Cursor:none abuse (trick users into clicking Facebook 'like')

http://jack-shepherd.co.uk/experiments/Fake-Mouse-Cursor/

by jackshepherd • 14 years ago

273 65 14 years ago

jack-shepherd.co.uk

epochwolf• 14 years ago

Interesting. Chrome's "Under the Hood > Content Settings > Mouse Cursor" setting doesn't affect this. I would have thought it would prevent this.

Also, stuff like this is why we can't have nice things in browsers. You can't trust the internet.

ben0x5392• 14 years ago

Given what we've been seeing with attack sites, whether shock sites trying to just DoS the browser or silly tricks like making the browser POST to an irc server's irc port to spread the malicious URL, or just terrible ads and tracking that actively slow down the browser and ruin the surfing experience, I'm amazed that not more people see javascript as a built-in remote code execution vulnerability that only gains more and more features over time, sandbox or not. :)

Javascript makes a lot of cool stuff possible, but outside of some heavy-weight web applications that I have to trust anyway like my webmail interface or online storage manager, or games where the interactive components are the only reason why I'm visiting the site to begin with, I'm starting to wonder whether trusting the internet is not inviting more trouble than it's worth.

Maybe I'm "old-fashioned" but I'd love to go back to all the sites I visit functioning with just static web content, no clientside scripting at all, and letting me consume videos and stuff in a trusted media player plugin.

Zirro4• 14 years ago

"...and letting me consume videos and stuff in a trusted media player plugin."

HTML5 generally solves this with <audio> and <video>. If implemented correctly by browsers, they should not require any scripting on the site itself to work.

That said, "trusted" media player plugins (think Flash) have been the targets of many successful attacks as well.

ruethewhirled• 14 years ago

Given that vein of thought you can't really trust any software

cs7022• 14 years ago

By default I have JavaScript blocked on all sites, allowing it only as needed, case by case, because JavaScript is a remote-code-execution vulnerability of modern browsers.

More and more of the applications we use and our private data live in the cloud. We now access our personal files, manage our bank and investment accounts, and make retail purchases on our web browser.

Browsing the web with JavaScript enabled by default allows code written by complete strangers to run on your browser!

superchink• 14 years ago

Odd effect. I see two mouse cursors (Mac OS X 10.7.3 + Chrome Dev Channel).

adriand• 14 years ago

He mentions OS X Chrome specifically. I would quote him, but I can't cut & paste because my cursor is so messed up. ;) If you leave the window and come back in, it works better (temporarily).

jackshepherd7• 14 years ago

If you move the cursor outside of the Chrome window and then back in it seems to work on Chrome OSX

rplnt• 14 years ago

Same in Opera. I'd say it's not supported as it is quite malicious. Another example that comes to mind is changing the content of clipboard when users copies something. http://en.wikipedia.org/wiki/DOM_events#Microsoft-specific_e...

gebe• 14 years ago

The same in Opera, both the original and the "fake" one are visible.

RandallBrown• 14 years ago

I love it. It seems to work fine in Firefox, although the real cursor starts flashing when it's above the Like button.

zxoq• 14 years ago

In Chrome on Windows, it looks fine except when you're hovering over the button, when the real cursor suddenly appears.

jackshepherd7• 14 years ago

That's because there's a transparant DIV above the Facebook iFrame, cycling on/off every few milliseconds. This is required to maintain the fake cursor's position (without it when the real cursor was over the iFrame the 'fake' cursor would stop moving).

pnewhook• 14 years ago

This is brilliant, but now it's only a matter of time until it's in actual use. Sort of like how evercookie was a clever hack meant to call attention to privacy concerns, then was put into actual production sites.

Zirro4• 14 years ago

Do you have any examples of sites/companies that put the techniques into use as a direct result of Evercookie exposing them?

EDIT: Why am I being downvoted for this question? I am seriously interested, so that I can avoid contact with them.

jackshepherd7• 14 years ago

I'm not sure if you can say that it's a direct result of Evercookie, but a number of high profile sites use this kind of tech - for example KissMetrics.com is used by a number of big companies, and they use ETAG cookies, Flash cookies - the lot.

Zirro4• 14 years ago

It should be noted that the NoScript add-on for Firefox prevents this from working through it's Clickjacking-protection (and possibly a couple of more, cursor-specific tricks). People need to know that it does more than block JavaScript.

joelhaasnoot• 14 years ago

What website is useable these days though without Javascript?

Zirro4• 14 years ago

Few of the popular ones, but there may be some misconception here. NoScript isn't meant to be blocking JavaScript for all sites. If you trust a site, which doesn't function without JavaScript, adding it to the whitelist is one click away. You get used to it quickly.

And, even in the mode where JavaScript is allowed by default on new sites, the other protections (Clickjacking, XSS, ABE, etc) still apply.

theon144• 14 years ago

Hacker News, for one. Anyway, NoScript isn't an extension to disable javascript (there's already a checkbox for that), the point is to selectively enable it.

mattstreet• 14 years ago

I think NoScript's clickjacking protection works even if the site is whitelisted or you have javascript turned on for all sites, it still checks for XSS type behavior.

RexRollman• 14 years ago

Many sites work reasonably well and some are even better, as many developers use Javascript to make website perform annoying advertising routines.

aw3c2• 14 years ago

Most actually, depending on your interests of course.. IF you are looking for content, not games, animations or games and the like. I browse with Javascript disabled by default and rarely enable it (and mostly it is for things would work just fine without if their creator wanted).

driverdan2• 14 years ago

Set NoScript to allow all same domain JS. This will block 3rd party tracking scripts and ads while allowing the site to work. You'll have to whitelist a few common files like jQuery on Google CDN but for the most part it works great.

kzrdude• 14 years ago

www.google.com is a good example.

natmaster• 14 years ago

In Firefox, the cursor flashes above the like button. Still easy to miss, but certainly not bad as it seems Chrome is.

sikmajnd• 14 years ago

and not to mention the lag when going over "clicky" button in ff

justindocanto• 14 years ago

I have some input on your todo list:

If you give an id (or class) to your p tag that contains the links you said you wanted to make easier to click, then you could use css and easily add a :hover state. Then on the hover state just make the cursor normal so it's easier to click those links. Upon mouseout the cursor will go back to 'normal'. =)

jackshepherd7• 14 years ago

Thanks for that :) I was thinking of perhaps creating an invisible target for them with the same offset as the FB like/button, so that they could be clicked with the 'fake' cursor to enhance the effect!

chc• 14 years ago

For everyone talking about JavaScript: As far as I can tell, this is fundamentally a CSS vulnerability. Something quite similar ought to be possible without JavaScript — it would just be a bit less elegant. For example, you could just make a pixel grid of divs to simulate mousemove events and position the fake cursor with CSS hover styles.

jonny_eh• 14 years ago

Sounds plausible (and I'd love to see an example!), but would hardly be worth the effort if JS would catch 99% of the victims.

jackshepherd7• 14 years ago

Actually just CSS won't work in this case - because the Facebook Like button is within an iFrame. This works because Javascript cycles show/hide a transparant div above the Like button.

TheMiddleMan• 14 years ago

I forked this to use a different exploit which takes advantage of pointer-events: none.

https://github.com/Rob-ot/Fake-Mouse-Cursor

cocoflunchy• 14 years ago

I don't think I'm getting the desired result... my cursor disappears, and I all I see is a static one in the top left corner above a cropped "Like" button (in french though, that may be the problem). See here : http://imageshack.us/f/836/28545472.jpg/

ck2• 14 years ago

Good luck faking my inverted extra large windows cursor.

chrisacky3• 14 years ago

And I browse without JavaScript, so the CSS style that hid the cursor actually meant I didn't see any cursor whatsoever.

SquareWheel2• 14 years ago

Out of curiosity, aren't 90% of websites broken for you?

AznHisoka• 14 years ago

Nice, can I use this to trick people into clicking an affiliate link instead?

duopixel• 14 years ago

A much more straightforward abuse would be pointer-events: none. Just position an element over the 'like' button and let clicks pass through it: http://jsfiddle.net/rVxTn/

jackshepherd7• 14 years ago

Wow - that is quite amazing. I wonder if that's in use in the wild yet.

Edit: It seems like this is a largely solved problem for Facebook: http://forum.developers.facebook.net/viewtopic.php?id=93201&...

Could definitely still be a problem for other social/ad/affiliate networks though.

jackshepherd7• 14 years ago

It seems that Facebook has a heuristic where it looks for unusual numbers of retracted 'Likes' and then starts requiring confirmation before logging new Likes.

This makes attacks such as these a little less worrying.

elisee• 14 years ago

A similar click-jacking trick is used a lot for spreading videos like worms on Facebook, at least in French. Videos with baiting titles like "How could she do that?", "I can't believe she did this in front of everyone" and such.

Most people will click just to see what it might be and not miss out. Then the video player says you have to click on some letters to prove you're not a robot (clever trick, people don't think much of it because it reminds them of CAPTCHAs)

The letters actually have Facebook Like button iframes on them with opacity set to 0. I edited the opacity on one of them with the Chrome Dev tools:

http://polyprograms.free.fr/tmp/FacebookLikeClickJacking.jpg

Unknowningly liking the video will create a story in your friends' feeds, who will in turn click to see and spread it to their friends. No real harm is done except for the spam and all the ad views generated.

paulgb• 14 years ago

It has. When I was at the company, the most common were a string of .info sites that would show a video player chrome and a title like "embarrassing blooper leaves actress topless" or something equally inviting. The video wouldn't exist, but there would be an invisible "like" button behind the play button.

endtwist• 14 years ago

Even better: http://jsfiddle.net/rVxTn/8/

pointer-events: none on an opaque container, with the FB 'like' button below it.

coderdude• 14 years ago

Great job! I wouldn't mind using this for legitimate reasons. I use custom share buttons on one of my sites and I hate having to use a popup. It's a hack. But this is a sexy hack with better integration.

thekevan• 14 years ago

In Chrome 16 on Ubuntu Natty, right clicking breaks this.

burgerbrain• 14 years ago

That more straightforward approach also avoids an unexpected downside of this approach. I never really noticed it before, but my mouse icon is black instead of the apparently usual white. My mouse suddenly turning white on that page makes it pretty clear what is going on.

dkd903• 14 years ago

I think we can stop worrying. Facebook has a detection mechanism for these false / forced likes :-) http://i.imgur.com/qf7VQ.png

smackfu• 14 years ago

Cursor:none makes it cleaner, but it's not necessary. You could use a lighter cursor like cursor:crosshair or cursor:text along with the fake cursor, and I bet most people will still click using the fake one.

In fact, even if you can't change the cursor at all, you could easily create a swarm of fake cursors that would frustrate the hell out of the user.

jusob• 14 years ago

I guess I should use this as an opportunity to remind people of the "Zscaler Likejacking Prevention" plugin for Firefox/Chrome/Safari/Opera (check the corresponding add-on stores). I use the setting "Request confirmation for all Facebook widgets" so that it asked me for confirmation before sending the Like request.

mkopinsky• 14 years ago

I tried clicking "Fork me on github" but couldn't because I couldn't position the real mouse pointer in the right place.

drucken• 14 years ago

I have NoScript 2.3.1 in Firefox with the default settings, including Clearclick protection. I have no Facebook account and no scripting is enabled for this site, including JQuery.

The site is still able to disable my mouse over most of the screen.

Am I the only one?

downandout• 14 years ago

Is this news? Likejacking has been around for well over a year. Google it.

Maro• 14 years ago

I use Ghostery to wipe out Facebook showing up elsewhere on the Internet.

http://www.ghostery.com

dybber• 14 years ago

Alternative using Adblock: http://adversity.uk.to/

EmmanuelOga• 14 years ago

Speaking about prevention (for the specific case of the like button), I have privoxy (1) setup to disable fb plugins with rules like these:

{+block{Facebook "like" and similar tracking URLs.}} www.facebook.com/(extern|plugins)/(login_status|like(box)?|activity|fan)\.php

{+block{Stupid facebook xd_proxy.php.}} http://static.ak.fbcdn.net/connect/xd_proxy.php.*

The second one also removes an annoyance I see from time to time when I bypass the proxy which makes the page request again and again that xd_proxy.php file.

If I really want to like something, I disable the proxy and reload the page. I use Proxy SwitchySharp (2) for chrome to do the setup for me in pages I visit often.

1: http://www.privoxy.org/ 2: https://chrome.google.com/webstore/detail/dpplabbmogkhghncfb...

Cursor:none abuse (trick users into clicking Facebook 'like')

Related Stories