up vote 2 down vote favorite
share [g+] share [fb]

http://raffa991[dot]ra[dot]funpic[dot]de/lol/
Warning: It is some kind of an annoying "you are an idiot" sign combined with a lot of popup message boxes. Open with care!

In any case, it crashed my firefox 3.5.4. (or to be more precise, made it unusable) ... I don't know about other browsers.

Since it's been a while since something that stupid did something like that, I'm wondering ... what weakness is that thing using (Javascript ?), and how to protect oneself from it ?

link|improve this question
64% accept rate
@Nifle - what was the point of that edit ? I don't mind, I just think it was more clear the way it was. – ldigas Mar 21 '10 at 18:38
feedback

4 Answers

up vote 3 down vote accepted

Looking at the page source (using a text-mode downloader), it seems it is mostly Javascript.

The best way to avoid these kinds of annoyances is to use NoScript.

It also seems to have a Flash object somewhere in the page. Flashblock can help with that.

There is also some code which moves windows all over the screen. Firefox has a preference which allows you to disable moving and resizing windows (dom.disable_window_move_resize); you should enable it (you do not need to use about:config for it, it is somewhere in the preferences dialog). While at that, also disable blocking the context menu (dom.event.contextmenu.enabled); it is in the same place in the preferences dialog.

Finally, the relevant bug report is Bug 61098 – Exit all currently active scripts (allow aborting modal window.alert() loops in javascript (js)) (warning: over 200 comments on that bug report). Finding a solution to bug 61098 (and coding it) will be a large step on avoiding this problem.

Edit: an even better bug report is bug 432687, which is the meta-bug tracking all bug reports relevant to this problem.

link|improve this answer
NoScript deals with flash as well. – John T Mar 21 '10 at 15:36
The flash object is the sound. NoScript blocks flash objects by default. – Josh K Mar 21 '10 at 15:37
Beat by 31 seconds! – Josh K Mar 21 '10 at 15:38
@John T: not if you temporarily allow Javascript on a page. When you do that, Flashblock takes over. – CesarB Mar 21 '10 at 15:41
feedback
up vote 3 down vote

I cURL'ed the page and put it up (raw text, no worries) on pastebin.ca.

I also deleted ~400 blank lines that started off the page.

It looks to be pure javascript, switching between several arrays to make the title move and the text change.

NoScript soundly defeats this. It won't however defeat stuff like http://tinyurl.com/y8qdwsv without some ahead thinking.

Warning. Clicking that link can be hazardous to your computer's health.

link|improve this answer
+1 for NoScript! – Earlz Mar 21 '10 at 15:44
The problem with that tinyurl link is bugzilla.mozilla.org/show_bug.cgi?id=167475 (it uses several IFRAMEs with SRC="mailto:...") – CesarB Mar 21 '10 at 16:05
Correct, however it's still not fixed. 3.6 is vulnerable to this along with al the major browsers I've tested it in. It would also be a pain if you injected a <iframe src="path/to/page"; /> into an include file in a site, thus making every page an attack page. Not sure how you would do that but I think it's a decently sized problem. – Josh K Mar 21 '10 at 16:10
feedback
up vote 2 down vote

Yep, it's javascript alright. Check out the NoScript extension, it's great for blocking annoying things like this.

link|improve this answer
feedback
up vote 2 down vote

Just a regular old JavaScript prank site, it looks like. (Pointed cURL at the address :P)

As you're using Firefox, you can disable the window movement in Preferences ->Content ->Javascript ->Advanced, though there's no way to stop the messagebox spam built in, you could use NoScript to kill it before it has a chance to run.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown

Not the answer you're looking for? Browse other questions tagged or ask your own question.