Anonymise security trick?

Forum Moderators: phranque

Message Too Old, No Replies

Anonymise security trick?

Any ideas how this works...

conor

12:14 pm on Feb 9, 2003 (gmt 0)

A user just sent me this:

" If you go into this web site and follow the instructions on the left hand column tell me how it can see the folders on your c-drive please. I thought our firewall was supposed to stop this..

anonymise.com

Any expanations as to how this works, we do have a firewall and all ports blocked apart from 80.

I suppose it is some sort of windows scripting host trick but I am not sure.

Any ideas appreciated.

[edited by: heini at 12:46 pm (utc) on Feb. 9, 2003]
[edit reason] delinked [/edit]

victor

12:28 pm on Feb 9, 2003 (gmt 0)

Here's one way....Save this to a file and browse it:

<a href="file://localhost/c:">click here to see YOUR C drive</a>

</body><html>

bird

12:39 pm on Feb 9, 2003 (gmt 0)

The site uses frames instead, but the effect is the same:

<frameset rows="38%,*">
<frame name="top" src="index_right.html" scrolling="no" noresize>
<frame name="bottom" src="file:///c¦/">
<noframes>
<body>
<p>This page uses frames, but your browser doesn't support them.</p>
</body>
</noframes>
</frameset>
</html>

All it does is to allow you to see the contents of your own disk. That's not a security problem by any measure. It's a rather stupid psychological trick to scare people into buying their services.

And now that you know this, would you do business with a "security service" that uses an open (and rather obvious) lie in their advertizing? Where I live, a solid assessment of who's honesty I can trust is a very important factor in any security considerations.

hurlimann

12:42 pm on Feb 9, 2003 (gmt 0)

I just got a blank page :)

SuzyUK

1:22 pm on Feb 9, 2003 (gmt 0)

blank page here too :)

but the window kept popping up again it took me about 6 attempts to close it :(

definitely a company I would avoid..and they've got an I.A.W.M.D "award" at the top of their page, not a great advert for them either I would think

Suzy

<added>just noticed smilies not working? and thought I'd check to see if the sttings had changed</added>

aspdaddy

1:31 pm on Feb 9, 2003 (gmt 0)

Blank page here too, the only way a webpage can browse your drive is by ruunning activeX or simliar

conor

4:14 pm on Feb 9, 2003 (gmt 0)

It worked when I tried it live on the site, as it did with Victor's version.

Thanks for all the input guys.

<apology>Sorry Heini, for linking to domain</apology>

BjarneDM

4:26 pm on Feb 9, 2003 (gmt 0)

this is *obvisously* an attemt to lure people who mistypes : anonymiser.com - which is a whole other ballgame. And anonymiser.com *does* have a *serious* test.

dingman

5:27 pm on Feb 9, 2003 (gmt 0)

Fun, Fun, fun. "file /c¦/ not found" :)

And yes, it does look like deliberate typo-traffic. Possibly even "passing off", though IANAL by any means.

TheDave

1:06 am on Feb 10, 2003 (gmt 0)

I went to that site and got 2 pop-ups. One of them had click here to close, so of course I ALT-F4'd :) The second pop-up I did the same thing, and it asked me in a standard windows dialog if I was sure I wanted to close the window and gave me an ok/cancel option. My question is, can these dialogs be used maliciously, like by pressing yes can it initiate something on my system bypassing some security checks? Whenever I get one of these dialogs I always CRTL-ALT-DEL and end the explorer task.

Chris_R

2:14 am on Feb 10, 2003 (gmt 0)

This is the iframe version - couldn't get the frame one to work.

[pr10.com...]

This is just a trick, but I have also wondered the same thing you have TheDave - and also don't answer no.

hurlimann

9:17 am on Feb 10, 2003 (gmt 0)

Yes these box's can be hijacked.

conor

1:57 pm on Feb 10, 2003 (gmt 0)

These boxes are usually images in a size browser window made to look like a system or Explorer message, and normally do nothing less than open a URL. F4 works everytime to be on the safe side!

JayC

2:47 pm on Feb 10, 2003 (gmt 0)

On the internal page called "What We Know About You" they somewhat ambiguously confess that they're using a "trick" to do that:

Do we really know who you are, where you are, what files you have your disk drive and are we able to take control of your computer?
The truth is not really!

And then...

Many web sites that try and sell you 'anonymity' use dirty tricks to fool and frighten you into giving them your money.
[...]
The following is a list of the tricks other sites often use to fool you.

"Other sites?"