Spoofing Flaw Resurfaces in Mozilla Browsers 258
GregThePaladin writes "A 7-year-old flaw that could let an attacker place malicious content on trusted Web sites has resurfaced in the most recent Firefox browser, Secunia has warned. The flaw, which also affects some other Mozilla Foundation programs, lies in the way the software handles frames. The applications don't check whether the frames displayed in a single window all originate from the same Web site." Commentary on this at whitedust as well.
So secure (Score:4, Funny)
Re:So secure (Score:4, Insightful)
There will never be such a thing as a 100% secure browser. It's all about which one is "more" secure... Even with the holes found in Firefox it's still many times safer than IE. Not only that, but these holes are usually patched in a matter of days, while with MS your lucky if it gets fixed in a few months.
Re:So secure (Score:5, Interesting)
Re:So secure (Score:2, Insightful)
Re:So secure (Score:2)
What camcorder is talking about is the inability to deinstall IE - you can deinstall FireFox without any problem, but you can't deinstall IE.
That is, you can not remove IE without breaking some Windows functionality that shouldn't depend upon IE to start with.
Re:So secure (Score:2)
*waits for the flamebait mod
Re:So secure (Score:5, Informative)
http://secunia.com/advisories/11966/ [secunia.com]
Re:So secure (Score:2, Informative)
Re:So secure (Score:4, Insightful)
IE has this issue, want to bet which browser will fix it first? (hint, Mozilla fixed it before)
Re:So secure (Score:2)
Exploits? (Score:4, Insightful)
Re:Exploits? (Score:3, Informative)
Before anyone could think of a way to exploit this this'd be fixed I think.
Re:Exploits? (Score:4, Informative)
NOTE: Exploitation can easily be made "automatic". However, since this example only serves as a test to give users an understanding of how it works, we have chosen not to do so.
Regardless, I don't consider this to be too big of deal. Th exploit can be used for a phishing attack, when a trusted site is using frames. A nontrusted site then replaces one of the inner pages with a fake lookalike, but the user can't tell, becasuse the address isn't shown in the address bar.
Banks using frames for the trusted portion of their sites is extremely bad design, and I don't know of any that does that anyways.
Re: (Score:2)
Automated testing? (Score:3, Interesting)
Software testing automation tools [tigris.org]
Re:Automated testing? (Score:2)
Either they don't have automated testing, or they do have, but it didn't look for this bug.
Finding bugs (and squashing them) is a good thing, but I'm curious about how this bug got reintroduced in FireFox. I hope they analyse this problem, and improve their operational procedures to prevent other reintroductions of old bugs.
Re:Automated testing? (Score:3, Interesting)
That might be true. I'm not sure the density of unthunk thoughts, though. Are they even liquid at room temperature?
Automated testing cannot prevent defects from recurring in subsequent builds as a pedantic [reference.com] interpretation of my passing observation might imply to a novice. I was sloppy with my terminology, yes.
However, automated testing can and does allow development teams to identify and correct defects which are accidentally re-int
Re:Exploits? (Score:5, Insightful)
Re:Exploits? (Score:2, Insightful)
Re:Exploits? (Score:4, Insightful)
Re:Exploits? (Score:2)
No, but I've heard innuendo describing potential exploits based on fairly contrived vulnerabilities in Firefox that have helped to slow the rate of adoption of Mozilla/Firefox as an alternative browser at MyCorp.
I've never experienced an exploit on Mozilla/Firefox or known anyone else to have experienced an exploit on Mozilla/Firefox.
That Mozilla/Firefox was even considered as an alternative browser by corporate
what about tabs? (Score:5, Interesting)
For a spoofing attempt to work, a surfer would need to have both the attacker's Web site and a trusted Web site open in different windows.
So, uh, what about tabs? 'Cause I never have 2 windows open at the same time.
Re:what about tabs? (Score:5, Informative)
Re:what about tabs? (Score:2)
This means a simple work around is to install TabBrowserPreferences or any of the other extensions which capture new window commands and make them open in tabs.
I was already using this anyway, but if you're running in a corporate environment or something this could be a quick fix.
Re:what about tabs? (Score:3, Interesting)
In Galeon, it does work across tabs.
Re:what about tabs? (Score:2)
Re:what about tabs? (Score:2)
Re:what about tabs? (Score:2)
Re:what about tabs? (Score:2, Insightful)
Re:what about tabs? (Score:2)
Re:what about tabs? (Score:2)
Trusted and untrusted sites? (Score:2, Insightful)
The whole notion of a trusted web site is bogus. Many large and popular web sites are not maintained well enough to prevent them from
Re:what about tabs? (Score:2)
Just about says it all right there... : p
j/k obviously...or am i?
Re:what about tabs? (Score:2)
So, uh, what about "open software has bugs squashed quickly because so many eyes are looking at it all the time, everywhere"?
Whose eyes? And where are they looking?
The exploit (Score:5, Funny)
Exploit: Local
Effects: All browsers
Description:
A 7 year old vulnerability has been discovered in multiple browsers, allowing malicious people to spoof the content of websites.
The problem is that the browsers don't check if a piece of black electrical tape is on the screen covering the address bar, which prevents the user from identifying the source of content in the browser window.
Successful exploitation allows a malicious website to load arbitrary content with its source masked by the black tape. The user cannot know if this is a trusted site.
Solution:
Remove the piece of electrical tape from the screen. Windex may be necessary to clean up afterwards.
Re:The exploit (Score:4, Informative)
Re:The exploit (Score:2)
If you have a "trusted" site open in one window, clicking on a malicious link in another window, can cause any frame in the "trusted" website to be replaced with a spoofed page. There are no clues in the address bar and it's not in the HTML source. The best I could do is, in FireFox, look at the page info box (Tools -> Page info)
Good the flaws are being found so quickly but... (Score:3, Insightful)
Re:Good the flaws are being found so quickly but.. (Score:5, Insightful)
Re:Good the flaws are being found so quickly but.. (Score:2)
and not having an automated regression test suite.
Crap. Most recent version of Moz suite is affected (Score:2)
Is the Moz community going to release a fix for Suite?
Re:Crap. Most recent version of Moz suite is affec (Score:2)
Re:Crap. Most recent version of Moz suite is affec (Score:2, Informative)
IIRC 1.x is feature frozen, but still 'active'.
Why - Oh why (Score:2, Interesting)
Re:Why - Oh why (Score:3, Informative)
Automated Testing (Score:4, Interesting)
Re:Automated Testing (Score:2)
Automated testing is helpful, though mainly for known errors or conditions. It can be used to find some unknown problems, but it is not entirely effective at this class of problems.
Re:Automated Testing (Score:2)
But in this case it was a known error. If the nature of the bug allowed it to be generated and verified using an automated test, you could add it to your regression test. Then if the bug showed up again, the regression test would catch it. This assumes that the automated test isn't dependent on the exact code snippet that caused the orginal problem but rather on the behavior.
Not all Firefox users will be affected (Score:2, Informative)
It is surprising, though, that a security vulnerability like this goes unnoticed for so long. On the other hand, I very much doubt that anybody has actually used this to exploit users.
Re:Not all Firefox users will be affected (Score:2)
The Tabbrowser Prefs extension r00lz. Don't leave your homepage without it.
Ehmm. (Score:2, Interesting)
So what do I do wrong?
Bunk commentary on Whitedust (Score:5, Interesting)
Or are they supposed to scrap it all and rewrite from scratch every few years? I sure hope not. Anyone else out remember M13, M14, M15, etc.? *shudder*
Re:Bunk commentary on Whitedust (Score:2)
Tabbrowser Preferences (Score:4, Informative)
Re:Tabbrowser Preferences (Score:2)
I would think you'd need main() { exit(1); }
Re:Tabbrowser Preferences (Score:2)
Re:Tabbrowser Preferences (Score:2)
Now it's perfect, unless you count these entries [slashdot.org]. I like the nostdlib one, but it seems like the sig should be comprehensible.
I don't think
This is the first time... (Score:2)
(hypothetical) Secunia advisory
blablablah... bug.
Versions affected: Firefox v1.04 etc....
Workaround: Install the tabbrowser preferences extension.
w00t.
Re:Tabbrowser Preferences (Score:2)
Disappointed in QA for browsers (Score:5, Insightful)
To have such fundamental flaws appear, whether by accident or negligence, is unacceptable.
Furthermore, the browser "industry" and the commercial sector NEED to come up with some guidelines as to how to promote and ensure online security for financial transactions and personal data.
For example, it's almost impossible for the casual or sophisticated user to easily determine whether a frame that appears within a website actually belongs to that website, or another. For example, if you have an online account with MBNA credit card, and make an online purchase, some vendors will display an MBNA authentication page which asks you to login to your online account to verify the purchase.
The problem is that this authentication page appears as a frame within the online vendor. How can you tell whether that frame is a legitimate MBNA page, or just a clever phishing attack? The browser gives no indication as to whether the frame belongs to MBNA or the vendor.
PayPal suffers from the same thing. I hate clicking on the "Make a Donation" button of some sites, and then seeing the PayPal login appear within a frame of the original site. That prevents me from making a donation - with today's complicated scripting invocations and what not, I don't feel trusting enough to type my account info and password into some frame which happens to appear in the middle of some other organization's website.
I can't BELIEVE that MBNA and PayPal would promote such idiotic practices, much less allow them to happen.
Re:Disappointed in QA for browsers (Score:3, Insightful)
Open frame in new tab (Score:2, Informative)
I click RMB->This Frame->Open Frame In New Tab
As you'd expect this opens the frame in a new tab where you can easily see the URL.
You can also find information about an embedded frame by clicking RBS->This Frame->Frame Info
Re:Disappointed in QA for browsers (Score:2)
- Access context menu for the frame (right click inside the frame
- select "This Frame"
- select "View Frame Info"
It gives you all the details.IE has this vulnerability (Score:5, Informative)
The bug in IE was reported almost a year ago, and it is still unpatched.
The bug was reported in all major browsers (Mozilla and Firefox, Opera, Safari, Konqueror, IE), and was patched in all of them except IE. It has now reappeared in Mozilla.
Re:IE has this vulnerability (Score:3, Informative)
Re:IE has this vulnerability (Score:2)
The reason why this hasn't been patched in IE and might never get patched in IE is because a user would have to be extremely stupid to not noticed the website INSIDE their other website. We've all seen this before, and occasionally deal with it from time to time. The only security risk here is having something like the "Help and Support Center" open in Windows XP and having IE or Firefox control the frames to try to load an application to
Re:IE has this vulnerability (Score:2, Informative)
http://www.microsoft.com/technet/security/bulletin
Also since IE5, there has been protection against this type of attack.
1. Click Start, point to Settings, click Control Panel, and then double-click Internet.
2. Click the Security tab.
3. Under Select a Web content zone to specify its security settings, click Internet.
4. Click Custom Level.
5. Under Navigate sub-frames across di
Before (and after) you start yelling at Firefox.. (Score:2, Insightful)
How many bugs have been exposed in IE and exploited? (Especially because for IE it's almost a 1:1 ratio)
Is it a bug? (Score:2)
I tried the exploit with a W2k box that has IE Version 6.0.2800.1106CO with SP1 and several Q### patches installed and it produces the same result.
I see how this could be used as an exploit but is it really a bug? I have written code for a game website which used multiple windows with frames and the information in the frames came from two different web servers. Yeah, I know, it sounds like a web surfing nightmare, but fret not, it was an experiment. But my point is that this may not a
problem not described quite correctly (Score:4, Insightful)
And they shouldn't check that because often frames do not originate on the same web site (e.g., Google, Hotmail). The problem is if you try to frame something low security inside something high security; the other direction is OK.
What they should check (according to Secunia) is something different: when code attempts to put content into a target, the browser should check whether that code actually created that frame and otherwise refuse.
A simple way of fixing this problem might be to prefix the name of any frame with the host that created it, so that "target=foobar" actually means "target=www.host-of-this-page.com::foobar"; that also helps avoid confusing name conflicts between web sites. But that suffers from the same problem as anything else that relies on host names: you can't tell which ones are supposed to "belong together".
Alternatively, you might require that if any frame in a window uses https, then all of them must, and they all must use the same certificate.
The best solution is probably just to abolish frames altogether; they cause many other problems as well.
A slightly less drastic solution would be to prohibit the display of any https content in a frame.
Open sores is bad (Score:3, Funny)
Thank God! (Score:2)
Frame Information Box (Score:2, Interesting)
What about placing a small colored box in the corner of each frame... If a frame's box differs in color from the surrounding frames, this would indicate the frame was on a different domain. That way the developers wouldn't have to worry about breaking the legitimate use of this technique.
TabBrowser Preferences Prevents This (Score:2, Interesting)
New Frame Exploit Announced (Score:2, Funny)
Re:Old news. (Score:4, Insightful)
Re:Old news. (Score:5, Insightful)
Re:Old news. (Score:2)
Re:Old news. (Score:5, Insightful)
There is absolutley no reason anyone should ever use this exploit for legitimate reasons. Yes, I can think of a few times it would be great if one website could help someone fill out another websites forms - but its not neccessary. If someone really wants to do that, they should attain permission and do it via GET or POST vars, or some serverside communication.
A website should still have control over what page is being shown in its frames, but not over the content of those pages directly.
Re:Old news. (Score:2)
you misunderstand the problem (Score:4, Insightful)
So, if you do banking in one window and you then open up a malicious site in another, the malicious site can change the content of a frame in your banking window. That's not "faking", it's something worse.
I can't think of a legitimate use for that "feature" in a real application, and the fact that it didn't use to work suggests that sites aren't relying on it.
Re:Old news. (Score:3, Insightful)
Re:Old news. (Score:2)
No, there are not. This "feature" is not used because it has not existed for years; ever since it was eradicated from browsers because it's a nasty security hole.
It is actually something to do with malicious code. It is not about making a fake site, it is about letting you navigate to a real site (like your bank), without you ever knowing you are actually doing so in a frame. And it's about that frame containing javascript that is contin
Re:Old news. (Score:2)
I have new windows open up in tabs instead.
Perhaps my setup could be exploited a different way, I am not sure I am 100% safe, but at least the flaw can be sidestepped in some instances.
Re:Old news. (Score:2)
And (Score:2, Troll)
Re:And (Score:2)
Re:Old news. (Score:2)
So why can't we get a plug-in to spoof primidi org (Roland Piquepaille's whore "technology site"), for those who can't edit their host file. Not all spoofing is necessarily bad, you know.
Alas, Frames aren't going anywhere. (Score:3, Insightful)
"...perhaps Mozilla should just take the lead on this and remove frame support entirely."
As much as I hate frames (oh GOD do I hate frames!), this would be a step back for FireFox and its proponents. One of the largest arguments for using non-IE browsers is compatibility with standards. Frames are in the HTML 4.01 standard, and therefore, removing support would be incredibly hypocritical.
Re:Alas, Frames aren't going anywhere. (Score:2)
Would this be enough? (I'm not sure)
+5 Troll (Score:2, Insightful)
I'd help you on the way to be a +5 Troll (I'd just vote underrated).
While the language is harsh, you are right. Frames do cause problems.
They sound good, but they bring problems with them.
Frames suck... most of the time, but not always. (Score:5, Interesting)
There are many uses for frames that can increase usability or enhance/ease integration with other systems (that you cannot directly modify for example), particularly inline frames -- if you know what you are doing.
Simply saying frames suck without qualifying further only shows your lack of understanding of appropriate applications of them
Re:Old news. (Score:4, Insightful)
Gimme 1.00 $ for each website using frames, and 'll never have to work again ...
Re:layout based on frames is bad (Score:2)
Re:Who is behind these exploits? (Score:2)
Re:As I understand it... (Score:2)
Since he created the master frame, his URL, not Paypal will appear in the address bar.
The problem with this is that you go to, say, Paypal (assuming they use frames), and the malicious code can change what Paypal displays without changing the Paypal URL.
Affects IE, Firefox, Opera (Score:2)
If you had bothered to read the linked demo page [secunia.com] you would know that the bug is present in IE and Opera as well.
I just tried it in IE6 (Win2K) and it works just the same as Firefox.
The only problem is that this feature (affecting the frames of one window from another) is actually used a lot, for example when pop-ups are involved. I know of at least one banking application which will break if they flat out disallow changing one frame from within another.
A better solution would be to only allow it for f
Re:Tough Issue (Score:2)
Like much on the web frames are often used badly, but they can be useful for navigation.
Re:Tough Issue (Score:2)
Its a compromise, and a safe one, because if they have javascript disabled, you can't inject the malicious frame.
Re:What is the name of the developer... (Score:2)
Yes, we hear that all the time with the Microsoft products. Here, whenever a disastrous Windows bug allows worms to run riot, or drive-by spyware installs to devastate hundreds of desktops, we always ring Redmond and demand to know the name of the developer who introduced the bug, and what Microsoft plan to do to