[ShadowAce]

[martin_fierro]

D'oh.

[USF]

read later...

[flashbunny]

tagging

[N3WBI3]

Here is the bit of JavaScript that they are using to do this

<script language="JavaScript" type="text/javascript">
var o_height = 768;
var o_width = 1024;

if ( screen.width > 100 )
{
o_width = screen.width;
}

if ( screen.height > 100 )
{
o_height = screen.height;
}

function run()
{
if ( window.opera )
{

window.open('http://www.google.com.secunia.com/tests/origin_spoof.php', '_blank', 'height=1,width=1,left=3000,top=3000,resizable=no,scrollbars=no');
}
else
{
window.open('http://www.google.com.secunia.com/tests/origin_spoof.php', '_blank', 'height=1,width=1,resizable=no,scrollbars=no,left=' + ((o_width / 2) - 50) + ',top=' + ((o_height / 2) - 150) ); }
window.focus();
}
</script>

[Zuben Elgenubi]

How do we turn off Java in Firefox? Anyone know?

[Blood of Tyrants]

Well crap!

[B Knotts]

Doesn't seem to work in Konqueror 3.4.0.

[kevkrom]

Typical shoddy tech reporting... they say it's a Java problem, and then talk about a JavaScript exploit. JavaScript is to Java as Velveeta is to Cheddar.

[antiRepublicrat]

Works on Firefox 1.0.4, but I do get an obviously suspicious small blank window before the dialog comes up to ask for my password.

We'll be seeing these things as long as we're working on HTTP and JavaScript, neither of which were really designed with security in mind.

[csvset]

bump for later

[MJY1288]

bttt

[ShadowAce]

IE pop-up spoof won't get patch

[Feiny]

pinging my inner geek for later