I recorded user behaviour on my competitor’s websites (2018)

"Users seldom read home page “fluff” and often look for things like testimonials, case studies, pricing levels and staff profiles / company information in search for credibility and trust. One of my upcoming tests will be to combine home page with “about us”, “testimonials”, “case studies” and “packages”. This would give users all they really want on a single page."

Shady tactics aside, this was interesting but could also have been measured by simply tracking his own website.

rhplus• 4 years ago

could also have been measured by simply tracking his own website

Perhaps his competitors were established, trusted brands, whereas his is one that hijacks back-buttons to trick his own customers.

chiefalchemist• 4 years ago

"While I was too deep into spying on my competition, my competition was focused on serving its customers."

A fool with a tool is still a fool.

teknopaul• 4 years ago

Or they noticed the URL and were trying to check validity

Arrath• 4 years ago

I despise sites that hijack my back button (No, I don't want to check any of these DENTISTS HATE THIS MOM'S NEW TRICK clickbait articles thanks) so I can't say I'm surprised there are malicious uses for it, but wow!

shadowgovt11• 4 years ago

Unfortunately, the feature itself is vital for making web apps work in anything like a coherent fashion, so it isn't something that can be disabled (though there may be meat on the bones of permission-gating it).

svnpenn4• 4 years ago

web apps work in anything like a coherent fashion

Why should I care about that? If you have to break the browser for your app to work, maybe you should be doing a desktop/mobile app instead.

ysavir5• 4 years ago

So removing it will simplify web pages? Sounds like a win/win to me.

ghayes• 4 years ago

I think there are some solutions to this problem. Akin to "after a back navigation, you cannot add to the history state without a user interaction"-- or better "the history stack can never grow beyond the number of user interactions". Basically, I should always be able to navigate back to the referrer in a definitive number of actions.

post-it2• 4 years ago

Just include a back button in the webapp.

tgsovlerkhgsel2• 4 years ago

It would be pretty simple to open a web page, do a few user interactions that shouldn't trigger this behavior, and then penalize or deindex web sites that hijack the back button.

Add manual penalties for the ones that slip through the automated testing.

Once it becomes known that doing this means saying bye-bye to your traffic, sites will stop doing it.

veddan• 4 years ago

We actually had an accidental back button hijack at a place I used to work at. It was an SPA, where if you navigated to / it would check if you were logged in. If so, you would be redirected (client-side) to /home, otherwise you were sent to /login. This was done with pushState() instead of replaceState(), so going back from /home would take you to / which would immediately see that you were logged in and send you back to /home.

hedora• 4 years ago

The quote from a security researcher at the end treats this like a vulnerability.

If this were early days of the web, I'd agree, but web browsers allow so many other shady tactics, this feels more like the web working as intended.

(Yes, phishing attacks are bad, but the browser back button spec is specifically designed to allow these sorts of shenanigans, with basically zero legitimate use cases -- the only use case I can think of is telling the browser certain actions should not push themselves onto the back button stack).

ysavir5• 4 years ago

Being part of an official spec doesn't eliminate it as a vulnerability. If it has potential to be an attack vector, it's a vulnerability.

bogwog• 4 years ago

with basically zero legitimate use cases -- the only use case I can think of is telling the browser certain actions should not push themselves onto the back button stack).

I agree on the "legitimate" part, but I suspect one of the main reasons is that Google and Apple both really want people to be creating SPAs that pretend to be real apps, and that's hard to do without being able to hijack the back button for navigation.

daveidol• 4 years ago

I agree. Users should be trained to pay attention to the address bar - in this example that exposed the truth of the matter, as intended.

warent2• 4 years ago

Beautiful example of a chaotic-good grayhat.

larsrc2• 4 years ago

Which RTM is that referenced in the quote at the end?

erpellan• 4 years ago

https://en.wikipedia.org/wiki/Robert_Tappan_Morris

larsrc2• 4 years ago

Thank you. I knew of the worm, but hadn't seen the acronym referring to Morris before.

placatedmayhem2• 4 years ago

Thanks for posting this. I am increasingly frustrated with browsers' weak stance on user control. Hijacking back buttons, right clicks, copy functions, and other items has become quite commonplace and even expected. For example, YouTube puts some functions only in the right-click menu and TinkerCad's viewport rotation is primarily right-click and drag.

Presumably, this is in pursuit of making web pages behave more like apps, but it is truly frustrating. If I wanted app behavior, I'd install an app (even something like Chrome's apps). While I'm in a web browser on a web page, I expect to interact with the web browser primarily and the web page through the browser intermediary.

The Line of Death discussion is highly relevant: https://news.ycombinator.com/item?id=13400291

chrisshroba• 4 years ago

As a counterpoint, I don’t want to download apps when webapps suffice. I appreciate when a right click gives me the options I’m hoping for rather than a set of generic Chrome actions that aren’t what I want. I also appreciate when copying works how I want it to (e.g. copy paste in google docs or Figma work as I expect it to, including all styles). And hijacking browser history doesn’t seem to me like it adds much exposure, because the attack vector is still there without browser support (when a user enters your site, auto redirect to google.mydomain.com, which then auto redirects to your content. Back button now will return you to google.mydomain.com without relying on custom browser back button shenanigans)

Disclaimer: I work for Figma.

warent2• 4 years ago

Your post seems to suggest that you feel Figma is a prime example of how webapps are sufficient over desktop/mobile apps. Yet Figma actually does offer desktop/mobile apps so I'm a bit confused by how Figma helps make your point haha

lmm• 4 years ago

If a webpage implements something perfectly, it enhances the experience. E.g. webpages that mess with scrolling - maybe for 20% of sites that do this it makes them 20% better, but 80% of sites that do it become 80% worse.

I'm not sure the benefits of allowing the Figmas of this world to offer a good app experience outweigh the costs of putting the same tools in the hands of every shitty news site.

placatedmayhem2• 4 years ago

This is why I mention Chrome's web apps. I see these as a reasonable middle ground. They are a relatively low barrier to entry and could be used as a way to allow the user to opt into app-like behavior. Sites that the user hasn't opted into wouldn't have these abilities.

As another commenter mentions, I'm more likely to disable Javascript by default rather than continue to allow it's abuse. I suspect I'm in the minority though.

Double-redirect attacks not withstanding...

Slurpuff• 4 years ago

Hijacking back buttons

There’s nothing that infuriates me more than trying to read an article and suddenly being forced to either spam the back button or close the tab entirely.

sudobash1• 4 years ago

This depends on your browser, but on desktop firefox I can get out of these by holding down the back button a moment. It pops up a list of my (real) browsing history in that tab. I can then select where I want to go back to.

Agreed on how infuriating this is though!

ummonk• 4 years ago

Ideally I’d want to be able to toggle between app mode (which would allow hijacking) and browse mode (which wouldn’t).

userbinator• 4 years ago

Turn off JS except on whitelisted sites and you'll experience a saner web. Unfortunately even static text is often hidden behind such "app-site" monstrosities these days.

fazfq• 4 years ago

For example, YouTube puts some functions only in the right-click menu

If you double-right-click (huh) you can see the "normal" menu. If you use Firefox you can shift-right-click also.

yamtaddle• 4 years ago

Ding ding ding.

Ever letting Javascript initiate requests on its own was a mistake, to pick one major blunder.

NaughtyShiba• 4 years ago

Jesus christ they are douches. This ain’t their first unethical dark-pattern-kind thing.

jonplackett• 4 years ago

Rewriting history in general is pretty dumb that it’s allowed.

notriddle2• 4 years ago

As much fun as it is seeing everybody reiterate the "SPAs are stupid and we should all go back to native apps" argument for the thousandth time with exactly the same arguments again...

It's all a moot point, because you can reproduce this particular attach using nothing but 2001-era DHTML. Start with a page that has a hidden iframe, a link that targets it, and a timer that polls the contents of the iframe. When the page first loads, use JS to click the link to add a new item to the back stack. If clicking the link with JavaScript doesn't add a back stack item, make the link visible, but also attach an onclick event handler to it so that the link can simultaneously do what you want and also do what the victim wants.

After you've poisoned the back stack, you can detect that the user clicked "back" when the iframe gets reset back to its initial page. Once this is done, use `document.body.innerHTML = whatever` to set up your fake SERP.

astura• 4 years ago

Doesn't X-Frame-Options in the response header prevent this attack?

quickthrower2• 4 years ago

This attach is similar to linking to g00g1e.com and setting up a mock page there. Impersonating sites is going to be hard to secure technically at all.

tgsovlerkhgsel2• 4 years ago

It's not true that researchers always do a minimal PoC. I've seen soo many people release fully weaponized attack toolkits, ostentibly for red teams etc., that then end up being abused by actual attackers. These are not just PoCs, but ready-to-reuse, universal toolkits.

OTOH, sometimes a harmless PoC isn't enough to induce action, and a proper attack PoC does. I think this may be such a case.

neuronflux• 4 years ago

How do other browsers handle this behavior? The author mentioned Chrome specifically.

O__________O• 4 years ago

Reminds me of the Google Maps profile hijacking, which included injecting proxied phone numbers to record the calls.

Examples of press on topic:

https://valleywag.gawker.com/how-a-hacker-intercepted-fbi-an...

https://www.theverge.com/2014/2/28/5458610/fake-google-maps-...

dmingod6663• 4 years ago

The moment you are impersonating Google and your competitors, it's very clearly in fraud/criminal behaviour territory. No serious business will even consider doing something like this.

eftychis• 4 years ago

I don't think the site suggests serious businesses would do that.

P.S. Yet it is not like "serious businesses" do not partake in fraud: Enron, cough cough some/most banks(creating of unauthorized accounts, mortgage fraud, investor fraud, etc).

dmingod6663• 4 years ago

I don't disagree, but, I mean, the moment you start serving fake google pages from your server -- you are straight 'scammer' in my book.

dmingod6663• 4 years ago

I always ctrl click and open multiple tabs, back button doesn't come into play. I assume a lot of people do this.

Loughla• 4 years ago

Middle mouse button click for any link. I don't remember the last time I used back. Just open and close tabs based on what I want to do. I learned this during research methods in graduate school as a way to avoid losing valuable studies while working on the various archaic databases, and it stuck. I know every graduate student at my university learned the same thing.

I also assumed most people did this.

metadat• 4 years ago

Middle mouse button click for any link

Yes, this is one of the best parts of having a desktop + mouse compared to a laptop + trackpad (or nub).

ttctciyf• 4 years ago

Middle mouse button click for any link.

Yes, and firefox configured to open windows, not tabs (!) Call me a luddite if you like but ctl-w and alt-tab are always to hand and better than any amount of new-fangled tabby nonsense IMNSHO...

Never thought of it as relevant to security before though.

avg_dev4• 4 years ago

I would be shocked if a lot of people did that.

bentcorner• 4 years ago

In a similar way that I choose to use backspace vs ctrl+z, I may use the back button or open a new tab (or duplicate tab, then go back), depending on if I want to keep current context or discard my current work.

paulcole• 4 years ago

Even if a lot of people do this, there’s a lot of people who don’t do this.

Just like there’s a lot of people who would never send money to a prince from Africa. A lot of people will…

carrotcarrot• 4 years ago

later used it to mess with conspiracy theory people

I always find it funny how these hackers grasp for some othered group that they can justify mistreating. If you're gonna be a hacker stop pretending that you're a moral being and accept what you are

avg_dev4• 4 years ago

I’m usually not interested in social engineering which I think is boring stuff, but I think that (1) this is a weakness on my part as a developer with something of a security focus, and (2) this is perhaps the perfect sweet spot of social engineering and programming.

It is an utterly fascinating takedown of the back button hijack. Totally unethical but also very eye-opening for me.

Is this kind of back button hijack and history rewriting still possible in modern browsers? Edit: this link leads me to believe this may still be possible: https://developer.mozilla.org/en-US/docs/Web/API/History - would love a confirmation.

tomcam2• 4 years ago

Is it “totally unethical” when published like this? (Not a security expert so I honestly don’t know the answer)

avg_dev4• 4 years ago

i believe that is a fair question and i believe that ethics are personal and each individual must find/define their own ethics based on their own values and life experiences.

here is where i am coming from:

1. the end user is on a google search engine results page (SERP) and sees the blog post author's website as one of the search results

2. the end user clicks the link to the blog post author's website

3. the end user is now on the blog post author's website

4. the end user hits the back button

   - i believe the end user has a reasonable expectation that they will be back on the google search engine results page... but *they are not*. they are on a mockup that looks like the google SERP but is in fact controlled by the blog post author.

5. the end user clicks on a "link" to a competitor's website - but the "link" is actually yet another mockup created and hosted by the blog post author.

i believe this is highly unethical! they are fooling an unsuspecting end-user into thinking they are visiting a brand new site, but they most definitely are not doing so. ultimately, i think that google and other browser authors should remove the possibility for this sort of trickery. i do admire the blog post author for posting the social engineering/programming trickery while still viewing it as unethical.

edit: at the bottom of the blog post the author links this previous HN comment which i find interesting: https://news.ycombinator.com/item?id=17826106 - and this one is as well https://news.ycombinator.com/item?id=17823886#17826206

TonyBar• 4 years ago

From what I can see, it is still very easy to hijack the back button. Wild that I never heard about this.

ar_turnbull• 4 years ago

Author could have learned this from a single user testing session rather than his hijacking technique. Users ignoring fluff is well established in the field of UX.

movedx• 4 years ago

Can you suggest any reading material on that subject? I'm interesting in building high quality, converting landing pages.

mitchbob• 4 years ago

The Nielsen Norman Group has quite a bit. [1]

[1] https://www.nngroup.com/articles/ux-writing-study-guide/

dmkii• 4 years ago

Am I missing something? This “hack” requires you to go to his site first, then use the back button and then click on a (fake) competitor link. How is he ever going to get people to his site in the first place? And if it’s through paid ads, why not create a fake paid ad that directs you straight to his fake site in the first place? All sounds very much like a marketer who uses the veil of “security researcher” to hide a scam.

I recorded user behaviour on my competitor’s websites (2018)

Related Stories