473,811 Members | 2,665 Online
Bytes | Software Development & Data Engineering Community
+ Post

Home Posts Topics Members FAQ

Malicious JavaScript code,

AIUI, it was not all that long ago when the threat to personal users,
was attachments that when executed compromised machines with keyloggers,
trojans, etc.

Now it seems that the big problem is reading a webpage or an HTML e-mail
and getting affected through the scripting. My understanding is that
the script downloads the malicious program from the web and sets it to
run on start up through the start-up folder or in the registry.

I don't know much about this; can someone suggest a good web site to
start learning a bit more about these threats. I have googled, but I am
not quire sure of the best search terms, and since there is so much
information out there, a site that experienced people endorse would be a
lot of help.

In particular, it seems as if JavaScript dowloading a trojran without
the user clicking an attachment is a big problem.

Thanks.
Jan 27 '06
28 3040
In article <0e************ *************** *****@4ax.com>,
jn******@yahoo. com.au says...
On Sat, 28 Jan 2006 04:16:04 -0500, in comp.lang.javas cript Randy Webb
<Hi************ @aol.com>
<ub************ ********@comcas t.com> wrote:
| cwdjrxyz said the following on 1/28/2006 1:50 AM:
| > cwdjrxyz wrote:
|
| <snip>
|
| Do you work for a security company or an anti-virus company? It has to
| be one of the two to come up with the kind of arguments you did (none of
| which are true).
|
| The best defense against being infected? Knowledge. Knowledge of how
| your computer works (at least a basic understanding) and a basic
| knowledge of how the web works. Now you can be safe.
|
| Even my mother knows how to keep from getting her computer infected. She
| has no firewall and no anti-virus program but she has the Knowledge to
| know how to stay safe.


My experience (take it for what it is worth).
I have cable connection.
I was rebuilding my machine after a crash.
I formatted the hard drive and re-installed the OS.
I left the cable connection as the setup would've detected this and
configured it for me.
After the OS was installed I then installed the AV app.
It reported 5 virii - all because I had a connection to the internet.


Rubbish. They're false positives, or your set-up is not "authentic" .

--

Hywel
http://kibo.org.uk/
Jan 29 '06 #21
Hywel Jenkins <hy***********@ gmail.com> wrote:
In article <0e************ *************** *****@4ax.com>,
jn******@yahoo .com.au says...
On Sat, 28 Jan 2006 04:16:04 -0500, in comp.lang.javas cript Randy Webb
<Hi************ @aol.com>
<ub************ ********@comcas t.com> wrote:
>| cwdjrxyz said the following on 1/28/2006 1:50 AM:
>| > cwdjrxyz wrote:
>|
>| <snip>
>|
>| Do you work for a security company or an anti-virus company? It has to
>| be one of the two to come up with the kind of arguments you did (none of
>| which are true).
>|
>| The best defense against being infected? Knowledge. Knowledge of how
>| your computer works (at least a basic understanding) and a basic
>| knowledge of how the web works. Now you can be safe.
>|
>| Even my mother knows how to keep from getting her computer infected. She
>| has no firewall and no anti-virus program but she has the Knowledge to
>| know how to stay safe.


My experience (take it for what it is worth).
I have cable connection.
I was rebuilding my machine after a crash.
I formatted the hard drive and re-installed the OS.
I left the cable connection as the setup would've detected this and
configured it for me.
After the OS was installed I then installed the AV app.
It reported 5 virii - all because I had a connection to the internet.


Rubbish. They're false positives, or your set-up is not "authentic" .


Not necessarily rubbish. I had a similar experience, but it didn't take my
NOD32 A/V program to discover I'd been invaded.

Turns out that after installing XP I had my machine connected to DSL. When
IE installed, it set its 'home page' to MSN.com. Shortly after connecting
to MSN, the shit hit the fan. Machine started to reboot, etc. An AV scan
showed about 4 or 5 viruses had invaded my new machine.

--
Ed Jay (remove M to respond by email)
Jan 29 '06 #22
In article <11************ *********@g43g2 000cwa.googlegr oups.com>,
sp*******@cwdjr .info says...

Hywel Jenkins wrote:
In article <11************ **********@g49g 2000cwa.googleg roups.com>,
sp*******@cwdjr .info says...

Randy Webb wrote:
> cwdjrxyz said the following on 1/28/2006 1:50 AM:
> > cwdjrxyz wrote:

> Do you work for a security company or an anti-virus company? It has to
> be one of the two to come up with the kind of arguments you did (none of
> which are true).

No, I do not work for a security or anti-virus company. You are
entitled to your opinion about what is true. However I suspect that
many would argue with this conclusion, especially for those who use
Windows XP without protective programs. I think that even Microsoft
will suggest protective programs on computers that use Windows OSs, and
they are not a big player in the security market - at least not yet.

Y> > The XP does provide a one way firewall

It has two-way functionality.


You may be right, but see
http://www.microsoft.com/windowsxp/u...2_wfintro.mspx
for details about the Microsoft firewall included with the XP, post
sp2. It makes mention that there firewall can block incoming attempts
to connect to ports, etc. It does not mention that it will block
outgoing attempts by your computer to connect to somewhere


The Windows Firewall *does* block outgoing traffic. It frequently asks
if an application should be permitted access to the internet.

--

Hywel
http://kibo.org.uk/
Jan 29 '06 #23
In article <kc************ *************** *****@4ax.com>, edMbj@aes-
intl.com says...

Rubbish. They're false positives, or your set-up is not "authentic" .


Turns out that after installing XP I had my machine connected to DSL. When
IE installed, it set its 'home page' to MSN.com. Shortly after connecting
to MSN, the shit hit the fan. Machine started to reboot, etc. An AV scan
showed about 4 or 5 viruses had invaded my new machine.


You allowed IE, out into the unknown with inadequate security. That's
how you got infected - you *let* it happen.

--

Hywel
http://kibo.org.uk/
Jan 29 '06 #24
In article <11************ *********@g43g2 000cwa.googlegr oups.com>,
sp*******@cwdjr .info says...
This thread has grown into a rather long, now off topic, monster.


Indeed. Most of them debunking your knowledge of JavaScript and web
security.

--

Hywel
http://kibo.org.uk/
Jan 29 '06 #25
Ed Jay said the following on 1/29/2006 4:57 PM:
Hywel Jenkins <hy***********@ gmail.com> wrote:
In article <0e************ *************** *****@4ax.com>,
jn******@yahoo. com.au says...
On Sat, 28 Jan 2006 04:16:04 -0500, in comp.lang.javas cript Randy Webb
<Hi************ @aol.com>
<ub************ ********@comcas t.com> wrote:

| cwdjrxyz said the following on 1/28/2006 1:50 AM:
| > cwdjrxyz wrote:
|
| <snip>
|
| Do you work for a security company or an anti-virus company? It has to
| be one of the two to come up with the kind of arguments you did (none of
| which are true).
|
| The best defense against being infected? Knowledge. Knowledge of how
| your computer works (at least a basic understanding) and a basic
| knowledge of how the web works. Now you can be safe.
|
| Even my mother knows how to keep from getting her computer infected. She
| has no firewall and no anti-virus program but she has the Knowledge to
| know how to stay safe.
My experience (take it for what it is worth).
I have cable connection.
I was rebuilding my machine after a crash.
I formatted the hard drive and re-installed the OS.
I left the cable connection as the setup would've detected this and
configured it for me.
After the OS was installed I then installed the AV app.
It reported 5 virii - all because I had a connection to the internet.

Rubbish. They're false positives, or your set-up is not "authentic" .


Not necessarily rubbish. I had a similar experience, but it didn't take my
NOD32 A/V program to discover I'd been invaded.

Turns out that after installing XP I had my machine connected to DSL. When
IE installed, it set its 'home page' to MSN.com. Shortly after connecting
to MSN, the shit hit the fan. Machine started to reboot, etc. An AV scan
showed about 4 or 5 viruses had invaded my new machine.


As was pointed out, that is a flaw on *your* part. You are the one that
allowed it out without checking it first.

You can not put anything on my PC without me, directly or indirectly,
allowing it. And if you allow it, you reap what you sow.

--
Randy
comp.lang.javas cript FAQ - http://jibbering.com/faq & newsgroup weekly
Javascript Best Practices - http://www.JavascriptToolbox.com/bestpractices/
Jan 29 '06 #26
Hywel Jenkins <hy***********@ gmail.com> wrote:
In article <kc************ *************** *****@4ax.com>, edMbj@aes-
intl.com says...
>
>Rubbish. They're false positives, or your set-up is not "authentic" .


Turns out that after installing XP I had my machine connected to DSL. When
IE installed, it set its 'home page' to MSN.com. Shortly after connecting
to MSN, the shit hit the fan. Machine started to reboot, etc. An AV scan
showed about 4 or 5 viruses had invaded my new machine.


You allowed IE, out into the unknown with inadequate security. That's
how you got infected - you *let* it happen.


I agree.

--
Ed Jay (remove M to respond by email)
Jan 29 '06 #27

Hywel Jenkins wrote:
The Windows Firewall *does* block outgoing traffic. It frequently asks
if an application should be permitted access to the internet.


In fact, depending on the security settings you choose, you do
sometimes get a warning message when online if the site you go to tries
to get some information sent to it or elsewhere. I also have this
happen to me when I am on the web using IE6. However, my Windows
firewall is completely disabled by another, in my opinion better, 2 way
firewall I use, and a check of Windows settings confirms that the
Windows XP firewall is indeed disabled. Thus this has nothing to do
with the Windows firewall and everything to do with the security
selection features that were greatly improved with sp2. What my 2 way
firewall does is display every application you have on your computer.
Each application may be completely blocked from the web, allow
outgoing, or be unblocked. If you change the security settings, when on
IE6, to the lowest possible (not recommended), you seldom get any kind
of message. If you set for maximum security you can not get into many
safe sites such as my bank, etc. Security settings are somewhat
different for various browsers. I keep Opera set at very high security
for the most doubtful sites and Firefox a little less secure for
trusted sites. On broadband, it is no problem having several browsers
in use at once, and I often have the SBC/Yahoo DSL(IE6 relative),
Firefox, and Opera all connected to the web when I am testing pages on
different browsers. Thus you often notice differences in security
warning response for different browsers when you are viewing the same
page with 3 browsers.

In the last 15 minutes, over 20 attempts to get into many different
ports have been rejected and recorded in my firewall log. Tonight many
can be traced to China. Many of these likely are attempting to find an
open port, get in, and take advantage of a worm or virus that they hope
has been planted on the computer. I take part in a program that reports
all of these attempts to a data base that is used to help improve web
security. Some ISPs likely are targeted much more than others. The
large broadband ISPs in the US seem to be favorite targets. A computer
that always is connected to broadband is likely much more useful to
many hackers than one that is online only now and then and connected on
dialup.

But back to javascript, I would love to see a page using a script for
which you are most proud, since you seem to have very strong opinions
about how to best write scripts.

By the way, I do not really care about subjective adjectives, good or
bad, that anyone may use on the web. Such usually are not allowed in a
proper technical journal owned by an important scientific or
engineering society where papers are properly peer reviewed and
objective statements are required. I can not get very excited in an
emotional way, pro or con, about anything I read in an open NG. You
seldom know anything about the qualifications of the person expressing
an opinion.You could have the Queen of England(unlikel y, but there is a
royal site), you could have a technician at a famous university who
knows little about computing and perhaps dissects frogs for a
researcher, or you may have someone who knows nearly nothing about
computing at all. And I doubt if skills in html, javascript, or C++ are
likely to be considered profound enough to win a Nobel prize.

So farewell to this much too long, off topic thread. Was there a full
moon this weekend? It has been too cloudy here for me to notice.

Jan 30 '06 #28
cwdjrxyz wrote:
<snip>
... . I can not get very excited in an emotional way,
pro or con, about anything I read in an open NG. You
seldom know anything about the qualifications of the
person expressing an opinion.

<snip>

The only qualification that matters on a technical newsgroup with a
specific subject is how much an individual knows about the group's
subject, and that is relatively easy to determine from their
interactions with the group. It doesn't matter that anyone can post
anything they like to any group because if their writing is perceived as
questionable it will be questioned. The people who understand the
subject will be able to explain and justify their statements, the people
who are learning will be able to explain their understanding (and be in
a position to learn from the comments they receive in response), and the
people who would rather pretend that they know more than they do (often
as much to themselves as to others) will bluster and vacillate and
expose the truth in the process.

Two or three months reading this (relativity heavily trafficked)
newsgroup should identify most of the people who are worth listening to,
and the utterly worthless usually give themselves away quite quickly,
with the many in-between often rapidly migrating towards the more
informed end of the spectrum, if they actively participate. Newsgroups
may seem overly critical but understanding evolves quickly in a hostile
environment.

Richard.
Jan 31 '06 #29

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

4
3545
by: joshw53 | last post by:
I'm sure this is a simple question. I just installed Visual Basic.NET and every time I begin running the program Norton anti-virus says that there is a malicious script file that it suggest I stop. The file is devenv.exe. Is this a problem I should worry about or can I simply allow the file to run? Will it cause problems later, and if so how can I fix things?
2
1197
by: IRAQI OIL IS TOO PRECIOUS | last post by:
Friedman is a malicious mischief monger and misleader In his mind he is probably gloating over the victims he has fooled. Comments below clearly show where he is not an idiot but a malicious schemer. > Restoring Our Honor
1
1867
by: Stimp | last post by:
I have an input field, which will ultimately be stored in a database and the contents of which will be output on screen at some stage. ASP.NET has built-in functionality to prevent users inputing values such as "<script>", etc, to call malicious code, but I'd prefer to back this up with my own input validation. I'll deny < and > characters on input.. any other strings/characters to look for?
0
1237
by: =?Utf-8?B?UGF1bCBILg==?= | last post by:
When I download the August ’07 Malicious Software Removal Tool I am able to run the “quick” scan, but the “full” scan stops with an error message each time. There’s no ref. code so I can’t easily diagnose the problem. I had no problems running the “full” scan with the July ’07 tool, and I prefer to run the “full” scan because it finds and removes some e-mail malware that the “quick” scan doesn’t. I’m running...
14
2375
by: morebeer | last post by:
I got the same problem, hundreds of SQL tables been infected with this malicious javascript code. But although closing the original injection leak and also having replaced all strings in all tables, my tables being infected again and again. I already checked all stored procedures but couldn't find anything suspicious. Any help how to get rid of this f* malware is highly appreciated!!!
0
9734
marktang
by: marktang | last post by:
ONU (Optical Network Unit) is one of the key components for providing high-speed Internet services. Its primary function is to act as an endpoint device located at the user's premises. However, people are often confused as to whether an ONU can Work As a Router. In this blog post, well explore What is ONU, What Is Router, ONU & Routers main usage, and What is the difference between ONU and Router. Lets take a closer look ! Part I. Meaning of...
0
9607
by: Hystou | last post by:
Most computers default to English, but sometimes we require a different language, especially when relocating. Forgot to request a specific language before your computer shipped? No problem! You can effortlessly switch the default language on Windows 10 without reinstalling. I'll walk you through it. First, let's disable language synchronization. With a Microsoft account, language settings sync across devices. To prevent any complications,...
0
10652
Oralloy
by: Oralloy | last post by:
Hello folks, I am unable to find appropriate documentation on the type promotion of bit-fields when using the generalised comparison operator "<=>". The problem is that using the GNU compilers, it seems that the internal comparison operator "<=>" tries to promote arguments from unsigned to signed. This is as boiled down as I can make it. Here is my compilation command: g++-12 -std=c++20 -Wnarrowing bit_field.cpp Here is the code in...
0
10395
jinu1996
by: jinu1996 | last post by:
In today's digital age, having a compelling online presence is paramount for businesses aiming to thrive in a competitive landscape. At the heart of this digital strategy lies an intricately woven tapestry of website design and digital marketing. It's not merely about having a website; it's about crafting an immersive digital experience that captivates audiences and drives business growth. The Art of Business Website Design Your website is...
0
10137
tracyyun
by: tracyyun | last post by:
Dear forum friends, With the development of smart home technology, a variety of wireless communication protocols have appeared on the market, such as Zigbee, Z-Wave, Wi-Fi, Bluetooth, etc. Each protocol has its own unique characteristics and advantages, but as a user who is planning to build a smart home system, I am a bit confused by the choice of these technologies. I'm particularly interested in Zigbee because I've heard it does some...
0
9211
agi2029
by: agi2029 | last post by:
Let's talk about the concept of autonomous AI software engineers and no-code agents. These AIs are designed to manage the entire lifecycle of a software development projectplanning, coding, testing, and deploymentwithout human intervention. Imagine an AI that can take a project description, break it down, write the code, debug it, and then launch it, all on its own.... Now, this would greatly impact the work of software developers. The idea...
0
6895
by: conductexam | last post by:
I have .net C# application in which I am extracting data from word file and save it in database particularly. To store word all data as it is I am converting the whole word file firstly in HTML and then checking html paragraph one by one. At the time of converting from word file to html my equations which are in the word document file was convert into image. Globals.ThisAddIn.Application.ActiveDocument.Select();...
0
5700
by: adsilva | last post by:
A Windows Forms form does not have the event Unload, like VB6. What one acts like?
2
3874
muto222
by: muto222 | last post by:
How can i add a mobile payment intergratation into php mysql website.

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.