Adobe Flash ads launching clipboard hijack attack

http://blogs.zdnet.com/security/?p=1733

The solution for Firefox users is easy: With Noscript you are protected even if you whitelist the site where such flash ads are placed as these links pointing to other sites are still blocked.

Most of these ads should also be blocked when using Adblock Plus. You should also subscribe to the new Malware Domains blocklist.

Solutions for other browsers might be found in one of the links provided in this thread.

 

Could this problem be avoided if one ran the browser inside a sandbox (SandBoxie or similar) ?

 

Well, Sandboxie would allow the copying to the clipboard. That article states;

So if you at some point pasted what you thought was a different web address into the address field and clicked 'Go', you would be pasting that malware link. You might not notice that the pasted address is not the address you intended to paste. So this would all happen...........but it would be in the sandbox.

 

Hi, many thanks for this. So interesting.

Let,s start playing. I tried the POC.

GesWall- bypassed
CFP HIPS- bypassed
THreatFire- bypassed

Very clever piece of malware activity. Try ur HIPS guys!!

 

Excuse my ignorance, what am I specifically supposed to see or experience with this POC? Does this POC work in Opera?


Peace & Gratitude,

CogitoErgoSum

 

The POC works with both IE 7 and Opera. It even works with Opera when JS is disabled. However it does not work if I disble flash( plugins) in Opera.

Not tested FF.

 

Just click the POC and see what is pasted in ur clipboard. Now try do some copy/ cut / paste operation and u will not be able to do anything until u close browser winndow.


Hmmmm...... time to test DW. If DW passes this, it will be a big achievemnt.

 

Hello,
And what if you're using non-Adobe flash ...?
Will have to check this out later.
Mrk

 

EQS with Alcyon's BLOCK FLASH COOKIES/CONTENT kills this POC nicely. Just tried it.

EASTER

 

It,s not a PASS. U can just disble falsh and you will pass without any HIPS.
I will take a HIPS pass if it intercepts actual Clipboard Hijack. If EQS/ Alcyon,s Rules do it, let us know.

 

Hmmmm... Ok, let us know. Never heard of non-adobe flash.

 

Gnash doesn't show anything. I think it's flash 7 ready, not 9 (which seems to be the case).
Gnash 0.8.3

 

Can anyone test ProSecurity?

Thanks

 

Hello aigle,

Thank you, it is clear now. FYI, unfortunately, DefenseWall does not protect against this POC.


Peace & Gratitude,

CogitoErgoSum

 

For those who are interested,

Here are links relevant to this discussion and topic.

http://www.dslreports.com/forum/r20925461-Malvertisement-on-MSNBCcom-using-clipboard-copypaste (Malvertisement on MSNBC.com using clipboard (copy/paste)
http://msmvps.com/blogs/spywaresucks/archive/2008/08/09/1644062.aspx (ALERT: malvertizements utilizing computer clipboards (copy and paste).)
http://msmvps.com/blogs/spywaresucks/archive/2008/08/15/1644705.aspx (Another nail in the 'Apple and Firefox are more secure' coffin)
http://msmvps.com/blogs/spywaresucks/archive/2008/08/18/1645130.aspx (ALERT: Firefox with NoScript does NOT ALWAYS protect from SWF clipboard hijacks)
http://msmvps.com/blogs/spywaresucks/archive/2008/08/18/1644914.aspx (The Clipboard hijacks continue....)
http://msmvps.com/blogs/spywaresucks/archive/2008/08/19/1644990.aspx (Malicious SWF copying data to computer clipboards... the discussions continue)


Peace & Gratitude,

CogitoErgoSum

 

Hello,

Most of those articles are mindless rants. The next time someone writes Linux etc are not more secure than Windows ... I'm gonna slit a wrist ... not mine of course.

I'm tired of explaining root, permissions, modularity ... Some people just don't get it.

BTW, Noscript works as expected. The article claiming otherwise is CRP. The fact someone allows content to run is not the fault of the application. Blaming a gun for shooting yourself in the foot.

Mrk

 

Exactly. Quote from http://msmvps.com/blogs/spywaresucks/archive/2008/08/18/1645130.aspx :

Which Noscript user who isn't completely insane would do such a thing and disable that default behavior?

This guy (sandi) is spreading FUD.

 

You people are too emotional for FF. NoScript is not a part/ setting of FF by default. Also ordinary users do use flash enabled every where. So the exploit does work without problems. This is all I understand.

I don,t say it,s fault of FF. Ofcourse it,s problem with Adobe flash.

 

Hmmmm.... I really guessed so.

Not sure how hard it can be to implement in a Sandbox, may some finctionality issues.

I have yet to see any HIPS intercepting this attack.

 

Interesting POC........
Indeed DefenseWall does not protect against this.
Not a peep from AntiBot either.

 

Hmmm I guess no HIPS will be able to intercept this. I am no expert but it seems something with JS and no HIPS/ Sandboxes intercept JS. Am I true?

Adobe people need to fish their flash or we get silverlight.

 

aigle, NoScript objectively stops this. The blogger that says it doesn't basically admits that NS does block it, in default settings.
The title works because people only read the title and don't read.

 

After looking at that 5th post and seeing obvious malware link and the other legitimate link. Am I to assume then that this means the creator of that post "0ld Owl333" unwittingly posted that malware link in addition to his other MSNBC link because it was somehow sitting in his clipboard? (Clicking that link only sends me to the malware site, nothing is placed in the clipboard.)

That is sort of like me posting a link in this post I am drafting and not seeing that is what I just pasted from the clipboard was not what I had copied and clearly not what I intended before posting.

Seems like the only way this would work is if the user is not paying attention.

For what it's worth just closing the tab or affected window in FX releases the clipboard, no need to exit Fx.

 

Hmmm, false confidence alarm.

Seems the exploit indeed works even in EQS with the extra RuleSet.

I'm sure though it could be blocked by applying some appropriate ruleset, but not the present one for certain.

EQS = ByPassed