[Dshield] RPC exploit popup ad

Kenneth Porter shiva at sewingwitch.com
Fri Aug 15 02:10:06 GMT 2003


--On Thursday, August 14, 2003 4:25 PM -0700 John Hardin
<johnh at aproposretail.com> wrote:

> One of my users just stumbled across a popup ad on MSN that blanked the
> screen and displayed a somewhat convincing "RPC failure, shutting down
> in X seconds" countdown timer. The only thing that somewhat mitigated
> the panic was a "click here" link in small type.

Tested it with Mozilla, and I just get a blank page. But then, I have this in
my prefs.js:

user_pref("dom.disable_window_flip", true);
user_pref("dom.disable_window_move_resize", true);
user_pref("dom.disable_window_open_feature.close", true);
user_pref("dom.disable_window_open_feature.directories", true);
user_pref("dom.disable_window_open_feature.location", true);
user_pref("dom.disable_window_open_feature.menubar", true);
user_pref("dom.disable_window_open_feature.minimizable", true);
user_pref("dom.disable_window_open_feature.personalbar", true);
user_pref("dom.disable_window_open_feature.resizable", true);
user_pref("dom.disable_window_open_feature.scrollbars", true);
user_pref("dom.disable_window_open_feature.status" , true);
user_pref("dom.disable_window_open_feature.titlebar", true);
user_pref("dom.disable_window_open_feature.toolbar", true);
user_pref("dom.disable_window_status_change", true);
user_pref("browser.block.target_new_window", true);

That kills most popup crap without disabling legit JavaScript.




More information about the list mailing list