Prevent Browser Hijacking

March 8, 2008 – 3:10 PM

Mike Healan
March 23, 2004

If you’ve ever been infected with a browser hijacker, you know what an infuriating situation it is. For all intents and purposes, your $3,000 computer is converted into a source of revenue for some fly-by-night web site unable to generate legitimate web traffic. Once installed, it usually takes an expert to remove a browser hijacker effectively.

If you’ve gone through this before, you never, ever want it to happen again. So, how do you prevent being hijacked? This is surprisingly easy.

Dump MSIE

First and most simply, stop using Internet Explorer. If you use either Mozilla, Firefox or Opera, you are immune to all known and future browser hijackers.

You are immune not because current hijackers are written to exploit Internet Explorer. It is because these other browsers do not allow access to Windows the way Internet Explorer does. MSIE has all sorts of security flaws that allow malicious web sites to slip past security and run arbitrary code. This is what happened to you if you’ve ever been infected with a hijacker.

The other browsers have their flaws but even if someone did manage to compromise them, what could they do then? The answer is: “not much”. The Mozilla and Opera browsers are user-level applications; they have very limited access to Windows. At most, they might delete some of their own files and force you to reinstall them.

Apply the same question to Internet Explorer and you can do just about anything you want. Microsoft has integrated Internet Explorer as part of Windows. Because of this, Internet Explorer is a system-level application and can do just about anything.

If you have to use MSIE

Switching browsers is the easy answer. For some people, that is not an option for various reasons. Internet Explorer can be made reasonably safe without locking down every useful function, but it requires some third-party software.

The most important thing is to update your browser and operating system. Go to WindowsUpdates and install the latest version of Internet Explorer (currently MSIE 6 Service Pack 1), then go back and install any security patches that are available. Also install any service packs and patches for Windows itself. This one action will save you from the overwhelming majority of browser hijackers.

After you’ve done that, replace Microsoft Java VM with Sun Java. You can download that from http://www.java.com/. There are several hijackers that exploit flaws in Microsoft Java VM. Sun’s Java is more secure and more up to date. Make certain, in Java’s options, that Sun Java JRE is set to work with Internet Explorer.

Open Internet Options from the Windows control panel and click the “Security” tab. Highlight the “Internet” icon and then click “Custom Level”. Choose “Medium” from the drop-down box at the bottom, then click the “Reset” button. Click ok, then click “Custom Level” again.

Set your options just as I have listed below:

.NET Framework-reliant components

• Run components not signed with Authenticode (Disable)
• Run components signed with Authenticode (Prompt)

ActiveX controls and plug-ins

• Download signed ActiveX controls (Prompt)
• Download unsigned ActiveX controls (Disable)
• Initialize and script ActiveX controls not marked as safe (Disable)
• Run ActiveX controls and plug-ins (Enabled) (This actually refers to Java and Flash, not ActiveX)
• Script ActiveX controls marked safe for scripting (Prompt)

Miscellaneous

• Access data sources across domains (Disable)
• Drag and drop or copy and paste files (Prompt)
• Installation of desktop items (Prompt)
• Launching programs and files in an IFRAME (Prompt)
• Navigate sub-frames across different domains (Prompt)
• Software channel permissions (High safety)
• Userdata persistance (Disable)

Scripting

• Allow paste operations via script (Prompt)
• Scripting of Java applets (Prompt)

Next, you need to run a registry script called IE-SPYADS. This script will place an enormous number of web sites known to be abusive into Internet Explorer’s “Restricted Zone”. Any site in that list will be unable to run javascripts, java applets, set or read cookies or use ActiveX scripting. You still will be able to visit those sites but they will be very limited in what they can do.

Be aware that MSIE has many security flaws that will allow a clever site designer to bypass security settings, even if their site is in the restricted zone. More must still be done.

Now you need to install SpywareBlaster. ActiveX programs need to use a CLSID (identifier number) before Windows will execute them. SpywareBlaster stops certain ActiveX CLSIDs from working by setting a “kill bit” in the Windows registry. This will stop ActiveX drive-by installations from programs that use those numbers, as well as preventing software already installed from running if they use that CLSID.

As a final safeguard, install a program called Browser Hijack Blaster. This program will watch for alterations to the home page, default page and search page as well as watching for Browser Helper Objects being installed. If it detects a change, it immediately will pop up a warning and ask if you wish to allow the change.

Be very careful about installing programs. By far the most common source of malware infection comes from third party bundles. Grokster, for instance, will install a dozen or more unwanted programs.

Finally, you also should disable the preview pane if you use Outlook or Outlook Express. Simply by highlighting an email while the preview pane is active, even to delete it, you could activate any scripting in that email. Visit TomCoyote’s site for instructions on doing that.

Follow the steps above and it will be very unlikely that you ever will be hijacked again. Periodically scan your system with antispyware and antivirus software. I recommend Spybot S&D for antispyware and Nod32 for antivirus.