Author Topic: False positive (again) : URL:Malvertising on LCL bank account  (Read 1150 times)

0 Members and 1 Guest are viewing this topic.

Offline chris...

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3041
A week ago, LCL bank customers received a warning from avast about a threat on hxxps://monespace.lcl.fr/connexion
https://forum.avast.com/index.php?topic=327981.0
Two days later (after filling in the false positive form), the vps were updated and the problem disappeared.
One week later the problem reappears, obviously still a false positive:
https://www.virustotal.com/gui/url/9d8183785a4ac8acda69c33bef22c62e23687e1b4272a89c65972233b24e0fe0/detection

Could Avast pay attention so that the problem doesn't become a recurring one?

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 34049
  • malware fighter
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 34049
  • malware fighter
Re: False positive (again) : URL:Malvertising on LCL bank account
« Reply #2 on: July 14, 2024, 05:28:37 PM »
This is not security-related as such, but these improvements could be used for this website:
In case of
Deprecated feature used
Unload event listeners are deprecated and will be removed.
1 source
ruxitagentjs_ICA2NVfqru_10285240307101407.js:15
Learn more: Check the feature status page for more details.
Page layout may be unexpected due to Quirks Mode

It looks like you're getting a warning message from the Ruxit agent.
which is a monitoring tool used by Dynatrace.

The message is indicating that the unload event listener is deprecated and will be removed.
This is likely due to a change in the browser's behaviour or a deprecation of the unload event
in modern browsers.

The unload event is fired when the user navigates away from a page, closes the browser window,
or reloads the page.
However, this event is not always reliable, as some browsers may not fire it consistently.

To mitigate this issue, you can consider using alternative approaches to handle page unload events.
such as:

Using the beforeunload event instead, which is fired before the page is unloaded,.
Using a timer to detect when the page is being navigated away from.
Implementing a solution that doesn't rely on the unload event at all.

Regarding the "Page layout may be unexpected due to Quirks Mode" message,
It's likely related to the browser's rendering mode being set to Quirks Mode.
Quirks Mode is an older rendering mode that simulates the behaviour of older browsers.
but it can cause layout issues and compatibility problems.

To resolve this issue, you can try updating your HTML document type declaration
to use a more modern rendering mode,
such as <html xmlns="http://www.w3.org/1999/xhtml"> or <html lang="en">.

This should help the browser render your page correctly and avoid Quirks Mode.

polonus (best policy information aided by A.I. reportingon dynatrace)
« Last Edit: July 14, 2024, 05:30:46 PM by polonus »
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline chris...

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3041
Re: False positive (again) : URL:Malvertising on LCL bank account
« Reply #3 on: July 15, 2024, 07:57:57 PM »
False-positive treated, no more alerts with VPS 240715-6
Here's hoping there won't be a third blockage next weekend

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 34049
  • malware fighter
Re: False positive (again) : URL:Malvertising on LCL bank account
« Reply #4 on: July 16, 2024, 10:31:05 AM »
See scan results here: https://quttera.com/detailed_report/monespace.lcl.fr

No malicious content was detected. But be aware of
Blacklisted External Links
htxps://cdn.trustcommander.net/privacy/344/privacy_v2_26.js
Re: https://www.virustotal.com/gui/url/3b0e0c9851ff69631fc679b1ec799ae944221c2a660982dec089bfe193bbbeca?nocache=1

So that might have been the culprit for earlier detections/FPs.

polonus
« Last Edit: July 16, 2024, 10:35:44 AM by polonus »
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 34049
  • malware fighter
Re: False positive (again) : URL:Malvertising on LCL bank account
« Reply #5 on: July 16, 2024, 11:19:02 AM »
Additionally, on the code of this link (parked),
htxps://cdn.trustcommander.net/privacy/344/privacy_v2_26.js

This code is a JavaScript file that appears to be part of a tag management system, likely used for tracking and managing user consent for targeted advertising. Here are some potential issues or red flags:

Untrusted domains: The code is loading scripts from multiple domains, including tagcommander.com and manager. (with a trailing dot). This could be a potential security risk if these domains are not trusted.
Overly broad permissions: The code grants itself permission to access a wide range of resources, including cookies, local storage, and the ability to send requests to third-party servers.
Privacy concerns: The code appears to be collecting and storing user data, including consent information, cookie data, and potentially sensitive information like IP addresses.
Unclear purpose: The code is not transparent about its purpose or how it intends to use the collected data. This lack of transparency could raise privacy concerns.
Unusual formatting: The code uses an unusual formatting style, with many consecutive lines of code separated by semicolons. This could make it harder to read and maintain.
Unnecessary dependencies: The code includes several dependencies that may not be necessary for the functionality of the script.
Potential vulnerabilities: The code may contain potential vulnerabilities, such as cross-site scripting (XSS) or cross-site request forgery (CSRF), due to its ability to manipulate the DOM and send requests to third-party servers. Open to SQL injection vulnerability.
Furthermore, outdated plug-ins were detected on the system, including WordPress, Joomla, and Adobe Flash Player.

polonus (aided by AI)
« Last Edit: July 16, 2024, 11:25:18 AM by polonus »
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline chris...

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3041
Re: False positive (again) : URL:Malvertising on LCL bank account
« Reply #6 on: July 16, 2024, 01:47:59 PM »
When opening the main link of the LCL account, avast blocked (this weekend and the one before) the connection to "static.tech.lcl" (see my initial screenshot) and not to "cdn.trustcommander.net".

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 34049
  • malware fighter
Re: False positive (again) : URL:Malvertising on LCL bank account
« Reply #7 on: July 16, 2024, 01:55:11 PM »
Is not flagged any longer as the site kicks up a 404: https://sitecheck.sucuri.net/results/https/static.tech.lcl.fr
The other flagged site does not respond either; DNS cannot be reached.

polonus
« Last Edit: July 16, 2024, 02:02:08 PM by polonus »
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!