Reverse Engineering Obfuscated JavaScript

Key Takeaways

pop unders are like popups just a lot more annoying the goal is to open a popup in the background pop under the current window so that you won't see it until you want to close your browser and you don't know which site created it creating a pop under used to be fairly easy because there are actually functions called blur and focus which exists solely to focus an element with Focus or prevent focus with blur so you would blur the popup window you open and focus the current main window and that technique still works in for example Edge but Chrome will always try to focus the new window thus preventing pop unders but I did some research into this and found the demo site that actually is able to create a pop under which obviously caught my attention this guy even sells a license for JavaScript library that can create pop unders in any browser and AD networks pay good money for it so I wanted to know how this script manages to do a pop under on Chrome 59 as other libraries can't do that so I started to analyze [Music] it let's check out the demo for the pop under I clicked the link and yes indeed here is a pop under let's try to figure out how it's done obviously one of the first ideas is to look into the sources the solution should be right there but shortly after you open the developer tools a debugger statement triggers a breakpoint and you can't just continue as this is constantly called on a timer it's an anti-debugging attempt you can disable break points entirely but then that also prevents you from setting break points in the sources themselves and you may would want that for debugging so that's annoying but first let's look generally at the scripts the main page loads a loader. JS file which loads three other scripts scripts JS licensed demo JS and demo JS let's have a quick look at each of those demo JS seems to be the script a potential client would use it configures the better JS pop module and allows developers to react on before and after popup creation otherwise not much else is there the real functionality is probably in better JS pop itself license demo could be interesting in how licensing works but when you look at the code it's heavily obfuscated even if you pretty print it it's completely rubbish code and script.js which is presumably the main script looks similar there are some easy functions and nonsensical functions which you can clean up like these here just return the argument or perform simple operation but even if you clean SE that up it still looks terrible and it's long so how do we figure out what it does I will go now over the path I took but it would be awesome to hear from you how you would have approached this as I'm sure there are many different techniques to go about this and I don't know if I know them all so the first thing I did was mirror the whole site locally I didn't really test it but I assumed if they put so much effort into licensing for the mains and have a demo here that these scripts will check the domain they are loaded from and won't function properly if loaded from somewhere else so you can't simply use the demo on your site that's why I not only downloaded each file and place it in the same path but also modified Etc hosts to point the domain to Local Host this way when I visit the site again it attempts to load it from 1271 which means we can start a simple PHP or python server on Port 80 and load the side in the browser and make a small modification to the local file and remove the embedded video and image and clean up the side a bit now you can easily see that it loads this version instead of the live web version so the reason why I want a local mirror is that I have all the freedom of modifying and playing around with it but where do I really start now in theory in the end the JavaScript code will have to call the main API functions functions like Windows do open and window at timeout or like create element or a pen child but we can't easily search for this in the script as these calls are heavily offis skated but we can try to hook or proxy or intercept those calls this way we can learn more about what's happening I'm using a proxy object for this it's like a web proxy that sits between you and your destination a proxy object in JavaScript sits between the caller and the actual function Target the proxy object is used to define custom behavior for fundamental operations for example property lookup assignments eneration or function invocation so now I'm defining a Handler function that can be used to intercept and log all the function calls then I can overwrite functions I want with a proed version and because we want to learn more about popups I wanted to intercept window open which is the function to open a popup oh and I write this code before the loader loads the other scripts so it can overwrite any functions it would use I disable the break points and reload the page but when I click the link I don't see any call to open which is super weird but in the console I noticed two deprecation warnings and one of them is interesting deprecation using the notification API from an iframe is deprecated and will be removed in Chrome ver 61 around September 2017 you should consider requesting permissions from the top level frame or opening a new window instead wait that's so weird first why the heck does it call the notification API what does it have to do with the popup and what's up with the I frame I feel like this must be a key component some kind of trick to achieve a pop under hm as there are no if frames in the HTML code that see if we can hook the dynamic creation of those iframes it probably uses the create element a pen child and remove child functions to achieve that so let's proxy these as a pen child could be called on any HTML element I can use the Prototype of the general element object to overwrite the function for all elements if we reload the page now we can already see that it works with some diff but let's see what happens when we click the link all look at that it creates an iframe unfortunately we can't inspect what the iframe is for because later the I frame is removed with removed child around this time I started to get really curious about the stuff that pops up briefly so weird so I decided to record it in order to slow it down and see what happens and when you go step by step you first notice a pop-up window being open in the bottom right corner so the user might not really notice it then the notification permission request pops up and around the same time an alert box is shown with chrome PDF viewer what the [ __ ] and then they disappear again what the heck is going on at this point I realized what seems to be the basic idea behind all of this to create a pop under you somehow want to get the main window back in focus and it looks like with this weird combination of notification requests and alert box you can get back the focus of the main window knowing this let's move on with some debugging the removed child prevents us from inspecting the iframe as it's gone by that point so instead of calling remove child let's overwrite it with a custom function we could use the proxy object and not call the original function but I just wanted to show another method how you can change the behavior of something a proxy object is cleaner but this works also well so now instead of removing an element we log the element it tried to remove and let's try it again and it looks like that remove child was necessary to remove the notification permission request and the alert box because they stay now here but we can also look now into the iframe HM it basically just defines a function mkp which calls window.open that's the trick used why we couldn't proxy window open because here they will dynamically create an iframe and use its clean new default window open function Instead This Is Not Meant to throw off analysis it's actually a simple pop-up blocker bypass some basic blockers simply override window open like I attempted to do and with this trick you can get back the original window open function so it's just a bypass for simple popup blockers you can also check that window mkp which I guess stands for make popup exists here in our Global scope pointing at window open so clever but let's move on because a few steps later there is a second if frame created and if we look into that one we see that it executes a script that requests notification permissions so that's why we get the dication warning here not sure yet why notification permissions are requested but now we know when and where they do it at this point I felt I understand what was going on more and more and I started playing around with this knowled myself doing Simple tests I first opened a new window and then caused a notification permission request and as it turns out with the notification request Chrome focuses the main window again but once the user clicks the Box away the focus goes back to the other window and two things to observe here first we get Focus off the main window which is exactly what we want question is just how to keep it second problem how do you remove the notification request again automatically both shouldn't be really possible but we know that remove child with an if frame could be the solution so we can try that first we create the iframe and append it to the Dom then we execute the JavaScript in the iframe and after that use a timeout to wait 3 seconds and remove it again and testing that shows that it works but what's up with the PDF message we see when you think about it it kind of looks like an alert box so let's play a bit more with our test and remove the iframe with the notification for now and instead call alert and we get the same behavior the main window gains Focus because of the alert but as soon as the user clicks it away focus is restored to the popup unfortunately a simple I frame won't help here to remove the alert box because alert blocks and pauses everything but anyway we can try to combine these two now like we saw in the slowed down video and so we trigger the notification permission request then we wait a bit with the set time out and trigger an alert and then we wait a bit longer and remove the notification again let's run it and when we now close the alert by hand and the notification request is automatically removed surprisingly the popup window stays in the background the main window is C kept in Focus so last question is how do they now remove the alert box automatically it looks like the alert is triggered from the PDF viewer it said please wait so I assume maybe it happens if you load a huge PDF or so I did some tests but it didn't work out I also couldn't find useful information about the waiting dialogue online so I decided to take a step back and analyze the demo further and besides the ey frames there is another element created an embedded object that defines a data URI of the media type PDF and basic C4 en coding so we can decode that and find the raw PDF file which contains a Javascript app alert please wait ah so it also calls alert just from a PDF and that's the trick because that alert box can be closed again by removing the embedded PDF from the Dom to not steal anybody else's code we can also create our own minimal PDF that cause alert and convert it to Bas 64 now everything falls into place we first open a new window then dynamically embed a PDF with an app alert and create an iframe that requests notification permissions and after a short moment we then remove the iframe and the embedded PDF again and that's it if it doesn't work then maybe you have the timing wrong it's not 100% reliable but wow we created a pop under wasn't this interesting hopefully Chrome will fix this so I don't have to experience these annoying pop unders [Music] [Applause] [Music] anymore