloading any login page should make you a lot safer, but remembering to always do that is perhaps not realistic.
- gcb0 10y ago
  I installed Firefox mobile and then NoScript, just to save bandwidth and battery. but my god, how the web got better! practically no ads. no frills. some sites don't work, but then I just move to one that does or allow js there.
- IgorPartola 10y ago
  The web now requires JS to function. I think it's time to take off the tin foil hat and accept it.
  - smt88 10y ago
    Unfortunately, two things can be true at the same time: JavaScript increases security risk, and JavaScript is necessary for a lot of the web.

by Cpoll 10y ago

k__ 10y ago

Saw this a few times. First we had pop-ups that opened on top of the current window Then we had pop-unders that opened behind the current window Now we have... what? pop-switches? that open your link target in a new window and change the source page to the "pop(-up)" behind your back. Impressive idea, I opened both windows on purpose so they couldn't be blocked or else I wouldn't get to my content and one was transmogrified to an ad page behind my back.

gcr 10y ago

How is this any different in principle than $.get("page", function(result){document.body = result;}); ? If the attacker can run the javascript you mentioned, they've already run.

biggerfisch 10y ago
The "benefit" is that it causes a "trusted" tab to change, not a new one that a user might expect to be tainted. If I open a link from HN (for example), read it, and close the tab, I'd expect to be back at HN. If the link changed my `window.opener` url to a fake-HN, I could do some action that asks for a password or some similar data. It's more likely to succeed since the user already trusts the existing window/tab/site.

userbinator 10y ago

For anyone who wants to see this defeated: - Disable JavaScript. Seriously, seeing all these interesting behaviours just makes me advocate even more strongly browsing the "open Web" with JS off by default. The power of JavaScript is not to be underestimated, and while it makes for some very good things that would be otherwise impossible, I think users should be more aware of and understand the risks that allowing any page to run JS can imply. I only allow JS for a very small number of sites which I thoroughly trust and require it, and haven't missed it one bit; the fact that it automatically rids a lot of other surprising and annoying things pages can do, besides phishing or exploiting you, is a nice bonus.

UIZealot 10y ago
Couldn't agree more. I don't even enable JavaScript for google.com, not since they integrated the pile of crap that is/was Google+ which added 10% usage load on my CPUs.
lomnakkus 10y ago
(Assuming I'm understanding the exploit correctly, obviuosly:) Limiting JS to a few sites won't protect you fully from this attack, though it will obviously limit your exposure. If one of your trusted sites, A, has been compromised by, say, an XSS attack, with the ability to inject JS then this attack can be leveraged to also compromise your access credentials to site B by redirecting your login attempt on site B to a malicious imitation of site B's login page. (Of course this assumes that you already have B open in a tab somewhere and that you opened site A through a _blank link on site B. Mostly I would think that would be a plausible scenario for sites mostly based on user-generated content such as forums, social media, and such.) AFAICT always explicitly force-reloading any login page should make you a lot safer, but remembering to always do that is perhaps not realistic.
gcb0 10y ago
I installed Firefox mobile and then NoScript, just to save bandwidth and battery. but my god, how the web got better! practically no ads. no frills. some sites don't work, but then I just move to one that does or allow js there.
IgorPartola 10y ago
The web now requires JS to function. I think it's time to take off the tin foil hat and accept it.
- smt88 10y ago
  Unfortunately, two things can be true at the same time: JavaScript increases security risk, and JavaScript is necessary for a lot of the web.