15

I've getting lots of 404 errors from crossdomain.xml. Here are the request details, as provided by Google App Engine:

404 22ms 19cpu_ms 0kb Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.30 (KHTML, like Gecko) Chrome/12.0.742.122 Safari/534.30
69.130.*.* - - [24/Jul/2011:07:43:42 -0700] "GET /crossdomain.xml HTTP/1.1" 404 124 "http://s.nsdsvc.com/App/DddWrapper.swf?c=3" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.30 (KHTML, like Gecko) Chrome/12.0.742.122 Safari/534.30" "app.*.*.*" ms=22 cpu_ms=19 api_cpu_ms=0 cpm_usd=0.000633 instance=00c61b117c557326bef77d341a345431e66b

I'm not sure what is going on. Can anyone help me solve this issue?

5 Answers 5

10

I also was finding these references in my logs.

This seems to be related to a service called "Drop Down Deals", that involves a browser add-on that seems, well, broken.

http://www.dropdowndeals.com/

https://nodpi.org/forum/index.php?topic=3462.0;wap2

5
  • This looks like it. I'll add a crossdomain.xml file that stops all access, hopefully nothing bad will happen.
    – Bogdacutu
    Jul 27, 2011 at 6:04
  • 2
    This is an answer but it's not an answer. Because we still have no incling as to why the service is looking for this script.
    – markus
    Sep 16, 2011 at 14:28
  • 3
    This entry isn't due to Drop Down Deals. It's only related to Drop Down Deals in as much as the plugin making the request also uses dddWrapper.swf, which is used by Yontoo (an app platform for ad/spyware-supported browser plugins). And the reason it's requesting crossdomain.xml is pretty obvious. Just google "crossdomain.xml" or search for it on this site and you'll quickly realize why a .swf file would be making this request. Feb 27, 2012 at 11:18
  • Lèse: So to verify, the idea is that Yontoo has injected a copy of drop-down deals into large numbers of random websites that you are visiting?
    – user9212
    Feb 28, 2012 at 2:03
  • 2
    @user9212: No, what's happening is someone who has installed a Yontoo-based browser plugin is browsing your site. The browser plugin loads the dddWrapper.swf flash object, which in turn wants to fetch content from your domain. But to do this, it needs to access the cross-domain policy on your site, which is what the crossdomain.xml request is for. The dddWrapper.swf is a part of the Yontoo platform. The "ddd" is not a reference to Drop Down Deals. Drop Down Deals' Yontoo plugin uses it, but so do all of the other Yontoo plugins. Mar 25, 2012 at 2:37
6

This isn't actually related to a firefox plugin, or any plugin at all. crossdomain.xml is part of the flash/flex specification. It's a method to allow/validate cross domain operations for flash and other Adobe products, Sliverlight also seems to use/obey the same adobe policy framework.

From Adobe's Cross-domain policy file specification

A cross-domain policy file is an XML document that grants a web client—such as Adobe Flash Player, Adobe Reader, etc.—permission to handle data across multiple domains. When a client hosts content from a particular source domain and that content makes requests directed towards a domain other than its own, the remote domain would need to host a cross-domain policy file that grants access to the source domain, allowing the client to continue with the transaction. Policy files grant read access to data, permit a client to include custom headers in cross-domain requests, and are also used with sockets to grant permissions for socket-based connections.

Example of a valid crossdomain.xml

<?xml version="1.0" ?>
<cross-domain-policy>
  <site-control permitted-cross-domain-policies="master-only"/>
  <allow-access-from domain="*"/>
  <allow-http-request-headers-from domain="*" headers="*"/>
</cross-domain-policy>

So it would seem an Adobe product is asking for permission to perform a cross domain operation - I've seen this in my logs before and took it to be a bot looking for a weakness because I could see no other reason for it being there - I would ignore it if it's doing no apparent harm.

2
  • Good explanation. I did know about it already, but it was that addon that caused all of the problems; my site doesn't use Flash at all.
    – Bogdacutu
    Mar 24, 2012 at 12:50
  • Hey I found out that I was accessing my flash site without the "www." before the domain. I.e. I was visiting mysite.com/page and getting the crossdomain.xml missing issue. So I used the above sample valid crossdomain.xml file supplied by "toomanyairmiles" and my flash site began working again. Mind you, it was working fine without the crossdomain.xml so long as I visited the site with "mysite.com/page" instead.
    – user20265
    Nov 28, 2012 at 23:08
0

Check your browser add-ons and look for something called yontoo.com not sure exactly what it is but if you remove this add-on all seems to go back to normal

-1

Do you have flash based adverts on your website, it looks like the 3rd party advert is looking in your domain for the crossdomain.xml.

Speak to your ad company about this.

Was your domain owned by anyone else in the past? It could be that something was setup before you came along.

2
  • I don't have and ads on my website. (yet)
    – Bogdacutu
    Jul 25, 2011 at 12:05
  • That's definitely not the case!
    – markus
    Sep 16, 2011 at 14:28
-1

To me it's the same, apparently is no attack but be careful because if we are requested to file many times that we can saturate the server

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.