{"id":11410,"date":"2018-02-07T15:10:03","date_gmt":"2018-02-07T23:10:03","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2018\/02\/07\/news-5181\/"},"modified":"2018-02-07T15:10:03","modified_gmt":"2018-02-07T23:10:03","slug":"news-5181","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2018\/02\/07\/news-5181\/","title":{"rendered":"Tech support scammers find new way to jam Google Chrome (updated)"},"content":{"rendered":"

Credit to Author: J\u00e9r\u00f4me Segura| Date: Tue, 06 Feb 2018 16:21:49 +0000<\/strong><\/p>\n

Update (1) (2018-02-07): This issue with Google Chrome was reported\u00a0here<\/a>\u00a0and merged\u00a0here<\/a>.<\/em><\/p>\n

Update (2)\u00a0(2018-02-07): Firefox and Brave seem to be affected by this bug as well (both vendors were informed).<\/em><\/p>\n

– –<\/p>\n

During the past quarter we have noted an increase in fake browser alerts pushing tech support scams. Most of these campaigns come from malicious advertising but also via compromised web sites. Crooks are using all sorts of tricks to not only scare users but also to try and ‘lock’ their browsers.<\/p>\n

One such technique involving the history.pushState<\/em> API which we reported<\/a> about on this blog has now been patched but still continues to be used. There are also the infamous pop-unders that can be used in such a way that users are stuck between various tabs<\/a>.<\/p>\n

In yet another twist, scammers are now abusing another API that achieves their intended goal of freezing the browser. By doing so they hope that users will panic and call the toll-free number for assistance. The following animation shows what a user may experience with Google Chrome’s latest version (64.0.3282.140).<\/p>\n

\"\"<\/p>\n

Figure 1: What happens when you visit the booby-trapped page.<\/em><\/p>\n

The code responsible for this is embedded within the main page, and slightly obfuscated:<\/p>\n

\"\"<\/a><\/p>\n

Figure 2: The underlying code shown with functions such as ‘bomb_ch’ or ‘ch_jam’<\/em><\/p>\n

The Blob<\/a> constructor coupled with the window.navigator.msSaveOrOpenBlob<\/em><\/a> method lets you save files locally and, as you may have guessed, is what is being abused here.<\/p>\n

The ch_jam()<\/em> function calls another function called bomb_ch()<\/em>, and are both appropriately named for what they do. This in turn calls the download<\/em> function that uses the aforementioned Blob constructor.<\/p>\n

It happens too fast to see how it works, but you may be able to spot it with a powerful enough machine and if you try to close the tab early on. That code triggers a very large number of downloads in rapid fire, which causes the browser to become unresponsive within a few seconds, and unable to be closed via normal means.<\/p>\n

\"\"<\/a><\/p>\n

Figure 3: Attempting to close the browser tab before it gets jammed reveals what is going on<\/em><\/p>\n

The primary targets for this particular browser freeze are Google Chrome users on Windows. Other browsers will get their own landing pages, abusing other HTML APIs. Considering that Chrome has the most market share in the browser category, this is yet another example of the desire for threat actors to deploy new social engineering schemes.<\/p>\n

Since most of these browser lockers are distributed via malvertising, an effective mitigation method is to use an ad-blocker. As a last resort, the Windows Task Manager will allow you to forcefully quit the offending browser processes. Malwarebytes users were already protected against the redirection mechanism used in this attack.<\/p>\n

The post Tech support scammers find new way to jam Google Chrome (updated)<\/a> appeared first on Malwarebytes Labs<\/a>.<\/p>\n

https:\/\/blog.malwarebytes.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Credit to Author: J\u00e9r\u00f4me Segura| Date: Tue, 06 Feb 2018 16:21:49 +0000<\/strong><\/p>\n\n\n\n
<\/a><\/td>\n<\/tr>\n
Browsers are usually the first point of contact between victims and threat actors. With a few bits of code, crooks manage once again to freeze Google Chrome and scare users into calling for assistance.<\/p>\n

Categories: <\/p>\n