1

My security officer came to me yesterday, and said the CEO had clicked a "viruses detected, click yes to scan" popup, after which of course his laptop was crawling with viruses. So the SO wants to distribute directions on how to keep people from making the same mistake.

He asked me: "If I say, 'just close popups, don't click anything in it,' is that good enough?" I plan to talk to him about popup blockers and explaining to users about the social engineering aspect of what they see, but I'm interested in how to answer his question.

Specifically because I know a malicious coder could put an onunload() or unbeforeunload() event catcher in the popup code, so if they close the window, (I assume) the same code that runs when you click "Yes, please make a mess of my computer" can be run when you click the close box. But on the other hand if that's true, if a hacker had you open a popup window that is entirely under their control, why bother needing you to click a button in the first place? Why not just have attack code run in the popup?

3 Answers 3

1

In theory, I would say "Read before you click", and if suspect, refer to to your local admin (yes, it generates more noise to the poor admin, but still less than repairing after a problem).

But we know that a popup appears most of times unwanted, and people don't want to read unwanted messages, they just want to get rid of it, to continue what they are doing.

As for the popup itself, such attempt should be detected by the local antivirus. If it is not, like you explained, not much to be done, because nothing forces them really to respect the "he agreed for it, he didn't just close". If a spyware wants to install, it won't just ask for permission.

2
  • "Read before you click" in the face of pages that are designed to mislead the user is a bad idea. That sort of implies that the user would actually consider doing what the popup says. I usually say something like "Never listen to anything that is telling or asking you to do anything" If it wants your password, it's a phishing attack, if it wants you to install something, it's a virus.. etc
    – user23307
    Feb 6, 2010 at 20:24
  • @justin - I meant that for the fact that most people just want a message to disappear, and just click the safest choice already. I agree however that it should be coupled with a "never trust anything you are being told on a webpage". My "report anything suspect" was in this meaning.
    – Gnoupi
    Feb 6, 2010 at 21:55
1

I disagree that having everyone contact the sys-admin for advice is adequate. You cannot always be available, and users being users will at some point assume they understand something and go ahead and click. You also have the issue of drive-by downloads. If you have more than a few users with internet access you are responsible for you should research and present him with some corporate firewall / anti-virus solutions. If you have only a few users with access, you might get by with something like Spybot-S&D on the exposed computers. (From your description it sounds like he found one of the Antivirus 20xx variants so is running Windows)

1

Whether you click OK, click cancel, or close the popup, malicious javascript will usually do the same thing either way. One option might be to make a simple program that kills the browser process, put a shortcut on the desktop/quicklaunch, and name it 'CLICK HERE IF THERE'S A WEIRD POPUP'.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .