Mousetrapping

Last updated

Mousetrapping is a technique that prevents users from exiting a website through standard means. It is frequently used by malicious websites, and is often seen on tech support scam sites. [1] [2]

Contents

Mousetrapping can be executed through various means. A website may launch an endless series of pop-up ads or redirects; it may re-launch the website in a window that cannot be easily closed. Sometimes these windows run like stand-alone applications and cause the taskbar and browser menu to become inaccessible. Some websites also employ browser hijackers to reset the user's homepage. [3]

Legality

The Federal Trade Commission has brought suits against mousetrappers, charging that the practice is a deceptive and unfair competitive practice, in violation of section 5 of the FTC Act. [4] Typically, mousetrappers register URLs with misspelled names of celebrities (e.g. BrittnaySpears.com) or companies (e.g. BettyCroker.com and WallStreetJournel.com). [5] Thus, if someone seeking the BettyCrocker website typed BettyCroker, the user would become ensnared in the mousetrapper's system. Once the viewer is at the site, a Javascript or a click induced by, as one example, promises of free samples, redirects the viewer to a URL and regular site of the mousetrapper's client-advertiser, who (the FTC said in the Zuccarini case) pays 10 to 25 cents for capturing and redirecting each potential customer. An FTC press release explaining why the agency opposes mousetrapping states:

Schemes that capture consumers and hold them at sites against their will while exposing Internet users, including children, to solicitations for gambling, psychics, lotteries, and pornography must be stopped.

Timothy J. Muris, Chairman of the FTC [6]

See also

Related Research Articles

Spyware is any software with malicious behavior that aims to gather information about a person or organization and send it to another entity in a way that harms the user by violating their privacy, endangering their device's security, or other means. This behavior may be present in malware and in legitimate software. Websites may engage in spyware behaviors like web tracking. Hardware devices may also be affected.

<span class="mw-page-title-main">Hyperlink</span> Method of referencing visual computer data

In computing, a hyperlink, or simply a link, is a digital reference to data that the user can follow or be guided to by clicking or tapping. A hyperlink points to a whole document or to a specific element within a document. Hypertext is text with hyperlinks. The text that is linked from is known as anchor text. A software system that is used for viewing and creating hypertext is a hypertext system, and to create a hyperlink is to hyperlink. A user following hyperlinks is said to navigate or browse the hypertext.

Pop-up ads or pop-ups are forms of online advertising on the World Wide Web. A pop-up is a graphical user interface (GUI) display area, usually a small window, that suddenly appears in the foreground of the visual interface. The pop-up window containing an advertisement is usually generated by JavaScript that uses cross-site scripting (XSS), sometimes with a secondary payload that uses Adobe Flash. They can also be generated by other vulnerabilities/security holes in browser security.

URL redirection, also called URL forwarding, is a World Wide Web technique for making a web page available under more than one URL address. When a web browser attempts to open a URL that has been redirected, a page with a different URL is opened. Similarly, domain redirection or domain forwarding is when all pages in a URL domain are redirected to a different domain, as when wikipedia.com and wikipedia.net are automatically redirected to wikipedia.org.

<span class="mw-page-title-main">Toolbar</span> Element of computer graphical interfaces

The toolbar, also called a bar or standard toolbar, is a graphical control element on which on-screen icons can be used. A toolbar often allows for quick access to functions that are commonly used in the program. Some examples of functions a toolbar might have are open file, save, and change font. Toolbars are usually distinguished from palettes by their integration into the edges of the screen or of other windows. This can result in wasted space if multiple underpopulated bars are stacked atop each other or interface inefficiency if overloaded bars are placed on small windows.

<span class="mw-page-title-main">Browser Helper Object</span> Plug-in module for Internet Explorer

A Browser Helper Object (BHO) is a DLL module designed as a plugin for the Microsoft Internet Explorer web browser to provide added functionality. BHOs were introduced in October 1997 with the release of version 4 of Internet Explorer. Most BHOs are loaded once by each new instance of Internet Explorer. However, in the case of Windows Explorer, a new instance is launched for each window.

Scareware is a form of malware which uses social engineering to cause shock, anxiety, or the perception of a threat in order to manipulate users into buying unwanted software. Scareware is part of a class of malicious software that includes rogue security software, ransomware and other scam software that tricks users into believing their computer is infected with a virus, then suggests that they download and pay for fake antivirus software to remove it. Usually the virus is fictional and the software is non-functional or malware itself. According to the Anti-Phishing Working Group, the number of scareware packages in circulation rose from 2,850 to 9,287 in the second half of 2008. In the first half of 2009, the APWG identified a 585% increase in scareware programs.

Meta refresh is a method of instructing a web browser to automatically refresh the current web page or frame after a given time interval, using an HTML meta element with the http-equiv parameter set to "refresh" and a content parameter giving the time interval in seconds. It is also possible to instruct the browser to fetch a different URL when the page is refreshed, by including the alternative URL in the content parameter. By setting the refresh time interval to zero, meta refresh can be used as a method of URL redirection.

Browser hijacking is a form of unwanted software that modifies a web browser's settings without a user's permission, to inject unwanted advertising into the user's browser. A browser hijacker may replace the existing home page, error page, or search engine with its own. These are generally used to force hits to a particular website, increasing its advertising revenue.

A spoofed URL involves one website masquerading as another, often leveraging vulnerabilities in web browser technology to facilitate a malicious computer attack. These attacks are particularly effective against computers that lack up-to- security patches. Alternatively, some spoofed URLs are crafted for satirical purposes.

<span class="mw-page-title-main">Zango (company)</span>

Zango,, formerly ePIPO, 180solutions and Hotbar, was a software company that provided users access to its partners' videos, games, tools and utilities in exchange for viewing targeted advertising placed on their computers. Zango software is listed as adware by Symantec, and is also labeled as a potentially unwanted program by McAfee. Zango was co-founded by two brothers: Keith Smith, who served as the CEO; and Ken Smith, who served as the CTO.

Christopher Boyd, also known by his online pseudonym Paperghost, is a computer security researcher.

<span class="mw-page-title-main">VirusTotal</span> Cybersecurity website owned by Chronicle

VirusTotal is a website created by the Spanish security company Hispasec Sistemas. Launched in June 2004, it was acquired by Google in September 2012. The company's ownership switched in January 2018 to Chronicle, a subsidiary of Google.

Typosquatting, also called URL hijacking, a sting site, a cousin domain, or a fake URL, is a form of cybersquatting, and possibly brandjacking which relies on mistakes such as typos made by Internet users when inputting a website address into a web browser. Should a user accidentally enter an incorrect website address, they may be led to any URL.

<span class="mw-page-title-main">Malwarebytes</span> Internet security company

Malwarebytes Inc. is an American Internet security company that specializes in protecting home computers, smartphones, and companies from malware and other threats. It has offices in Santa Clara, California; Clearwater, Florida; Tallinn, Estonia; Bastia Umbra, Italy; and Cork, Ireland.

<span class="mw-page-title-main">Malvertising</span> Use of online advertisement or advertising to spread malware

Malvertising is the use of online advertising to spread malware. It typically involves injecting malicious or malware-laden advertisements into legitimate online advertising networks and webpages. Because advertising content can be inserted into high-profile and reputable websites, malvertising provides malefactors an opportunity to push their attacks to web users who might not otherwise see the ads, due to firewalls, more safety precautions, or the like. Malvertising is "attractive to attackers because they 'can be easily spread across a large number of legitimate websites without directly compromising those websites'."

SmartScreen is a cloud-based anti-phishing and anti-malware component included in several Microsoft products, including operating systems Windows 8 and later, the applications Internet Explorer, Microsoft Edge. SmartScreen intelligence is also used in the backend of Microsoft's online services such as the web app Outlook.com and Microsoft Bing search engine.

Hotspot Shield is a public VPN service operated by AnchorFree, Inc. Hotspot Shield was used to bypass government censorship during the Arab Spring protests in Egypt, Tunisia, and Libya.

<span class="mw-page-title-main">Technical support scam</span> Type of fraud and confidence trick

A technical support scam, or tech support scam, is a type of fraud in which a scammer claims to offer a legitimate technical support service. Victims contact scammers in a variety of ways, often through fake pop-ups resembling error messages or via fake "help lines" advertised on websites owned by the scammers. Technical support scammers use social engineering and a variety of confidence tricks to persuade their victim of the presence of problems on their computer or mobile device, such as a malware infection, when there are no issues with the victim's device. The scammer will then persuade the victim to pay to fix the fictitious "problems" that they claim to have found. Payment is made to the scammer through ways which are hard to trace and have fewer consumer protections in place which could allow the victim to claim their money back, usually through gift cards.

References

  1. "Partnerstroka: Large tech support scam operation features latest browser locker - Malwarebytes Labs | Malwarebytes Labs". blog.malwarebytes.com. 2018-09-13. Retrieved 28 August 2019.
  2. Afolabi, Oluwademilade (2023-01-21). "What Is Mousetrapping and How Do You Break Free?". MUO. Retrieved 2023-12-27.
  3. Other definitions of 'mousetrapping' and related practices are found at Mousetrapping and Pagejacking.
  4. See, for example, the FTC's complaint against John Zuccarini.
  5. A catalog of examples of URLs that one mousetrapper registered, which then became involved in ICANN Uniform Domain Name Dispute Resolution proceedings, is available here.
  6. FTC press release