Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I was searching for wallpaper images on Google Images and I stumbled upon what appears to be a malicious website. I saw an interesting image in the search results and I clicked on the Visit Page link to visit the page that holds the image, hoping to find some interesting article or blog post.

At first the website seemed normal. But after clicking on a link on the main webpage, Firefox started opening new windows and what you see in the screenshot below is the content of one of the windows.

website

I thought the computer was about to crash because it almost stopped responding. At least four new windows were opened. But then I received the following two info messages telling me that the security settings caused the application to stop. Luckily...

msg1

msg2

After clicking OK two times it stopped opening new windows. I quickly closed the tab holding the URL to the malicious website.

Should I be concerned about a possible infection now? Or was the infection diverted? And what program is responsible for these dialog boxes? Is this part of a Windows or Firefox security feature?

share|improve this question
1  
You should turn on "click-to-play" settings on your web browser, which forces you to click on plugin containers before they activate. Browser plugins (especially un-updated versions) are a major source of attack. This way, you can only allow plugins to run from trusted sites, or sites that you expect to have plugin content. –  Wk_of_Angmar Jun 23 '13 at 5:07

1 Answer 1

up vote 2 down vote accepted

And what program is responsible for these dialog boxes? Is this part of a Windows or Firefox security feature?

It's part of neither. If you'd done us the favour of translating the error messages it would have been easier and I wouldn't have had to resort to an online translator. Anyway, the last word on the dialog very clearly mentions which program is responsible, i.e. JRE.

Should I be concerned about a possible infection now? Or was the infection diverted?

For the benefit of others, this is what the message translates to in English:

1

Presumably the applet was indeed blocked as stated and no malicious code got executed on your system. Even if code did get executed perhaps there's a chance it wasn't able to break out of the Java VM's sandbox and affect your system. Of course, given Java's poor security track record there's no guarantee an exploit hasn't compromised your system despite those messages.

I'd suggest: i) thoroughly scanning your system with multiple anti-malware tools, and ii) disabling Java if you don't use it or at the very least update. What are you doing running an insecure/expired JRE anyway?

For extra credit you may want to read the Setting the Security Level of the Java Client article, which states the reason for the dialog:

Ensuring the Most Secure JRE

Before the browser plugin software attempts to run a Java app, it verifies that the JRE version is at or above the security baseline for that family and that the age of the JRE is recent. If the JRE is deemed expired or insecure, additional security warnings are displayed. In most of these dialogs, the user has the option to block running the app, to continue running the app, or to go to java.com to download the latest release.

JRE Expiration Date

The JRE relies on periodic checks with an Oracle Server to determine if it (the JRE) is still considered up-to-date with all the available security fixes (above the security baseline). In the past, if the JRE was unable to contact the Oracle Server, it continued to behave as though it is still the most recent version with regard to security for an indefinite period.

To avoid this problem, a secondary mechanism, which does not rely on external communication, has been added to the JDK 7u10 release. From this release onwards all JREs will contain a hard-coded expiration date. The expiration date is calculated to end after the scheduled release of the next Critical Patch Update.

This means that JREs that are unable to contact Oracle Servers for an extended period of time, will now start offering additional protection after a reasonable period and will not continue to behave as if they were still up-to-date with security fixes.

share|improve this answer
    
What was the translator you used? So the applet was stopped because I have an old version of JRE? So it's a good thing I had the old/expired version then? Would a newer version of JRE have stopped it? –  sammyg Jun 21 '13 at 23:25
    
Google, but I guess any other would have helped as well. Are you saying the English screenshot I posted is for another warning? As per the message displayed that's why the applet was blocked. Was the wrong message displayed in your case? Obviously I can't say. If the reason for blockage was indeed just an expired and insecure JRE, then perhaps a newer one might have executed it. Again these are things one would have to guess at unless you're willing to test using a VM with the latest version of JRE installed. –  Karan Jun 21 '13 at 23:28
    
Google Translate? I thought you used some dedicated UI string translation website. I stumbled upon one of those websites once, but I forgot the name of it. That's why I was keen to know which one you used. If you know any such website please let me know. A website like that would be a great resource, dedicated UI translation is much better than using Google Translate, it gives you exact translation as it would appear in front of a user with a different language setting. –  sammyg Jun 22 '13 at 9:20
    
The screenshot you posted is correct. Of course it says "blocked" instead of "stopped". But that's the way they translated the dialog from English to Swedish. We do have the word "block" as well. It would literally say "blockerat". But of course you can't translate between languages word by word. You have to take consider context, grammar and style. But yes, the dialog box shown in your screenshot is the same one. –  sammyg Jun 22 '13 at 9:29
    
The JRE on my computer is old and expired. I know that. I have been busy restoring the system after a failure, and I have been meaning to update Java but I have not done so yet. All my Windows updates have been removed too, so I'll have to download and install those as well. I didn't even have my Anti Virus installed at the time of incident. I think it's safe to say now that I was saved by running an old Java JRE. I might try opening the link in a VM with latest JRE. I would like to know if the latest one would stop this. –  sammyg Jun 22 '13 at 9:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.