Slashdot Log In
Firefox Quickies
Posted by
kdawson
on Tue Jul 10, 2007 07:36 PM
from the three-twisty-little-items-all-different dept.
from the three-twisty-little-items-all-different dept.
First, Gypsy2012 writes with a highly critical security flaw involving both Firefox 2.0 and Internet Explorer, which could allow a malicious attacker to gain remote control of a user's system. It exploits the "firefoxurl://" URI handler. ... Next, reader dsinc sends word that the beta for Firefox 3 has slipped by 6 weeks. The new target date is September 18 at the earliest. The article wonders whether the final release will slip into 2008. ... Finally, reader jktowns points out new anti-phishing features in the latest nightly build of Firefox 3. One of them was added into the code base by the guy who developed the LocationBar2 extension.
Related Stories
[+]
10 Anti-Phishing Firefox Extensions 129 comments
An anonymous reader writes "A list of 10 anti-phishing Firefox extensions was published at Security-Hacks: 'For most Internet users, defending against phishing attacks is a top priority. One popular way to combat phishing attacks is to maintain a list of known phishing sites and to check web sites against the list.'"
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Demonstration (Score:5, Informative)
Cmd.exe [firefoxurl]
This should launch cmd.exe....
Notice that you must click that link from internet explorer, firefox will warn you that an external application is being called.
above example taken from here [xs-sniper.com]
Re:Demonstration (Score:5, Funny)
"Iceweasel doesn't know how to open this address, because the protocol (firefoxurl) isn't associated with any program."
and when I try to open this "ie" program:
"~ $ ie
bash: ie: command not found"
maybe there's something wrong with your operating system?
Parent
Re:Demonstration (Score:5, Funny)
Parent
Re: (Score:2, Funny)
Re: (Score:3, Funny)
Laughing? A less happy feeling (Score:5, Funny)
"If you've used Windows Vista for more than 3.7 minutes, you know what UAC (User Account Control) is.. it's the obnoxious, nagging popup window that will be your life for the next 3-5 years... Note: Disabling UAC will lead to a less secure system, so be warned. -- The How-to Geek [howtogeek.com]
Parent
Re:Laughing? A less happy feeling (Score:4, Informative)
If you try it on Vista with UAC turned on, it'll fail -- or, at least, it'll give you a warning dialogue (one of these [wvsom.edu] ) -- due to IE's protected mode, which is part of UAC (quick summary: IE runs as an even lower integrity token than normal users, and need privilege elevation to a normal user token to do things like write to anywhere other then temporary internet files and access other programs on the computer -- in this case, Firefox).
Parent
Re: (Score:3, Interesting)
Re: (Score:3, Informative)
this [firefoxurl]
If you open this in firefox (as most of you probably are usuing firefox, since this is slashdot), it warns you that something is trying to launch an external application.
once again, the above example was taken from Here [xs-sniper.com]
Re: (Score:2)
stop stripping my links! >:-O
the link in full txt is THIS:
a href = 'firefoxurl:test" -chrome "javascript:C=Components.classes;I=Components.inte rfaces;file=C[@mozilla.org/file/local;1].createIns tance(I.nsILocalFile);file.initWithPath(C:+String. fromCharCode(92)+String.fromCharCode(92)+Windows+S tring.fromCharCode(92)+String.fromCharCode(92)+Sys tem32+String.fromCharCode(92)+String.fromCharCode( 92)+cmd.exe);process=C[@mozilla.org/process/util;1 ].createInstance(I.nsIProce
Re:Demonstration (Score:4, Informative)
Firefox 2.0.0.4 and IE6.
Doesn't even work from IE, just loads a blank tab in firefox. I guess I must be doing it wrong
Parent
Re:Demonstration (Score:4, Informative)
Parent
Re: (Score:3, Insightful)
Re: (Score:3, Informative)
Firefox users with the NoScript extension [noscript.net] installed have been already protected both from MacManus/Larholm remote code execution and from Rios "Universal XSS" since June, the 22th, see NoScript changelog [noscript.net].
More in general, they're protected from chrome privilege escalation gained by opening non-chrome URLs in top-level chrome windows (Larholm's PoC) and from javascript: URLs being loaded in externally opened browser shells (Rios' PoC), no matter if attempted through the firefoxurl: handler (like in this s
Re: (Score:3, Informative)
Firefox just does what you tell it, and 'you' in this case is an IE which doesn't escape characters that have a meaning to the shell that is going to execute the command. So it's IE pwnx0ring (is that how you spell it?) the *shell* to get it to execute firefox with arbitrary parameters. I'd be willing to bet that there's a way to
Re:Demonstration (Score:4, Insightful)
Parent
Re: (Score:3, Insightful)
Meanwhile, Kristensen of Secunia said: "A new URI handler was registered on Windows systems to allow Web sites to force launching Firefox if the 'firefoxurl://' URI was called, like ftp:// [ftp] http:/// [http] or similar would call other applications."
But because of the way the URI handler was registered by Firefox, it causes any parameter--which activates a program to perform a particular task--to be passed from Microsoft's Internet Expl
Finally (Score:2)
First, Gypsy2012 writes with a highly critical security flaw involving both Firefox 2.0 and Internet Explorer
Earlier when Microsoft's IE team flew over to Mozilla HQ to ask them about their RSS icon, I knew it that's the beginning of a wonderful partnership.
What OS (Score:3, Interesting)
Granted if it's a bug it needs fixed regardless, but I would be more shocked if it said "allows a person to gain remote access on ALL systems running said software".
Re:What OS (Score:5, Insightful)
Parent
Re: (Score:3, Interesting)
Are we *sure* this is a bug, not a "feature"?
Right now, somewhere in Remdond, someone is planning a press release...
[1] By extension, if you are one of the 97.46% of desktop users worldwide with Windows installed.
Re: (Score:3, Informative)
Re: (Score:3, Informative)
Re:What OS (Score:4, Interesting)
Is it. Most exploits that would work on XP wouldn't work on Vista in protected mode.
Parent
Re: (Score:2)
Re:What OS (Score:5, Informative)
Parent
Re: (Score:2, Informative)
You're correct. Protected mode means something different [microsoft.com] in this context.
Nowhere near as much fun as handling triple faults in your assembly code!
Re: (Score:2, Informative)
http://en.wikipedia.org/wiki/Virii [wikipedia.org]
Doesn't work with Firefox 1.5.x.x (Score:2, Insightful)
Free Diease. Now pay for the Cure. (Score:5, Insightful)
Now this blows:
http://secunia.com/advisories/25984/ [secunia.com]
> Solution:
> Do not browse untrusted sites.
> Disable the "Firefox URL" URI handler.
The first is impractical. The second begs the question, "Sure, How?" Read on:
> Extended Solution:
> The "Extended Solution" section is available for Secunia customers only.
> Request a trial and get access to the Secunia Customer Area and Extended Secunia advisories.
So these guys are publishing zero day security flaws, then making you reach for your credit card. Very grubby.
The CNET article doesn't tell you what the fix is either. Google has nothing. Anyone?
Here's how... (Score:5, Informative)
Now in the list of registered file types find the one that says:
"(NONE)" for extension and "Firefox URL" for file type
Select it and click on delete button to delete it.
Click on "OK" to close the "Folder Options" dialog.
Parent
Re: (Score:2)
Re: (Score:3, Informative)
HKEY_CLASSES_ROOT\FirefoxURL
So, go to start Run, type regedit and navigate to this key. Right click on it and choose Delete.
Of course you could also export the entry and save it in a
To put it back, just double click on the
Re: (Score:2)
URI handlers are stored under HKCR in the registry. If you rename or remove HKCR\FirefoxURL it should disable the handler. Note that I have no idea what other impact doing that would have.
IE problem, but also Firefox problem. (Score:5, Informative)
Firefox will warn you if a program tries to use other protocols. It will allow you to suppress the warning, however, which can cause the same problem as IE, but at least you can't say you weren't warned. So from this POV, it is IE's problem moreso than Firefox's, especially when it's considered that the URLs can't do anything from WITHIN Firefox, and that (I haven't checked this, just heard it somewhere) the protocol was requested by MS for some Vista compatibility thing or some such nonsense. Not sure if there's anything to that.
However, on the flip side, anyone who implements a protocol needs to be aware any web page can invoke the protocol at will, without the consent of the user (well, thanks to IE's "standards"). This results in being able to do things like this [mzzt.net]. This webpage redirects the browser to steam://open/main, which will open the main Steam window. The user never sees the actual url. This could work with the firefoxurl protocol as well. Here are some other things that can be done [valvesoftware.com], some of the uglier ones have confirmation screens I believe, but launching a game or connecting to a server does not. Note the first one which promises that it can redirect command line arguments, just like firefoxurl... however I cannot get that to work (I tried -shutdown and it just focused the main window like my current sample does). Also note the hackish steam://openurl/, which is designed to allow Steam's built-in IE browser to invoke the computer's default browser. Theoretically this could be used to bypass a popup blocker.
Of course it would appear that Steam at least can't run arbitrary programs and is limited to it's own folder in terms of effects (I could force you to join my UBER LAME COUNTER STRIKE SERVER but that's about it).
I think both Microsoft and Mozilla need to take steps to fix this problem. Microsoft needs to improve external protocol handling to at least what Firefox does (Firefox could even secure its own handling more, but that might detract too much from the flexibility. Not that that's stopped anybody before). Mozilla should remove this silly firefoxurl bit. I can't think of any legitimate reason for it (anyone have any clue?).
As for Valve with Steam... steam://openurl/ is a bit much I think. It's expected for users who don't know what MSHTML or ActiveX are to think it's a bug that external windows open in IE, but us devs know that, internally, IE is just spawning a new window for a page. Since when were you browsing the web in IE and click on a link and it popped open in Firefox? I wouldn't want that to happen if I preferred IE! (Yeah... firefoxurl is definitely useless.) I mean, can't Valve say that because Steam uses Internet Explorer internally for the Store, all launched webpages will appear in Internet Explorer and there's no way around it? Eh probably not. The technically inclined probably think everything is great now and wouldn't care if anyone told them Valve used a hackish and possibly unsafe solution.
Although at the least they could use a whitelist for urls to use for openurl... IE steampowered.com and whatever other sites they link to... although considering the number of third party games being added it could be a largish list. :(
Perhaps steam could kick the steam:// thing entirely, but the only alternative I can think of is an Internet Explorer BHO (ick, not worth the trouble IMO), unless they can do something fancy with javascript or java or flash or something.
Here's a bonus for reading all this: You can see what available protocols Windows / Internet Explorer can use (Firefox too, although it has its own extras like about: and data:) by checking HKEY_CLASSES_ROOT in regedit. Search for Values with the exact name of "URL Protocol" and the keys you find (or maybe it's in the default value?) are the protocol names. With a look it can be easy to figure out how
Re:IE problem, but also Firefox problem. (Score:4, Insightful)
It's a protocol scheme Windows makes up based on the registry keys Firefox has to set to get things like http: associated with it.
To be more precise, what Firefox does is:
register HKLM/SOFTWARE/Classes/FirefoxURL with a shell/open/command
subkey and then set the values of ftp, gopher, http, and https to
FirefoxURL under HKLM/SOFTWARE/Clients/StartMenuInternet/FIREFOX.E
This causes Windows to send "firefoxurl:" URLs to Firefox.
Not much to remove here on Mozilla's end.
Parent
Requires firefox to exploit from IE (Score:2, Insightful)
The fact is that the URI handler firefoxurl:// is installed by.... Firefox.
In other words, IE is redirecting to the firefoxurl DLL or EXE installed by Firefox, and that is the code which is executing user input without warning.
To me it seems disingenuous to blame the IE implementation for handing control to the Firefox protocol handler, which is treated like a shell plug-in. It seems the responsibility to prompt the user should rest on the protocol handler. Otherwise, IE would be expected to prompt
What earthly use is "firefoxurl" anyway?! (Score:3, Informative)
After reading about "firefoxurl" and what it does, I only have one simple question: what on earth were they thinking when they implemented it? What's it supposed to be useful for?
As far as I can tell, the only use it could possibly have is creating desktop URLs that always open in Firefox, however there's no reason why they would have to create a URL handler to do that. Otherwise, it's completely worthless and, as discovered, a security risk, to boot.
For added fun, attempting to use a "firefoxurl" URL while Firefox is already running creates an infinite loop. (It just keeps on asking you to allow an "external application" to launch. It doesn't even seem to actually work. I get the same results when launching it directly from IE through the address bar.)
Why was this implemented? What was it supposed to do?
And, for bonus points, is it possible to write a firefoxurl that, when opened in IE, would unregister the firefoxurl handler?
Re:What earthly use is "firefoxurl" anyway?! (Score:5, Informative)
Except that's still retarded, since it's by definition a remotely executable code exploit. URLs don't have to be loaded by users, and in some cases, can even be loaded without any user interaction. (<meta http-equiv="Refresh"> comes to mind, although I haven't gotten the exploit to work on my system yet).
XUL applications have access to basically everything on the system. You know how you can launch files from the Firefox's Downloads window? There's nothing that prevents a skeleton XUL application from downloading a EXE and then launching it with no user interaction. The dialog that Firefox displays when launching executables is handled by the download dialog, there's nothing that requires it be displayed. (I've written an extension that launched a Windows Control Panel applet before, trust me that there's nothing really preventing XUL applications from being nasty.)
So I'm still left wondering, what was this intended for, and who thought it was a good idea?
Parent
Firefox's Fault? (Score:4, Interesting)
I interpret that as saying that the Firefox installer messed with Windows and Internet Explorer, opening a hole. Is Window/IE really to blame when another application adds "features" that end up being holes?
If Windows/IE were to filter what can and cannot happen through URI handlers, I could see developers crying foul for preventing access and locking out competition.
Further, is the onus now on Microsoft to fix a hole created by Firefox? And once they fix it, and legit things break because of it, who's fault will that be?
Re:Firefox's Fault? (Score:4, Insightful)
Firefox set up the http: protocol and such to launch it. Windows synthesizes a new URI scheme based on the registry key name used for this and associates this made-up scheme with Firefox. Not much Firefox can do about this Windows "feature".
Parent
Highlighting phishing sites is nice, but weak (Score:5, Interesting)
Just highlighting domains of phishing sites isn't going to be enough. Here's today's list of domains that "sort of look like Paypal". These are after subdomain truncation.u i.ork.pl"
"paypal-checker.com"
"paypal-contact.net"
"paypal-customize.com"
"paypal-erreur2.com"
"paypal-security.com"
"paypal-web-dll-scrnupdateaccount.ici.st"
"paypal-web-scrn-dll-pl-dai-pl-webscrndllfs-werty
"paypal.powered.at"
"paypal.q.fm"
"paypalaccverify.com"
"paypalcomcgibinwebscrcmd.by.ru"
"paypalcomcgibinwebscrcmm.by.ru"
"paypalcomcgibinwebscre.by.ru"
"paypalconstomers.com"
"paypalct.com"
"paypall.ro"
"paypalmd.com"
"paypalobjects.us"
"paypalsecuritycenter.org"
"paypalverification.org"
"paypel-acc-5.com"
"paypilpal.com"
"paypll-wscr.com"
"paypluspl.com"
These are from PhishTank, which blacklists at the URL level based on manual reports. For SiteTruth" [sitetruth.com], we're in the process of converting to blacklisting phishing sites by the entire base domain. That's because we now see hundreds of entries like "session-624333.nationalcity.com.userpro.tw", which has to be treated as a bad indicator for all of "userpro.tw".
There's collateral damage. There are days when "tinyurl.com" and "notlong.com" get blacklisted, because phishing sites use them. MSN gets complaints about this. [msdn.com] Today, anybody running something like "tinyurl" needs to continually check the phishing databases for attempts to abuse their service, or their own reputation is toast.
Whats the fuss about? (Score:3, Interesting)
Re:Ok.... (Score:5, Informative)
Hell, I've got Firefox on my WIndows system (but Opera is my main browser,) and I usually end up using IE for some sites.
Parent
So do I. For ones I absolutely have to trust. (Score:3)
It keeps me safe.
If a site doesn't work with that, then fuck them. I only need IE for some work related sites that have stupid ActiveX controls.
Re: (Score:2)
Re: (Score:2)
Re: Firefox crashes (Score:5, Informative)
Parent
Re:Kdawson... (Score:5, Funny)
It was added a couple of months ago to settle a bet whether Slashdot's editors are better than a random number generator (as yet no winner has been declared).
Parent
Re: (Score:3, Interesting)