[Steve]

Hi all,

I'm making this thread to serve as a reminder to the community (especially newer or less technically inclined users) that, although userscripts can be useful and a great way to learn about/practice coding, they can also be used maliciously to manipulate those who have installed them.

Userscripts and Extensions are very popular on Hack Forums, but members should be aware just how much control you are giving the author of the script over your account. When you install a userscript or extension, the script can perform nearly any process that the user has access to. These could be functions for giving reputation, sending PMs, making posts/threads, etc. These events can target any member the author wants and can be triggered by something as simple as a page request.

When installing a userscript I strongly advise you personally look through the code for anything malicious. If you can't read the code, then find someone trustworthy who can check it for you. You also should disable auto-updates for your scripts, so that the the author cannot push malicious code without you noticing.

I've prepared a small proof of concept script called MyRAT to test some basic functions a userscript can do. Below I've posted the userscript code. This is code that you could see in any basic userscript. I will explain what each of the functions does, but I will not be posting the code that sets up and handles the malicious server/functions, of course.

MyRAT Userscript Source

MyRAT opens a socket connection with a server that allows real-time communication between the client and the malicious server. There are 3 functions in the userscript. The names of the functions give away that this is probably not a script that someone would want, but keep in mind that the author can give the functions misleading names in order to hide malicious code. Here are what these functions do:

1) changeUsertitle changes the users usertitle to any usertitle defined by the userscript.
2) sendPM makes the userscript user send a PM to any member with any subject and message.
3) giveRep makes the userscript user give any member any rep within the userscript user's power.

You can imagine how functions like these can maliciously be used - especially when there are hundreds of users who have the userscript installed.

Suppose you install a large userscript with dozens of features. The author of the script could easily bury malicious code within any of the functions and do pretty much anything with your account, because when you install a userscript you give the script the ability to do an action defined by author at a time defined by the author.

I've also prepared a graphic to help understand the flow of data in the order given by the arrows:
Spoiler (Click to View)

Userscripts can add extra desirable, customizable features for users, but they come with their fair share of risks. Poorly coded userscripts can break normal site functions, and malicious userscripts can manipulate your account. I hope that all members proceed with caution when installing userscripts.

[Xerotic]

Very informational thread, Steve. Great job on always trying to keep HF safe.

[Pronouncer]

Very nice to see this, was a interesting read

[Almonds]

Well done, Steve.

Indeed something to keep in mind.

[Crystallize.]

You never cease to amaze me haha.Good job man writing this up.👍

[Woods]

Thanks for the post man, one of the few concerns I have for using user scripts.

[Bluffer]

Great thread Steve, I'm glad you care about the community enough to bring this to attention.

Lately I've been getting a lot of 405 errors and I remember reading quite some time ago that if you have too many tabs open on HF or you are sending too many requests, this might happen. I've never changed my browsing habits on HF but only recently have started getting these pages which aren't much of an issue to me since all it takes is a quick refresh and everything is fine.

Adam's HFX userscript is the only one I have, it has all the great features one requires that Omni and Xerotic don't have the time to code into vanilla HF. I hope it has no malicious code in it but don't have the knowledge to check. I trust that there are so many users who use it that somebody would've found some malicious code by now if it existed.

[Crystallize.]

Great thread Steve, I'm glad you care about the community enough to bring this to attention.

Lately I've been getting a lot of 405 errors and I remember reading quite some time ago that if you have too many tabs open on HF or you are sending too many requests, this might happen. I've never changed my browsing habits on HF but only recently have started getting these pages which aren't much of an issue to me since all it takes is a quick refresh and everything is fine.

Adam's HFX userscript is the only one I have, it has all the great features one requires that Omni and Xerotic don't have the time to code into vanilla HF. I hope it has no malicious code in it but don't have the knowledge to check. I trust that there are so many users who use it that somebody would've found some malicious code by now if it existed.

Those warnings are normal if you do more than 3req/sec.Happens to me all the time when im on pc and open multiple tabs.

[Bluffer]

Those warnings are normal if you do more than 3req/sec.Happens to me all the time when im on pc and open multiple tabs.

I know they can be but its strange how I never got them before and I've always done the same thing... multiple tabs. Hell sometimes I have HF open on two different monitors, I dont even know why.

[Xerotic]

I know they can be but its strange how I never got them before and I've always done the same thing... multiple tabs. Hell sometimes I have HF open on two different monitors, I dont even know why.

Consider the following...

You use the feature in xadamxk’s script that hides your online location. That works by sending a page request every single time you visit an HF page to https://hackforums.net/misc.php

So every page you load on HF you are actually sending TWO page requests. Increasing server load and triggering firewall defenses because of the multiple rapid requests.

[DerJager]

I know they can be but its strange how I never got them before and I've always done the same thing... multiple tabs. Hell sometimes I have HF open on two different monitors, I dont even know why.

same, i have 8 tabs open rn of just random shit. i dont understand why people find the need to install scripts/extensions such as the ones mentioned

[Bluffer]

some, i have 8 tabs open rn of just random shit. i dont understand why people find the need to install scripts/extensions such as the ones mentioned

I've been super active on HF a few years now. The only one I find completely necessary is HFX and it's developed by a very trusted member so I don't think there's any risk in it.

Before, the "cite" feature was practically my only use for it, now I like everything.

[Eagle 95]

Thanks for alerting the members about it mister. :)

[CYB3RM4N]

I've been super active on HF a few years now. The only one I find completely necessary is HFX and it's developed by a very trusted member so I don't think there's any risk in it.

Before, the "cite" feature was practically my only use for it, now I like everything.

The "Quick PM" function is also super useful.

[Esteban]

..

thank you, i just far away from installing xadamkxs user script.