Cursor:none abuse (trick users into clicking Facebook 'like') • Hacker News Board

Re: Cursor:none abuse (trick users into clicking Facebook 'like')

#31

Post by jackshepherd » Tue, Mar 06, 2012, 9:49 PM UTC

chc wrote: post #27

For everyone talking about JavaScript: As far as I can tell, this is fundamentally a CSS vulnerability. Something quite similar ought to be possible without JavaScript — it would just be a bit less elegant. For example, you could just make a pixel grid of divs to simulate mousemove events and position the fake cursor with CSS hover styles.

Actually just CSS won't work in this case - because the Facebook Like button is within an iFrame. This works because Javascript cycles show/hide a transparant div above the Like button.

Re: Cursor:none abuse (trick users into clicking Facebook 'like')

#32

Post by ck2 » Tue, Mar 06, 2012, 9:51 PM UTC

Good luck faking my inverted extra large windows cursor.

Re: Cursor:none abuse (trick users into clicking Facebook 'like')

#33

Post by chrisacky » Tue, Mar 06, 2012, 9:54 PM UTC

ck2 wrote: post #32

Good luck faking my inverted extra large windows cursor.

And I browse without JavaScript, so the CSS style that hid the cursor actually meant I didn't see any cursor whatsoever.

Re: Cursor:none abuse (trick users into clicking Facebook 'like')

#34

Post by AznHisoka » Tue, Mar 06, 2012, 9:55 PM UTC

Nice, can I use this to trick people into clicking an affiliate link instead?

Re: Cursor:none abuse (trick users into clicking Facebook 'like')

#35

Post by sikmajnd » Tue, Mar 06, 2012, 9:56 PM UTC

natmaster wrote: post #22

In Firefox, the cursor flashes above the like button. Still easy to miss, but certainly not bad as it seems Chrome is.

and not to mention the lag when going over "clicky" button in ff

Re: Cursor:none abuse (trick users into clicking Facebook 'like')

#36

Post by duopixel » Tue, Mar 06, 2012, 10:00 PM UTC

A much more straightforward abuse would be pointer-events: none. Just position an element over the 'like' button and let clicks pass through it: http://jsfiddle.net/rVxTn/

Re: Cursor:none abuse (trick users into clicking Facebook 'like')

#37

Post by smackfu » Tue, Mar 06, 2012, 10:05 PM UTC

Cursor:none makes it cleaner, but it's not necessary. You could use a lighter cursor like cursor:crosshair or cursor:text along with the fake cursor, and I bet most people will still click using the fake one.

In fact, even if you can't change the cursor at all, you could easily create a swarm of fake cursors that would frustrate the hell out of the user.

Re: Cursor:none abuse (trick users into clicking Facebook 'like')

#38

Post by rplnt » Tue, Mar 06, 2012, 10:11 PM UTC

superchink wrote: post #3

Odd effect. I see two mouse cursors (Mac OS X 10.7.3 + Chrome Dev Channel).

Same in Opera. I'd say it's not supported as it is quite malicious. Another example that comes to mind is changing the content of clipboard when users copies something. http://en.wikipedia.org/wiki/DOM_events#Microsoft-specific_e...

Re: Cursor:none abuse (trick users into clicking Facebook 'like')

#39

Post by ben0x539 » Tue, Mar 06, 2012, 10:12 PM UTC

Zirro wrote: post #13

ben0x539 wrote: post #10

Earlier quoted context omitted.

Given what we've been seeing with attack sites, whether shock sites trying to just DoS the browser or silly tricks like making the browser POST to an irc server's irc port to spread the malicious URL, or just terrible ads and tracking that actively slow down the browser and ruin the surfing experience, I'm amazed that not more people see javascript as a built-in remote code execution vulnerability that only gains mor…

"...and letting me consume videos and stuff in a trusted media player plugin." HTML5 generally solves this with and . If implemented correctly by browsers, they should not require any scripting on the site itself to work. That said, "trusted" media player plugins (think Flash) have been the targets of many successful attacks as well.

I don't want to be thinking flash :)

I'm thinking a dumb unscriptable video playback frame that draws its own controls and isn't remote-controlled by javascript.

I've seen plenty of sites that see that see I don't have javascript enabled (or unblocked) and conclude that welp, that guy probably doesn't have speakers, let's display a unhelpful message instead of embedding media content.

Of course there'll still be some attack surface just like people have been managing to exploit image decoding libraries over the years, but at least it wouldn't be engineered against usability by default.

Re: Cursor:none abuse (trick users into clicking Facebook 'like')

#40

Post by jusob » Tue, Mar 06, 2012, 10:14 PM UTC

I guess I should use this as an opportunity to remind people of the "Zscaler Likejacking Prevention" plugin for Firefox/Chrome/Safari/Opera (check the corresponding add-on stores). I use the setting "Request confirmation for all Facebook widgets" so that it asked me for confirmation before sending the Like request.