8 ms·
I recorded user behaviour on my competitor’s websites (2018)
- ar_turnbull 4y agoAuthor could have learned this from a single user testing session rather than his hijacking technique. Users ignoring fluff is well established in the field of UX.
- movedx 4y agoCan you suggest any reading material on that subject? I'm interesting in building high quality, converting landing pages.
- mitchbob 4y agoThe Nielsen Norman Group has quite a bit. [1] [1] https://www.nngroup.com/articles/ux-writing-study-guide/ https://www.nngroup.com/articles/ux-writing-study-guide/
- dmkii 4y agoAm I missing something? This “hack” requires you to go to his site first, then use the back button and then click on a (fake) competitor link. How is he ever going to get people to his site in the first place? And if it’s through paid ads, why not create a fake paid ad that directs you straight to his fake site in the first place? All sounds very much like a marketer who uses the veil of “security researcher” to hide a scam.
- deleted 4y ago[deleted]
- jcims 4y ago(2018)
- huitzitziltzin 4y agoShould have the date: (2018)
- chrismorgan 4y agoPrevious discussion: https://news.ycombinator.com/item?id=17823886 https://news.ycombinator.com/item?id=17823886 (Aug 23, 2018, 766 points)
- z3t4 4y agoWas expecting to land on a fake HN page after clicking back
- toxicFork 4y agoYou did!
- snappythrowaway 4y agoi always open everything in new tab. Is it safer this way?
- toxicFork 4y agoIt's safer against this back button hijack indeed
- deleted 4y ago[deleted]
- Abecid 4y agoWow
- josefresco 4y ago> "Users seldom read home page “fluff” and often look for things like testimonials, case studies, pricing levels and staff profiles / company information in search for credibility and trust. One of my upcoming tests will be to combine home page with “about us”, “testimonials”, “case studies” and “packages”. This would give users all they really want on a single page." Shady tactics aside, this was interesting but could also have been measured by simply tracking his own website.
- rhplus 4y agocould also have been measured by simply tracking his own website Perhaps his competitors were established, trusted brands, whereas his is one that hijacks back-buttons to trick his own customers.
- chiefalchemist 4y ago"While I was too deep into spying on my competition, my competition was focused on serving its customers." A fool with a tool is still a fool.
- teknopaul 4y agoOr they noticed the URL and were trying to check validity
- Arrath 4y agoI despise sites that hijack my back button (No, I don't want to check any of these DENTISTS HATE THIS MOM'S NEW TRICK clickbait articles thanks) so I can't say I'm surprised there are malicious uses for it, but wow!
- shadowgovt 4y agoUnfortunately, the feature itself is vital for making web apps work in anything like a coherent fashion, so it isn't something that can be disabled (though there may be meat on the bones of permission-gating it).
- svnpenn 4y ago> web apps work in anything like a coherent fashion Why should I care about that? If you have to break the browser for your app to work, maybe you should be doing a desktop/mobile app instead.
- shadowgovt 4y ago> Why should I care about that? Because they are major use-cases for the web browser framework. I mean, that's a bit like asking why you should care about Web Audio API, or the accessibility layer... The fact you're not using it doesn't mean it isn't vital for those who do.
- svnpenn 4y ago> I mean, that's a bit like asking why you should care about Web Audio API, or the accessibility layer Nope. Those are both useful elements of a browser, that don't even require JavaScript to use. What you're talking about is the monster/frankenstein that is web applications.
- shadowgovt 4y agoHow do you use the web audio API without JavaScript?
- hedora 4y agoThe quote from a security researcher at the end treats this like a vulnerability. If this were early days of the web, I'd agree, but web browsers allow so many other shady tactics, this feels more like the web working as intended. (Yes, phishing attacks are bad, but the browser back button spec is specifically designed to allow these sorts of shenanigans, with basically zero legitimate use cases -- the only use case I can think of is telling the browser certain actions should not push themselves onto the back button stack).
- ysavir 4y agoBeing part of an official spec doesn't eliminate it as a vulnerability. If it has potential to be an attack vector, it's a vulnerability.
- bogwog 4y ago> with basically zero legitimate use cases -- the only use case I can think of is telling the browser certain actions should not push themselves onto the back button stack). I agree on the "legitimate" part, but I suspect one of the main reasons is that Google and Apple both really want people to be creating SPAs that pretend to be real apps, and that's hard to do without being able to hijack the back button for navigation.
- daveidol 4y agoI agree. Users should be trained to pay attention to the address bar - in this example that exposed the truth of the matter, as intended.
- warent 4y agoBeautiful example of a chaotic-good grayhat.
- larsrc 4y agoWhich RTM is that referenced in the quote at the end?
- placatedmayhem 4y agoThanks for posting this. I am increasingly frustrated with browsers' weak stance on user control. Hijacking back buttons, right clicks, copy functions, and other items has become quite commonplace and even expected. For example, YouTube puts some functions only in the right-click menu and TinkerCad's viewport rotation is primarily right-click and drag. Presumably, this is in pursuit of making web pages behave more like apps, but it is truly frustrating. If I wanted app behavior, I'd install an app (even something like Chrome's apps). While I'm in a web browser on a web page, I expect to interact with the web browser primarily and the web page through the browser intermediary. The Line of Death discussion is highly relevant: https://news.ycombinator.com/item?id=13400291 https://news.ycombinator.com/item?id=13400291
- chrisshroba 4y agoAs a counterpoint, I don’t want to download apps when webapps suffice. I appreciate when a right click gives me the options I’m hoping for rather than a set of generic Chrome actions that aren’t what I want. I also appreciate when copying works how I want it to (e.g. copy paste in google docs or Figma work as I expect it to, including all styles). And hijacking browser history doesn’t seem to me like it adds much exposure, because the attack vector is still there without browser support (when a user enters your site, auto redirect to google.mydomain.com, which then auto redirects to your content. Back button now will return you to google.mydomain.com without relying on custom browser back button shenanigans) Disclaimer: I work for Figma.
- placatedmayhem 4y agoThis is why I mention Chrome's web apps. I see these as a reasonable middle ground. They are a relatively low barrier to entry and could be used as a way to allow the user to opt into app-like behavior. Sites that the user hasn't opted into wouldn't have these abilities. As another commenter mentions, I'm more likely to disable Javascript by default rather than continue to allow it's abuse. I suspect I'm in the minority though. Double-redirect attacks not withstanding...
- warent 4y ago
- NaughtyShiba 4y agoJesus christ they are douches. This ain’t their first unethical dark-pattern-kind thing.
- jonplackett 4y agoRewriting history in general is pretty dumb that it’s allowed.
- quickthrower2 4y agoThis attach is similar to linking to g00g1e.com and setting up a mock page there. Impersonating sites is going to be hard to secure technically at all.
- notriddle 4y agoAs much fun as it is seeing everybody reiterate the "SPAs are stupid and we should all go back to native apps" argument for the thousandth time with exactly the same arguments again... It's all a moot point, because you can reproduce this particular attach using nothing but 2001-era DHTML. Start with a page that has a hidden iframe, a link that targets it, and a timer that polls the contents of the iframe. When the page first loads, use JS to click the link to add a new item to the back stack. If clicking the link with JavaScript doesn't add a back stack item, make the link visible, but also attach an onclick event handler to it so that the link can simultaneously do what you want and also do what the victim wants. After you've poisoned the back stack, you can detect that the user clicked "back" when the iframe gets reset back to its initial page. Once this is done, use `document.body.innerHTML = whatever` to set up your fake SERP.
- astura 4y agoDoesn't X-Frame-Options in the response header prevent this attack?
- notriddle 4y agoNo, you're thinking of clickjacking. The "attack" I'm thinking of is hijacking the back button, but done using iframes instead of history.pushState. It doesn't involve any third-party origins, so x-frame-options doesn't matter, because a domain owner that wants to launch this attack has control of all the HTTP headers.
- tgsovlerkhgsel 4y agoIt's not true that researchers always do a minimal PoC. I've seen soo many people release fully weaponized attack toolkits, ostentibly for red teams etc., that then end up being abused by actual attackers. These are not just PoCs, but ready-to-reuse, universal toolkits. OTOH, sometimes a harmless PoC isn't enough to induce action, and a proper attack PoC does. I think this may be such a case.
- neuronflux 4y agoHow do other browsers handle this behavior? The author mentioned Chrome specifically.
- O__________O 4y agoReminds me of the Google Maps profile hijacking, which included injecting proxied phone numbers to record the calls. Examples of press on topic: https://valleywag.gawker.com/how-a-hacker-intercepted-fbi-and-secret-service-calls-w-1531334747 https://valleywag.gawker.com/how-a-hacker-intercepted-fbi-an... https://www.theverge.com/2014/2/28/5458610/fake-google-maps-listings-recorded-calls-to-the-fbi-secret-service https://www.theverge.com/2014/2/28/5458610/fake-google-maps-...
- dmingod666 4y agoThe moment you are impersonating Google and your competitors, it's very clearly in fraud/criminal behaviour territory. No serious business will even consider doing something like this.
- eftychis 4y agoI don't think the site suggests serious businesses would do that. P.S. Yet it is not like "serious businesses" do not partake in fraud: Enron, cough cough some/most banks(creating of unauthorized accounts, mortgage fraud, investor fraud, etc).
- dmingod666 4y agoI don't disagree, but, I mean, the moment you start serving fake google pages from your server -- you are straight 'scammer' in my book.
- dmingod666 4y agoI always ctrl click and open multiple tabs, back button doesn't come into play. I assume a lot of people do this.
- paulcole 4y agoEven if a lot of people do this, there’s a lot of people who don’t do this. Just like there’s a lot of people who would never send money to a prince from Africa. A lot of people will…
- Loughla 4y agoMiddle mouse button click for any link. I don't remember the last time I used back. Just open and close tabs based on what I want to do. I learned this during research methods in graduate school as a way to avoid losing valuable studies while working on the various archaic databases, and it stuck. I know every graduate student at my university learned the same thing. I also assumed most people did this.
- metadat 4y ago> Middle mouse button click for any link Yes, this is one of the best parts of having a desktop + mouse compared to a laptop + trackpad (or nub).
- lolinder 4y agoI always configure three-finger tap on the trackpad to act as the middle mouse button. I haven't tried this on a Mac, but it can be done on Windows and Linux with Gnome (and I believe KDE, too).
- vermilingua 4y agoBetterTouchTool TipTap on macOS, gamechanger
- gondo 4y agoOr free alternative: https://github.com/artginzburg/MiddleClick-BigSur https://github.com/artginzburg/MiddleClick-BigSur
- carrotcarrot 4y ago> later used it to mess with conspiracy theory people I always find it funny how these hackers grasp for some othered group that they can justify mistreating. If you're gonna be a hacker stop pretending that you're a moral being and accept what you are
- deleted 4y ago[deleted]
- avg_dev 4y agoI’m usually not interested in social engineering which I think is boring stuff, but I think that (1) this is a weakness on my part as a developer with something of a security focus, and (2) this is perhaps the perfect sweet spot of social engineering and programming. It is an utterly fascinating takedown of the back button hijack. Totally unethical but also very eye-opening for me. Is this kind of back button hijack and history rewriting still possible in modern browsers? Edit: this link leads me to believe this may still be possible: https://developer.mozilla.org/en-US/docs/Web/API/History https://developer.mozilla.org/en-US/docs/Web/API/History - would love a confirmation.
- tomcam 4y agoIs it “totally unethical” when published like this? (Not a security expert so I honestly don’t know the answer)
- avg_dev 4y agoi believe that is a fair question and i believe that ethics are personal and each individual must find/define their own ethics based on their own values and life experiences. here is where i am coming from: 1. the end user is on a google search engine results page (SERP) and sees the blog post author's website as one of the search results 2. the end user clicks the link to the blog post author's website 3. the end user is now on the blog post author's website 4. the end user hits the back button - i believe the end user has a reasonable expectation that they will be back on the google search engine results page... but *they are not*. they are on a mockup that looks like the google SERP but is in fact controlled by the blog post author. 5. the end user clicks on a "link" to a competitor's website - but the "link" is actually yet another mockup created and hosted by the blog post author. i believe this is highly unethical! they are fooling an unsuspecting end-user into thinking they are visiting a brand new site, but they most definitely are not doing so. ultimately, i think that google and other browser authors should remove the possibility for this sort of trickery. i do admire the blog post author for posting the social engineering/programming trickery while still viewing it as unethical. edit: at the bottom of the blog post the author links this previous HN comment which i find interesting: https://news.ycombinator.com/item?id=17826106 https://news.ycombinator.com/item?id=17826106 - and this one is as well https://news.ycombinator.com/item?id=17823886#17826206 https://news.ycombinator.com/item?id=17823886#17826206
- TonyBar 4y agoFrom what I can see, it is still very easy to hijack the back button. Wild that I never heard about this.
- jjzhiyuan 4y ago