Blogger can have javascript embedded?

Hi folks,

I guess other people knew this, but I did not. It turns out that if you own a blog, using the new version of Blogger, you can embed javascript, by adding Page Elements in the layout screen.

What this means is that, if you wanted to, you could embed exploits. Now, to be fair, it's only in your own blog, and an exploit might get shut down pretty quickly, but on the other hand, some exploits are pretty subtle, and some will not be noticed until long after someone has surfed off somewhere else. And, of course, if it's a rootkit, it might not be noticed at all. So far we have not found any overt exploits, but we do keep finding obfuscated automatic redirects to bogus search engines or porn pages.

How it works is this ... They first go to the trouble of setting up a fairly legitimate looking page. Probably they just "borrow" one from a legitimate site, such as Royal Caribbean Tours. This ensures that when the google bots come to index them, they will have lots of good keywords to be indexed on. Then, by adding a small javascript, they automatically redirect any visitors to the real target. I guess they consider that it's marketing, but being the kindest that you can, it's bait and switch at a minimum.

Naturally, we've taken the precaution of preemptively blocking those scripts, but it's easy to see how that school teacher recently got into trouble for having porn on the computers under her control.

Cheers

Roger

Yay! Winbudget is installed!

Hi folks,

In the last day or so, there has been some discussion, particularly in EDU circles, about some sort of bot programs infecting computers and displaying "Yay". (The Attentive Reader will be amused that malcode would actually announce its presence, but that's beside the point). It's not yet clear where they're getting the Yay-bot from, but part of the mystery is now solved. The purpose of the Yay-bot is to install a piece of adware/spyware called WinBudget. This is a Browser Helper Object that appears to monitor all the major search engines, and hijack the search results, displaying its own popups as well.

I guess we can speculate that the dork^h^h^h^h programmer who wrote the installer must have been a bit of a newbie, and was thrilled to find his code actually worked... thus the "Yay". The BHO, however, works quite well and is a real nuisance, and we've taken the precaution of blocking the BHO install site.

Roger