last day (14 days later) » 

1:21 AM
-1
Q: Weird youtube js api code

PaulEcouple of day ago, i found a javascript injected in my website. It was obscure. i find a way to deobscure but im not that good in javascript so i can't understand what it does You can find the code here https://pastebin.com/pMRWXy3F as i can't paste it all on here but as those line indicate: ...

 
...what exactly is your question? From what I can tell, you're trying to figure out if this is malicious code, but I'm not really sure what the problem is here.
 
@PatrickRoberts i want to figure out what is the code job! Thats it! I dont know where to find someone to help me so i posted it here
 
http://jacker.io/v/a96f142b3d18d1d252ae8bf3a8696280/?r= where r contains location.host on your website without the port, reversed, might contain more information.
 
yap i found out open this.. and i tried it on my website.. its returning alert newsletter expired or something like this
this how i found out about it.. when i get the alert when i access my website! What is the job of the user functions in the code @PatrickRoberts? Got any idea?
 
Well, whatever you copied for var32 is invalid.
 
1:21 AM
yeah i base64 decode it its a style! i guess it brings something from the html from jacker or something. Do u think its a clickjacking attack or what? @PatrickRoberts
Hey @PatrickRoberts
 
I'm going to need you to re-copy what var32 is because what you have it as in the pastebin is an invalid base64 encoded string
 
 
It looks like the job of this script is to create a fake "subscribe to our newsletter" form that appears to be a legitimate google endorsed form, but it's not
 
so what about the youtube api
with this video id : youtube.com/watch?v=MICqMbgG7eQ
MICqMbgG7eQ
 
The video has no significance, but notice that this script is kick-started when the window's global onYoutubeIframeAPIReady callback is executed, it invokes function5()
 
1:31 AM
yap
i guess he is using it to gain youtube subscriber
 
I don't know if that channel has anything to do with this script necessarily
 
yap
i googled his channel
thats what i found
the video is unlisted but its on a cached hackforum post
i guess thats it
but is this possible?
 
okay, yeah you might be right. Would you mind sharing the link to the page on your website that contained this exploit?
 
it was on here exactlycheckme.com
the website from the video : tdeveloper.cba.pl
 
oh, that X icon in the video... notice the decoded CSS from the base64 string contains a background-image with a base64 encoded source for that same icon under the #ythj-x-o CSS selector
 
1:41 AM
yeah so what is he doing exactly
how he is making anyone clicking on the X subscribing to his channel?
 
hijacking a user-generated click event and using it as verification for subscribing to a youtube channel
I don't know, exactly.
 
wowwwwwwwwwwww
you dont need to confirm/verify the subscribe
just hover over the channel profile pic and click subscribe
you subscribe to the channel without the confirm dialog
but u have to hover over the channel profile pic in the video frame so the subscribe button appear
can it be done using javascript?
 
yeah, so that explains the iframe. They probably move the loaded iframe exactly to where the click event happens so that it intercepts the click event
 
yeah got it!
but how he can put the move over the channel picture in the iframe?then when the user click it clicks the subscribe button?
 
2:13 AM
let me know if you are interested!
 

last day (14 days later) »