Unable to block browser take-over scripts in malware/phishing sites, or at least block redirects to such sites #1013
Comments
|
Blocking inline scripts worked for the two sites offered as example. Inline script can be blocked using static filtering: Further adding: Cripples them more. |
|
Actually just using plain: Worked too.
Someone should use the information in that list to create a ABP/uBlock compatible filter lists which I would enable by default in uBlock. |
|
Closed due to lack of feedback. |
|
Sorry I didn't get back to you quicker. It is not working for me. Maybe I am doing something wrong? I added all of the following to the My Filters tab of uBlock Dashboard: ||mac-system-alert.com^$inline-script Then I clicked on http://mac-system-alert.com/warning.html, at which point a popup hijacked Safari and I was forced to force-quit Safari to escape. |
|
Maybe Safari does not support the blocking of inline scripts, I don't remember. Some thoughts... These sites are definitely a threat to users. One thing that would work is to block the main document, i.e. the root document would not be downloaded from the site. This is something that ABP filter syntax does not semantically support. There is the |
|
Thanks for reopening. I'd like to understand what's going on better, and help in any way I can (though I'm a novice JS coder). I get that I can attempt to implement the JS if it would help... in which case some clues as to where I should start looking at the code would be helpful :) |
Yes. I believe |
|
I think it a strange and inconsistent syntax that As to redirect, I would recommend redirecting to a static (hardcoded) page explaining what just happened, perhaps even showing the list and filter rule that applied. |
Hm, I wonder why is this necessary? Those sites can already be blocked in uBlock either by Dynamic Filtering or by simply adding the hostname to My Filters. Using EDIT: Not quite .... |
|
Ok, I looked at https://adblockplus.org/en/filter-cheatsheet and now understand that |
|
@tlu1024 Because to prevent the behavior reported in issue, one need to block inline script, which I believe is not possible in Safari -- whether through static or dynamic filtering. Anyways, the ability to whole block a site has been requested before, and here we have a very valid reason for this: those sites are dangerous, it's their primary purpose. To have the ability to block them whole is a good thing, especially for non-technical users, who are actually the target for such sites. The original purpose of |
Confirmed. The dynamic filter @gorhill, thank you for understanding the importance for this! I'm thinking hard about ways to get more of the Internet, especially non-technical people, to protect themselves and join the fight against malicious, dishonest or privacy invading behavior. Tools such as uBlock are a step in the right direction. |
|
There is something I don't understand:
But not so with
After blocking also How come? I thought that rules like
block all net requests? BTW: How does a filter like
differ from
EDIT: I'm using Googgle Chrome on Linux. |
I can't help you if you do not tell me what exactly is "block that site with Dynamic Filtering". Show me rules, filters for each screenshot. |
|
Static filter Static filter |
Well, I mentioned them in my post above:
|
|
|
I read your post again, and I have no idea what is unexpected. I am left to guess for what the exact rules are for the first screenshot. I will guess |
Right, that's what I said. But even after blocking |
|
If the User can go back, close the page, or proceed to the site, which site will be temporarily unblocked (set at 60s currently).
If a user thinks the site is all fine and should not be blocked, setting an |
|
add buttons (Go Back) and (Close this window) |
|
You mean to use buttons instead of links? |
|
yes |
|
Done. |
|
I would suggest making "Proceed at your own risk" text a link (because the URL is already mentioned) and also displaying the name of the filterset that has this filter if the filter isn't manually added. |
|
At that point, uBlock has no way to know whether this is a custom filter or not. Looking at the page again, I will change the style of the link to not be code-like looking, but I still prefer to show the URL, just as a reminder of what a user is clicking. |
|
@Deathamns I tried to uncomment the Firefox code for redirection, but this did not work, some security error at the console about " |
|
@gorhill You can't redirect to privileged context ( if ( result.redirectUrl ) {
channel.cancel(this.ABORT);
vAPI.tabs.open({ tabId: details.tabId, url: result.redirectUrl });
return true;
} |
|
@Deathamns Thanks, it worked (just added a check for |
|
Alright, trying to make use of this new code, and I am second-guessing the currently implemented behavior... Requiring the But doing this by default (without the One way to make the current feature useful is to offer the user to choose which semantic to use: strict or relax (better worded in the UI so as to be comprehensible by non-advanced users). This would mean I remove the That kind of feature was requested in the past (#865), and my answer at the time was to install uMatrix which always work in strict mode. The issue in OP here definitely shows that blocking whole pages is in many case often a necessity. |
|
@gorhill does it remain a necessity if I implement inline-script blocking for Safari? |
|
@chrisaljoudi I think yes. If it wasn't for ABP filter semantic, I would probably have done it like in uMatrix. There are benefits to block completely by default a connection for to a bad site -- especially for non-advanced users, because these non-advanced users are even less likely to have globally disabled scripting. For example I am testing the behavior if it blocks by default the root document with the filter lists as is, and I see benefit already for when blocking popups: the blocked popup won't even be able to have it's payload loaded in the window, not even a connection to the remote server serving the crappy stuff with which nasty popups are made of. So currently I am aiming at blocking by default, and to have a setting to fall back to ABP mode if someone chooses so, because non-advanced users are the ones to benefit the most from this behavior. So long as it is easy to un-block permanently a site from uBlock's replacement doc in case of false positive, that shouldn't be a problem for anybody I figure. So I count on the dev build to road-test the idea. The key will be for a user to be able to easily un-block permanently from the replacement doc (it can be done only temporarily currently). I think I will skip publishing a new release next week end so that this is really thoroughly tested for as long as it takes. |
|
Meanwhile, following @Deathamns comment above, I figure it's better to use the same technique for Chromium, so I had to add a new
Which purpose is to load a new URL into an existing tab. If the tab does not exist, it's a noop. I didn't want to extend |
|
Newb question: I'd like to help test the dev version on Mac/Safari. How would I do that? |
|
@vasvasvas right now that's not possible unless you build it yourself, unfortunately. |
|
I remember proposing a different option name, With that said, your implementation of whole-site blocking overcomes the issues I ran into when I was hacking away at ABP in 2013, because it allows people to temporarily go through anyway in case of false positives (for example, if you're trying to view a forum about AdSense and it gets blocked). |
|
I'm doing some testing with uBlock ... I have one dynamic rule only: * * * block I thought that this would block all pages/domains from loading ... But it does not ... if i enter a url like: www.facebook.com ... a portion of the webpage still downloads and loads. If I look at the network log I find that the type "doc" is not being blocked for facebook.com .. If I understand from the above conversation ... the root page (the "doc" type as shown in the log) is the cause for this ... What is not clear, is how I can work around this problem and block any/all network activiity with the blocked domains. Is this possible with uBlock? |
An evil and ever more common phishing trick is to redirect a search result to a site that throws up an impossible to dismiss popup window warning that your system is comprimised by viruses. For example:
(warning, do not click on these unless you're prepared to kill your browser)
http://mac-system-alert.com/warning.html
http://informationdoc.com/rr/
I've made many attempts to craft custom filters and dynamic filters to prevent these. I'm pretty sure there is no way to do so. NoScript would do the trick, but it doesn't exist for Safari. It seems like this is something that uBlock could or should do.
This article describes the problem and maintains a list of such sites:
https://sites.google.com/site/appleclubfhs/support/advice-and-articles/browser-popup-hijack-safari
The text was updated successfully, but these errors were encountered: