Textual Pornography : They Have the Internet on Phones Now?

So, at about 4:30 AM last night, while very slowly working on an archaeology paper, I glanced over to the phone and noticed something interesting: it was displaying an HTML document. Now, of course, cell phones have had the capability to connect to the internet for ages, so this might seem like nothing noteworthy. However, there are two things that make this worth mentioning:

Normally, cell phones tend to render the page before displaying it, but this was the full page source, starting with the DOCTYPE.
I don’t have a cell phone. This page was displaying on the dorm-issue Cisco 7940 Series IP phone.

I was staring at for what all intents and purposes appeared to be a web page that my phone had attempted to access. I scanned the page, and it appeared to be a fairly standard 404 page, albeit with some extensive JavaScript. So, I did the first thing that came to mind: I took pictures so that I could share it across the internet.

doctype
Here’s your doctype. HTML 3.2 is so passé.

CSS
There’s some CSS for you.

And some nondescript JavaScript.

table
Mmm, now we’re getting into the meaty stuff, tables.

content
Actual content! Praise the Lord!

I tried to take a movie of the whole document, but since I only have a digital camera with a terrible focal length in movie mode, it turned out to be other garbage. Instead, here’s the code, hastily transcribed (with probably copying errors):

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<html dir=ltr>

<head>
<style>
a:link {font:8pt/11pt verdana; color=FF0000}
a:visited {font:8pt/11pt verdana; color=#4e4e4e}
</style>

<META NAME="ROBOTS" CONTENT="NOINDEX">

<title>The page cannot be displayed</title>

<META HTTP-EQUIV="Content-Type" Content="text-html; charset=Windows-1252">
</head>

<script>
function HomePage(){
<!--
// in real bits, urls get returned to our script like this:
// res://shdocvw.dll/http_404.htm#http://www.DocURL.com/bar.htm

 //For testing use DocUrl = "res://shdcovw.dll/http_404.htm#https://www.microsoft.com/bar.htm"
 DocURL=document.URL;

 //this is where the http or https will be, as found by searching for :// but skipping the res://
protocolIndex=DocURL.indexOf("://",4);

 // this finds the ending slash for the domain server
serverIndex=DocURL.indexOf("/",protocolIndex+ 3);

 // for the href, we need a valid URL to the domain. We search for the # symbol to find the beginning
 //of the true URL, and add 1 to skip it - this is the BeginURL value. We use serverIndex as the end marker.
//urlresult=DocURL.substring(protocolIndex-4,serverIndex);
BeginURL=DocURL.indexOf("#",1)+1;
urlresult=DocURL.substring(BeginURL,serverIndex);

 //for display, we need to skip after http://, and go to the next slash
displayresult=DocURL.substring(protocolIndex + 3,serverIndex);
InsertElementAnchor(urlresult, displayresult);
}

function HtmlEncode(text)
{
    return text.replace(/&/g, '&amp').replace(/'/g, '&quot;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
}

function TagAttrib(name, value)
{
    return ''+name+'="'+HtmlEncode(value)+'"';

}

function PrintTag(tagName, needCloseTag, attrib, inner){
    document.write('<' + tagName + attrib + '>' + HtmlEncode(inner) );
    if (needCloseTag) document.write('</' + tagName +'>');
}

function URI(href)
{
    IEVer = window.navigator.appVersion;
    IEVer = IEVer.substr(IEVer.indexOf('MSIE') + 5, 3);

    return (IEVer.charAt(1)=='.' && IEVer >= '5.5') ?
        encodeURI(href) :

escape(href).replace(/%3A/g, ':').replace(/%3B/g,';');
}

function InsertElementAnchor(href, text)
{
    PrintTag('A', true, TagAttrib('HREF', URI(href)), text);
}

//-->
</script>

<body bgcolor="FFFFFF">

<table width="410" cellpadding="3" cellspacing="5">

    <tr>
        <td align="left" "valign="middle" width="360">
    <h1 style="COLOR:000000; FONT: 13pt/15pt verdana"><!--Problem-->The page cannot be displayed</h1>
        </td>
    </tr>

    <tr>
        <td width="400" colspan="2">
    <font style="COLOR:000000; FONT: 8pt/11pt verdana">There is a problem with the page you are trying to reach and it cannot be
displayed.</font></td>
    </tr>

    <tr>
        <td width="400" colspan="2">
    <font style="COLOR:000000; FONT: 8pt/11pt verdana">

    <hr color="#C0C0C0" noshade>

    <p>Please try the following:</p>

    <ul>
        <li>Open the

    <script>
    <!--
    if (!((window.navigator.userAgent. indexOf("MSIE") > 0) && (window.navigator.appVersion.charAt(0) == "2")))
    {
    Homepage();
    }
    //-->
    </script>

    home page, and the look for links to the information you want.</li>

    <li>Click the <a href="javascript:location.reload()">

Now, some things should be pretty obvious:

It’s not the whole code. Clearly the buffer could only hold so much of the page data.
It shows evidence of being rewritten or copied from more than one source. The best place to notice this is the difference in styles of hexadecimal color values (in the CSS declarations at the top, compare “color=FF0000” with “color=#4e4e4e”).
It’s an internal Windows document. Notice the reference in the comments of the HomePage function to “shdcovw.dll.”

It turns out that you can actually exploit this DLL (or could as of 2003, anyway), but that’s beside the point. The article also explains the purpose of the document; it’s an internal resource file used by Internet Explorer to handle 404 errors. Which leads to the following question:

Why is my phone trying to use Internet Explorer?

Textual Pornography

They Have the Internet on Phones Now?

{ 1 } Comments

Post a Comment

Links

Meta

Categories

Archives