Hacker problems, help someone?

Forum Moderators: phranque

Message Too Old, No Replies

Hacker problems, help someone?

danthwhaler

6:31 pm on Dec 1, 2004 (gmt 0)

For the second time in three days, someone (from Russia) is framing my site in an iFrame and feeding trojans to anyone who clicks on the site.

The first time I got the host to shut down the site, but now it's back again doing the same thing on another domain name.

I've contacted the host of the new webspace again, but don't want to play cat and mouse until this idiot gets bored and packs it in.

Any ideas of:

Damage it could cause? My antivirus / firewall and Spybot are stopping the trojans affecting my own machine.

How I can stop this by some means other than contacting the webspace providers he is using?

encyclo

6:48 pm on Dec 1, 2004 (gmt 0)

Welcome to WebmasterWorld [webmasterworld.com], danthwhaler.

I'm guessing that the trojans, etc. are displayed around your website which is placed in the iframe.

The first move is to use a frame-breaker Javascript which will get your site out of the iframe. Add this in between the

<head>

and

</head>

of your site pages:

<script type="text/javascript">
if (parent.frames.length > 0) {
parent.location.href = self.document.location
}
</script>

If your site is itself using frames, place the Javascript in the frameset page.

That will mean that anyone finding the iframed page is going to get your site only displayed, not the other site around it.

nancyb

7:33 pm on Dec 1, 2004 (gmt 0)

what are the down sides to using a frame breaker especially if you don't know if the site is being framed?

Also, if java script is turned off it wouldn't work, right?

is this just generally a good idea as a preventative measure?

encyclo

7:44 pm on Dec 1, 2004 (gmt 0)

Also, if java script is turned off it wouldn't work, right?

You're right in saying it wouldn't work, but as the scumware downloads depend on Javascript/ActiveX as well, if JS is switched off so is the possibility of being hit.

I use a script like that on every single page I have online. As you said, it's a quick preventative measure.

createErrorMsg

1:29 pm on Dec 2, 2004 (gmt 0)

encyclo, that's a great tip. Should be put in the library somewhere for all to see.

cEM

danthwhaler

5:56 pm on Dec 2, 2004 (gmt 0)

Many thanks for the very quick reply and great advice. I didn't get to see if it worked or not as the host took the site down before I got a chance to use it.

The code is in the header of my site now and so will hopefully sit there dissuading any similar such attempts.

twist

6:44 pm on Dec 2, 2004 (gmt 0)

I have the following in a .js file which is called from all pages,

if( window!= window.top ) { top.location.href = location.href; }

Someone from here told me about it, will it work the same as your script?

encyclo

7:05 pm on Dec 2, 2004 (gmt 0)

twist, I don't know if there is much of a difference, so I have started a thread in the Javascript forum here [webmasterworld.com] to ask for the best script to use.