IE, Firefox Spoofable, Again

Yahoo News ^ | 21 June 2005 | Unknown

[ShadowAce]

Internet Explorer and Firefox -- even the newest edition that's getting ready for release -- can be spoofed by hackers intent on stealing passwords or other confidential information, a security firm said Tuesday.

According to Danish vulnerability tracker Secunia, Microsoft's Internet Explorer, Mozilla's Firefox, and virtually every other popular browser could be used by malicious Web site to display bogus Java dialog boxes atop legitimate sites.

"The problem is that JavaScript dialog boxes do not display or include their origin, which allows a new window to open -- a prompt dialog box -- which appears to be from a trusted site," read the alert that Secunia posted.

An exploit requires that the user first visit a malicious site -- perhaps enticed there via e-mail or instant message -- that includes a link to a legit, trusted site, say an online banking portal. By leveraging the JavaScript bug, the attacker could display a fake password dialog, and trick the user into entering her account information.

Secunia has created a vulnerability test that users can quickly run to see if their browser is open to such a spoof.

Not only does the vulnerability exist in up-to-date editions of Internet Explorer, Firefox, Mozilla, Camino, Opera, and Safari, but it also affects the not-yet-released Firefox 1.0.5, which is in the last stages of testing.

"We expect a Firefox 1.0.5 release in the not too distant future," the quality control blog for Firefox read Tuesday. "We'd appreciate any help you all can offer by downloading and testing out these new bits."

It was expected that Firefox 1.0.5 would fix the frame insertion bug that crept back into the open-source browser's code, a gaffe that made news earlier in June.

Would 1.0.5 also fix this news flaw?

"We'll be taking a look at the vulnerability, and deciding whether it makes sense to put [a fix] in 1.0.5," said a Mozilla spokesman. "Firefox security is an ongoing process."

The spokesman wouldn't comment on whether any inclusion of a fix for the new vulnerability -- which Secunia rates as only a "less critical" threat -- would delay the appearance of 1.0.5, but said that the builds now available "were mostly for the development community. The release of 1.0.5 is a ways off."

Firefox 1.0.5 can be downloaded in its not-finished Windows, Mac, and Linux editions from the Mozilla Web site.

[ShadowAce]

[martin_fierro]

D'oh.

[USF]

read later...

[flashbunny]

tagging

[N3WBI3]

Here is the bit of JavaScript that they are using to do this

<script language="JavaScript" type="text/javascript">
var o_height = 768;
var o_width = 1024;

if ( screen.width > 100 )
{
o_width = screen.width;
}

if ( screen.height > 100 )
{
o_height = screen.height;
}

function run()
{
if ( window.opera )
{

window.open('http://www.google.com.secunia.com/tests/origin_spoof.php', '_blank', 'height=1,width=1,left=3000,top=3000,resizable=no,scrollbars=no');
}
else
{
window.open('http://www.google.com.secunia.com/tests/origin_spoof.php', '_blank', 'height=1,width=1,resizable=no,scrollbars=no,left=' + ((o_width / 2) - 50) + ',top=' + ((o_height / 2) - 150) ); }
window.focus();
}
</script>

[N3WBI3]

And of course here is how you would call that function

(a href="http://www.google.com/" onclick="run();")

[Zuben Elgenubi]

How do we turn off Java in Firefox? Anyone know?

[Blood of Tyrants]

Well crap!

[atomic_dog]

Here's how you stop it for Firefox.
Firefox NoScript Extension.

[ShadowAce]

Go to Options --> Web Features --> Enable Java and click off the check box

[Blood of Tyrants]

Click Tools, then Options, then Web Features and deselect it.

[Zuben Elgenubi]

Thanks.

Deselect JavaSript also?

[Blood of Tyrants]

Too many bad reviews.

[Zuben Elgenubi]

Thanks

[Blood of Tyrants]

Actually I think that JavaScript is the one you are supposed to deselect.

[Zuben Elgenubi]

Got it, thanks. My bad.

[B Knotts]

Doesn't seem to work in Konqueror 3.4.0.

[kevkrom]

Typical shoddy tech reporting... they say it's a Java problem, and then talk about a JavaScript exploit. JavaScript is to Java as Velveeta is to Cheddar.

[ShadowAce]

That's kewl. I may have to start using that. :)