Mozilla UI Spoofing Vulnerability

This is nothing... by Anonymous Coward · 2004-07-30 22:08 · Score: 3, Funny

You think your Mozilla or FireFox has neat features like that?

Well my friend, my IE can beat your browser many times over!

HA!

Re:This is nothing... by westyvw · 2004-07-30 22:12 · Score: 0, Troll

Lets see how long this takes to fix.

IE months.

Mozilla 2 days tops.

HA you IE fools!
Re:This is nothing... by ceejayoz · 2004-07-30 22:19 · Score: 5, Informative

except it has been a known issue since 1999...
Re:This is nothing... by dedazo · 2004-07-30 22:41 · Score: 1

Mozilla 2 days tops.
Try five years.

--
Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo
Re:This is nothing... by auzy · 2004-07-30 22:45 · Score: 3, Insightful

Its not really an issue though.. Even if this is fixed, theres 10000 different ways of doing the same kind of thing that will throw off even most security experts. Even if its changed, there will be other ways of pretending the bar exists.. They made it confidential because theres no way to fix it.. If they fix it this way, blackhats use javascript..

Rat never thought this thru. I think his trying to gain attention over something which he never bothered contemplating that there was no possible solution anyway.

Thanks to him now, his given just about every credit card frauder on the planet new ideas (and even implemented the paypal clone code for it too). They made it confidential to just stop ppl panicing about something which has always been possible and to try to stop frauders from adding this technique to their arsenal.. Now, Rat has done an incredibly smart move and gave spammers, credit card frauders, script kiddies some new ideas.. And for that, we have to thank him
Re:This is nothing... by Jugalator · 2004-07-30 22:54 · Score: 2

Its not really an issue though..

Of course it is. It doesn't stop being an issue just because it can be done in other ways as well. It doesn't stop being an issue because it can't be fixed (more like the opposite in that case).

If they fix it this way, blackhats use javascript..

Maybe, but Javascript won't do a nearly as good job as XUL itself to make pretty much a 100% identical version of the interface that's interactive and all.

--
Beware: In C++, your friends can see your privates!
Re:This is nothing... by unoengborg · 2004-07-30 23:00 · Score: 1

2 days?
Isn't that a very long time for finding the advanced preference where you turn off mozillas ability to hide the toolbar, statusbar, changeing the statusbar text, moving or rezizing existing windows, etc

Seriously, this is hard to fix. Some people need these features. Just turning them off by default is not a good solution.

Perhaps they could turn them off by default, and then allow users to turn them on as they occur on a site by site basis . They already have a similar solution for popup windows.

--
God is REAL! Unless explicitly declared INTEGER
Re:This is nothing... by Anonymous Coward · 2004-07-30 23:07 · Score: 0

Even if this is fixed, theres 10000 different ways of doing the same kind of thing that will throw off even most security experts.

Experts don't browse with javascript enabled, so it's pretty obvious actually. The solution is to disable javascript or anything else not under the users control... flash for example!
Marketers and morons don't like this solution for some reason but for the rest of us it is the right thing to do. A polite note to webmasters when their site becomes non functional without javascript is how progress needs to be made.
Re:This is nothing... by dedazo · 2004-07-30 23:09 · Score: 5, Interesting

That's nice, except that when "blackhats" do the same thing to people who use IE then it's Microsoft's fault.
Oh, and there's no excuse for "security through obscurity", especially when you've spent the past five years ridiculing the evil empire for it and thumping your chest singing the praises of being open and honest about the same thing. I don't care if this particular issue is interpreted as a bug, a vuln, a feature or anything else. The Mozilla folks kept this jewel mum for five years as far as I can tell. You know what? That means that XUL is probably flawed in some fundamental way and they know it. And if that's not the case, the fact that they hid it sure makes it seem that way.
I suspect we're going to start seeing many more of these as Mozilla gains a foothold. Perhaps all our retarded zealot fanboys will being the understand that actual vulnerabilities aside (which affect all code), plain user stupidity and the fundamental problems of the browser as an application platform make up for a large percentage of the perceived problems with IE. Heck, the other day I rain into a page that wanted me to install some XPI malware.
Maybe we're not so superior after all when people actually use what we do. Reality intrudes on the best laid plans, I guess.

--
Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo
Re:This is nothing... by auzy · 2004-07-30 23:11 · Score: 3, Interesting

actually, you can make javascript almost as interactive.. The only advantage for this one is the theme is the same, and the bookmarks are there.. I'm actually thinking about whether its worth making a javascript clone which would fool 90% of people, and be actually a higher risk because it would work on IE too, and safari, and whatever else available.. Of course, I believe in reusable programming and the only people who would look at the code for such a thing, would be the last people you want to see it
Re:This is nothing... by Anonymous Coward · 2004-07-30 23:37 · Score: 0

actually, you can make javascript almost as interactive.. The only advantage for this one is the theme is the same, and the bookmarks are there..

Please read the article before posting next time.
"So what is safe from tampering? A bad guy can't read your browser preferences. He doesn't know whether you use large toolbar icons or small ones, what your bookmarks are, or what sort of extensions you have installed."
Re:This is nothing... by auzy · 2004-07-30 23:59 · Score: 2, Insightful

In 99% of cases, he doesn't need to, he just needs to be close enough. For such a thing to work well, he'd probably have to/want to open up a new window anyway full screen, during which time, 99% of people will forget if theres a special bar there, and not notice that their theme is a light white instead of their normal light pink, and 99% of ppl dont touch the bookmarks bar, so the defaults would be fine.. And nevertheless, those who would fall for something like this would just assume that those small changes are a bug in mozilla. I dont think with this 'exploit' they can put your extension bars there anyway.. Maybe your bookmark bar, but you'll notice that if u look at the code of the spoof, that there might not actually be a way to do that.

You have to think logically, to do something like this you have to give someone a link too, thats where most likely the best place to do a check.. Make sure that if a hyperlink on a page says its http://www.paypal.com, make sure it doesn't go to http://killme.com .. Because in most phishing cases, people actually fall for it because the link is false anyway and just looks the same..

I still think that something like that something like this in javascript would affect just as many ppl as the XUML version.. But be more dangerous because it affects every browser
Re:This is nothing... by smallfries · 2004-07-31 01:43 · Score: 2, Interesting

Actually this is nothing for me. Does it work for anyone else? The screenshot looks quite well done but the actual spoof just bombs out on my copy of firefox with an xml parsing error and a *huge* 5000 pixel wide yellow window. That didn't exactly take me in...

--
Slashdot: where don knuth is an idiot because he cant grasp the awesome power of php
Re:This is nothing... by HuckleCom · 2004-07-31 02:21 · Score: 0

There's safety in numbers... firefox is exponentially less used than internet explorer.

Now that people are fed up with internet explorer, firefox is the new great thing and everyone is recognizing it- even the reverse engineers...
Re:This is nothing... by GoldMace · 2004-07-31 02:29 · Score: 2, Insightful

What people exactly need the status bar to be hidden?

I don't want any website to ever be able to hide the status bar, for any reason.

For that matter, I don't want any website to be able to hide my address bar, toolbar, or menu bar either.
Period. Why is THIS not an option in Mozilla or Firefox. This is my computer why is that not an option?
Re:This is nothing... by Michalson · 2004-07-31 02:45 · Score: 5, Interesting

You should really read the Mozilla vuln. list. While they only allow things that have been reported, *already fixed*, and *gone for 2 versions already*, it does provide a pretty scare look at Mozilla's "security", or lack there of. While I will be the first to admit this model of secrecy has worked in the past, it doesn't look like it will in the future. First, a lot of people are moving to Mozilla and Firefox, making it a viable target (I've already seen several instances xpi spyware/trojans ["please install me to make your clock run accurately"] being used in place of traditional ActiveX), and second, security reporting has been changing. In the past Mozilla security bugs where reported directly to Mozilla, where they could be kept secret as long as it took Mozilla to fix them - I've only seen a few rare cases of someone actually taking their grievances about Mozilla's slow bug fixing public (like the 1 line Javascript exploit for taking down every Mozilla window and tab at once, which took a year to fix, finally being done when the vulnerability was reposted to a public board, which prompted it to be fixed silently shortly after 1.7 came out). With Mozilla and Firefox "mainstream" browsers now, real security experts are starting to look at them, and they don't play Mozilla's game. They want credit for their discovery, so they don't want to have it shuffled under the rug while Mozilla pretends it never existed. This means publicly announcing exploits, which not only forces Mozilla to radically change how quickly they respond to security bugs, but also forces them to publicly inform users that they should upgrade to the latest build (before of course they just kept fixes secret and let everyone who doesn't download a 12MB build everyday browse with arbitrary code execution vulnerabilities, since saving their own face was more important). The fact that Mozilla vulnerabilities are going to start getting announced within days or hours of them being patched means you're going to start getting exactly what you get in IE - hackers take the bug, make a working exploit, and deploy it a week or month later against the 90% of people who didn't download Mozilla's daily bugfix (perhaps a bigger problem then IE, since Mozilla demands you download the whole 12MB thing, instead of just a little 100KB patch file). Remember Blaster - easy, 56k friendly made available more then a month before it hit. Now try "easy, 12MB patch made available on a weekly basis" and see how few people are keeping ahead of the hackers.
Re:This is nothing... by Fuzzle · 2004-07-31 02:48 · Score: 1

Those are simply checkboxes in the existing UI, so it shouldn't be hard at all for them to find the preferences. I can't think of one good reason why any _user_ would need the toolbar shown all the time (Short of business presentations).
Re:This is nothing... by Atrax · 2004-07-31 03:00 · Score: 1

Err..... if the bad guy can't read my preferences and find out wht my theme is, how come the proof of concept appeared in MY THEME?

what, did this guy just happen to use Charamel for his PoC?

or hang on, was this not your point?

--
Screw you all! I'm off to the pub
Re:This is nothing... by Atrax · 2004-07-31 03:05 · Score: 3, Insightful

> Experts don't browse with javascript enabled, so
> it's pretty obvious actually.

So how do these experts have any idea what will affect the end user? From their non-javascript Ivory Tower, they survey the scene and see all is good. meanwhile, Joe Dickwad sends his credit card info to the Ukraine, thinking he's just bought his momma a bouquet for mothers' day.

To secure the end user's experience, you need to experience things from an end-user perspective.

[this comment is nitpicking the post, not the experts, by the way]

--
Screw you all! I'm off to the pub
Re:This is nothing... by Anonymous Coward · 2004-07-31 03:17 · Score: 0

Um, MS has a habit of patching some things (IE: MSBlast) Almost a full year BEFORE the release of an exploit so STFU
Re:This is nothing... by Anonymous Coward · 2004-07-31 03:20 · Score: 0

What the heck are you talking about? Mozilla does put out small patches!
Re:This is nothing... by Anonymous Coward · 2004-07-31 03:31 · Score: 0

firefox is exponentially less used than internet explorer
Exponentially less used? You mean with a negative exponent, yes?
Re:This is nothing... by Anonymous Coward · 2004-07-31 03:55 · Score: 0

The grandparent post said "The only advantage for this one is the theme is the same, and the bookmarks are there", the theme is the same yes but the bookmarks are not there (the page explicitly states they cannot be accessed) and although it will appear in your theme it does not know if, for example, you use large or small icons as it cannot access the preferences (for me I saw large icons whereas in my browser I have small ones). Of course this may be "good enough" to fool some people but then again so are many things -- my brother is still fooled by those banner ads that look like dialog boxes ;-).
Re:This is nothing... by Zaiff+Urgulbunger · 2004-07-31 04:13 · Score: 1

The update between 0.9.1 to 0.9.2 is the only fix that I can think of that was available as an XPI update. Are there any others?

It will be interesting to see how this issue is handled. I think that Michalson's comments are valid, and I guess it highlights a need for an auto-update feature using delta's to make it viable over dialup connections.
Re:This is nothing... by hkmwbz · 2004-07-31 04:59 · Score: 1

"With Mozilla and Firefox "mainstream" browsers now, real security experts are starting to look at them"
I don't get this defeatism. First off, real security experts have looked alternative browsers for years. Opera and Mozilla have been scrutinized from the bottom up. Why do you think vulnerabilities are reported in the first place? Because people have been looking for them for ages.
It is very true that as the browser is more widely used, more attacks will be designed for it, but here's the thing:
Firefox has a far better security record than MSIE despite the occasional vulnerability.
The same goes for Opera. Whitehats do discover vulnerabilities, and yes, it is important to fix them rapidly, before they can be exploited.
But I don't get people like you, who all but say that everyone should just give up and move back to IE because Firefox has vulnerabilities. Would you jump over to a sinking ship if you discovered a loose screw in your own boat? It sounds like you would.
Alternative browsers have fewer and less serious vulnerabilities, and they are not exploited as often. And if more people started using alternative browsers, and we got even more alternatives to use, then a security hole in one browser wouldn't be a disaster like vulnerabilities in IE today are.
We have to continue to evangelize for alternative browsers. Not only does it give users an actual choice and avoid lock-in if we get real competition. Security holes will have far lesser impact.

--
Clever signature text goes here.
Re:This is nothing... by NutscrapeSucks · 2004-07-31 05:03 · Score: 1

Indeed. The scary thing was when you looked at the release notes and they would sometimes say "Upgrade to Mozilla 1.x Alpha for security fixes.", and you're wondering if are really suggesting that you roll out an Alpha-Test browser to your entire company.

Hopefully the recent 1.7/0.9 patches are an indication of a reformed patch policy that treats Mozilla like a real product and not Netscape's developer "testing only" playground.

But it is absurd that Mozilla has not been clear on exactly what their patch policy really is. Their security page is a bunch of mumbo-jumbo. Especially with Microsoft is getting roasted over the lack of IE patches, the "monthly cycle", etc.

--
Whenever I hear the word 'Innovation', I reach for my pistol.
Re:This is nothing... by Anonymous Coward · 2004-07-31 05:09 · Score: 0

Would you jump over to a sinking ship if you discovered a loose screw in your own boat? It sounds like you would.

I would consider jumping over to another ship if the people maintaining the ship that I was on knew that the screws were being loosened but did nothing about it. Especially when those "screws" are in plain sight for everyone to see and exploit. Isn't that the whole benefit of having open source? So that everyone can see the source, find vulnerabilities, and patch them up? But the Mozilla team had known about this bug for 5 years, did nothing about it, and kept it confidential from everyone. Why exactly? I can understand doing this for a few months maybe, but 5 years? I'm not saying IE is perfect (or any better), but atleast their source isn't available for everyone to go in and find problems to exploit.
Re:This is nothing... by Michalson · 2004-07-31 05:17 · Score: 1

But I don't get people like you, who all but say that everyone should just give up and move back to IE because Firefox has vulnerabilities.

When did I say people should go back to IE? It sounds like you trying to draw me as rooting for IE just so you have a straw man to burn down. What I pointed out is that the times are changing, and if Mozilla doesn't change with them, it will end up just like IE. Apache has been able to work as a mainstream piece of software, so has Linux itself. Mozilla just needs to realize that secret vulnerability lists (even of fixed vulnerabilities) won't work well for much longer. Security through obscurity doesn't work.

Alternative browsers have fewer and less serious vulnerabilities, and they are not exploited as often.

Can you actually back that up, or are you just making a blanket statement based on a zealots "alternative" viewpoint. A bank with a vault made of cardboard may have a better security record then a bank whose vault is made of steel, but that's only because the cardboard bank has less then $10 stored there. I suggest you actually read the admitted vulnerability list (I admit it's nested as deeply as possible on Mozilla homepage, but Google should be able to help you). While I won't make a blanket statement like yours, when you look at the facts, Mozilla does seem to be at least a healthy competitor for IE, the only difference is that Mozilla never bothered to tell you that another near monthly arbitrary code vulnerability had been patched. They simply let you browse in ignorence chanting how Mozilla is open source, there force it must be secure. That is what Mozilla needs to change if they want to succeed on the big stage.
Re:This is nothing... by Anonymous Coward · 2004-07-31 05:28 · Score: 0

First off, real security experts have looked alternative browsers for years. Opera and Mozilla have been scrutinized from the bottom up. Why do you think vulnerabilities are reported in the first place? Because people have been looking for them for ages.

Then why did it take five years for this particular issue to surface? If real security experts have been examining Mozilla and Firefox for years as you assert then:

1. They have overlooked this vulnerability for years.
2. They have not reported it for years.

Either way their efforts have not been very reassuring.

This also adds doubt to the claim that open source is more secure because people can look at the code. It appears that this issue has existed for five years yet we're only hearing about it now. If, as has often been claimed, people really are looking at the source then you have the same situation as with the experts.
Re:This is nothing... by Anonymous Coward · 2004-07-31 06:26 · Score: 0

http://www.mozilla.org/projects/security/known-vul nerabilities.html
Re:This is nothing... by Pieroxy · 2004-07-31 06:46 · Score: 1

Of course, the fact that your firefox doesn't fall for it probably makes it not a real threat. Viva Mozilla!

At least, yours is more secure than IE.

--
Write boring code, not shiny code!
Re:This is nothing... by Anonymous Coward · 2004-07-31 07:18 · Score: 0

"That's nice, except that when "blackhats" do the same thing to people who use IE then it's Microsoft's fault."

Well of course it is. They are Microsoft. If you give it a few posts someoen will blame this on Microsoft too somehow.

Welcome to /.
Re:This is nothing... by hkmwbz · 2004-07-31 07:43 · Score: 1

"Then why did it take five years for this particular issue to surface?"
Irrelevant. The same can be asked about IE. Why did it take X years for all those recent exploits in Internet Explorer to surface?
"This also adds doubt to the claim that open source is more secure because people can look at the code."
Certainly. Even Opera, a closed-source program, is more secure than IE.

--
Clever signature text goes here.
Re:This is nothing... by hkmwbz · 2004-07-31 07:51 · Score: 1

"I would consider jumping over to another ship if the people maintaining the ship that I was on knew that the screws were being loosened but did nothing about it."
Sounds like Microsoft and the known and still unpatched vulnerabilities. It's sad that security company which had a page with 30 or so unpatched and well known security vulnerabilities in Internet Explorer let themselves be bribed to take the page down.
"Especially when those "screws" are in plain sight for everyone to see and exploit. Isn't that the whole benefit of having open source?"
You would have to ask them open-source advocates about that. I personally prefer Opera, a closed-source browser.
"I'm not saying IE is perfect (or any better), but atleast their source isn't available for everyone to go in and find problems to exploit."
This comment does not make sense. First you insinuate that open-source is supposed to be more secure because more people can look at the code. Now you say that it's less secure because people can look at the code.
But guessing either way is useless. The fact is that with open-source anyone can check the code. That can be a good thing or a bad thing. But it is also a fact that Firefox is still more secure than Internet Explorer.
And aren't most exploited vulnerabilities discovered by whitehats in the first place? So thinking that some blackhat would bother to waste his time reading through the Firefox source code to find security holes seems a bit far-fetched.

--
Clever signature text goes here.
Re:This is nothing... by Fat+Cow · 2004-07-31 07:56 · Score: 1

it's just a demonstration of the principle - a real spoofer could make it better.

--
stay frosty and alert
Re:This is nothing... by Sklivvz · 2004-07-31 09:45 · Score: 1

From the error page:
XML Parsing Error: undefined entity Location: http://www.nd.edu/~jsmith30/xul/test/browser2.xul Line Number 91, Column 83:<command id="Browser:ReadMail" oncommand="MailIntegration.readMail();" label="&mailButton.readMail.label;"/>

--
My Stack Overflow user
Re:This is nothing... by jrockway · 2004-07-31 09:50 · Score: 1

He just uses the icons from your theme. Move the buttons around on your toolbar; that he can't mimic.

--
My other car is first.
Re:This is nothing... by Anonymous Coward · 2004-07-31 14:00 · Score: 0

MoveOn.org is well-known for its lies. Get over your personal hatred for George Bush. It's no longer about the issues, it's about being able to say you were "right" and the evil Republics were "wrong." Two groups of bullies on the school playground. You morons are the reason our two-party system still exists, a two-headed snake enslaving us.
Re:This is nothing... by ColMustard · 2004-07-31 14:20 · Score: 1

atleast their source isn't available for everyone to go in and find problems to exploit.

This problem wasn't discovered by finding a security hole in the source. In fact, it isn't even a security hole in the code. It's a security problem by design.

Nice theory, though. Have you ever even heard of any holes being exploited because the source was available anyway?

--
Moof.
Re:This is nothing... by ColMustard · 2004-07-31 14:26 · Score: 1

This also adds doubt to the claim that open source is more secure because people can look at the code. It appears that this issue has existed for five years yet we're only hearing about it now.

This point is moot simply because this problem is not a problem with the code. It's a design problem. Therefore, even if you read every line of the code it's not something that you're going to see and say 'yep, there's a security bug.'

But I agree with your other points. Basically, they screwed up big-time to keep this issue under the table. It's a ding to their name IMO.

--
Moof.
Re:This is nothing... by Anonymous Coward · 2004-07-31 15:26 · Score: 0

The Mozilla folks kept this jewel mum for five years as far as I can tell.
Yeah, real mum. They hid it on their public bug list.
Re:This is nothing... by HuckleCom · 2004-07-31 18:21 · Score: 0

Internet explorer has an exponentially higher amount of users than firefox... smartass..
Re:This is nothing... by Anonymous Coward · 2004-07-31 19:22 · Score: 0

Stop trolling, yoou Microsoft astroturfer.
Re:This is nothing... by srcosmo · 2004-08-01 00:06 · Score: 1

Perhaps Firefox's update notification could be adapted to give "Critical Update" warnings, for really nasty bugs.
Ie. when checking for updates, a dialog box pops up: "Your copy of Firefox has a critical security vulnerability. Click 'Next' to fix this problem."
Users will want it to stop bugging them, and choose to install the patch. Since the user hardly has to take any initiative at all, this could go a long way toward solving the hardest part of the process -- getting people to install the damn patch.

--
free speach
Did you mean: free speech

So... by Anonymous Coward · 2004-07-30 22:09 · Score: 0

Is this the first post, or just a spoof?

Not another one! by Nermal6693 · 2004-07-30 22:09 · Score: 5, Funny

I've lost faith in Secunia, they seem to love pointing out security holes in open-source products. So I just ignore them now.

Re:Not another one! by rking · 2004-07-30 22:11 · Score: 0, Redundant

I've lost faith in Secunia, they seem to love pointing out security holes in open-source products. So I just ignore them now.

If you're using open source software then a site that loves pointing out security holes in those programs sounds very useful. If you're not using open source then I can see your point.
Re:Not another one! by Zeal17 · 2004-07-30 22:14 · Score: 2, Interesting

I've lost faith in Secunia, they seem to love pointing out security holes in open-source products. So I just ignore them now.

Does this make the point less valid? The open-source community seems to react quickly to criticism like this, so my guess is there will be a fix quickly.

--

"If it sucks without butter, it still sucks with butter, only creamier." - AC
Re:Not another one! by Pahalial · 2004-07-30 22:24 · Score: 3, Interesting

You -do- realize they've known for 5 years, right? We're only hearing now because it's apparently starting to be used in the wild, not to mention someone published research about using chrome spoofing.

--
Stuff.
Re:Not another one! by Zeal17 · 2004-07-30 22:34 · Score: 1

Well, the grandparent was implying that Secunia was reporting mostly bugs in OSS, and therefore should not be listened to, I was just pointing out that ANY news is good. If this exploit had been publicized 5 years ago, we wouldn't be talking about this now.

--

"If it sucks without butter, it still sucks with butter, only creamier." - AC
Re:Not another one! by Anonymous Coward · 2004-07-30 22:37 · Score: 1, Informative

The grandparent was being funny and the following posts mistook mild humour for a troll.
Re:Not another one! by Anonymous Coward · 2004-07-30 23:02 · Score: 0

Hey dumbass, I think your joke-detector has broken down
Just FYI
Re:Not another one! by Nermal6693 · 2004-07-30 23:14 · Score: 3, Funny

But at 21, I'm too young to be a grandparent! ;)
Re:Not another one! by pjt33 · 2004-07-30 23:19 · Score: 1

Setting someone up with a beautiful straight line. Who's going to get the +5 funny reply?
Re:Not another one! by AsbestosRush · 2004-07-31 00:14 · Score: 1

It's amazing what time travel devices can do, however.

--
EveryDNS. Use it. It works.
AC's need not reply
Re:Not another one! by Anonymous Coward · 2004-07-31 02:20 · Score: 0

Go easy, he's Swiss! Only the Germans have a less-functional sense of humor.
Re:Not another one! by ryane67 · 2004-07-31 02:45 · Score: 1

nice... so as soon as someone points out enough flaws in OSS that must mean they are against it.... I bet they are PAID by M$ to point out OSS vulnerabilities.

Wait no, maybe they just want to make it better.

some of you guys way overreact to things like this, you just have to realize that as your precious OSS grows to be the king of the hill people will write exploits for it too.

Note: Im using firefox to type this message

--
?SYNTAX ERROR IN LINE 42
Re:Not another one! by Anonymous Coward · 2004-07-31 04:41 · Score: 0

*woosh*
Re:Not another one! by ibbey · 2004-07-31 09:56 · Score: 1

some of you guys way overreact to things like this, you just have to realize that as your precious OSS grows to be the king of the hill people will write exploits for it too.

And some of you guys need to get a sense of humor. The parent was making a joke!

I'm using Firefox... by Anonymous Coward · 2004-07-30 22:09 · Score: 5, Funny

so am I really seeing slashdot, or is someone trying to spoof me, while at the same time ironically warning me about said Firefox spoofs?

Re:I'm using Firefox... by sanctimonius+hypocrt · 2004-07-30 22:19 · Score: 0, Troll

am I really seeing slashdot, or is someone trying to spoof me
It's really Slashdot. If it were a spoof, you wouldn't have to reload so many times
Re:I'm using Firefox... by HoneyBunchesOfGoats · 2004-07-30 22:20 · Score: 5, Funny

You can tell that it's not the real slashdot because they got the colors all wrong.
Re:I'm using Firefox... by King_of_Prussia · 2004-07-30 22:21 · Score: 2, Funny

I think I'm being spoofed, only a colourblind script-kiddie from Norway could have chosen a background colour this vomit-inducing.

--
Making the moon less necessary since 1998.
Re:I'm using Firefox... by dedazo · 2004-07-30 22:34 · Score: 1

No, those cool 503 server errors are real.

--
Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo
Re:I'm using Firefox... by Pharmboy · 2004-07-30 22:38 · Score: 2, Funny

Depends, did you get a bunch of 500 and 503 errors? Then its the real Slashdot. Oh, and look for dupes on the front page, the spoof's don't do that.

--
Tequila: It's not just for breakfast anymore!
Re:I'm using Firefox... by Anonymous Coward · 2004-07-30 22:55 · Score: 0

so am I really seeing slashdot, or is someone trying to spoof me, while at the same time ironically warning me about said Firefox spoofs?

Just like in the Matrix, there is no spoof.
Re:I'm using Firefox... by Anonymous Coward · 2004-07-30 23:18 · Score: 0

They should fix their damn server!
Re:I'm using Firefox... by whovian · 2004-07-30 23:20 · Score: 1

am i really seeing slashdot...?

Does the page render blank, or do you not have to tweak you font size back and forth? ;)

--
To-do List: Receive telemarketing call during a tornado warning. Check.
Re:I'm using Firefox... by moonbender · 2004-07-30 23:42 · Score: 1

Well... the colors are different, but they still make me want to claw my eyes out, so it's basically the same.

--
Switch back to Slashdot's D1 system.
Re:I'm using Firefox... by kunjan1029 · 2004-07-31 00:04 · Score: 1

tell me this beige is spoofed. tell me this beige is not from slashdot.

--
Re:I'm using Firefox... by Anonymous Coward · 2004-07-31 00:36 · Score: 5, Funny

man...oh man. this reminds me of the time our "cio" first heard about ip spoofing back in 97.

for the next 3 months every problem was probably caused by "spoofing"...he drove us nuts with that bullshit.

so to fuck with him, we created fake security/vulnerability reports about a new threat: "goof balling"

we could barely keep from wetting our pants as he ran around for the next 3 months telling everyone "we are being goof balled"
Re:I'm using Firefox... by dillee1 · 2004-07-31 01:07 · Score: 5, Funny

Fuck, I thought that was the VGA cable getting loose again and tried to fix it.
Re:I'm using Firefox... by Anonymous Coward · 2004-07-31 01:20 · Score: 2, Funny

You can download a fix here

After installing this, I am not vulnerable to this security threat.
Re:I'm using Firefox... by Halfbaked+Plan · 2004-07-31 02:37 · Score: 1

Colors on Slashdot? "Use the 'Light' setting in your Slashdot Config, Will Robinson...."

--
resigned
Re:I'm using Firefox... by rocjoe71 · 2004-07-31 02:57 · Score: 1

Forget the browser, The Matrix has you and your entire life is being spoofed.

--
Height: 38U, Weight: 0 Newtons, Eyes: #0000FF, OS: Gray Matter 1.0 (Alpha)
Re:I'm using Firefox... by scruffy · 2004-07-31 04:23 · Score: 0, Troll

Mozilla and Firebox are cool, but spoofing sucks, 5-year old bugs suck, and so does this color scheme.
Re:I'm using Firefox... by Anonymous Coward · 2004-07-31 05:14 · Score: 0

At first I thought it was okay. Then I noticed that the links are almost the same colour as the background. Way to go Taco.
Re:I'm using Firefox... by Anonymous Coward · 2004-07-31 19:33 · Score: 0

the spoof's don't do that.

"spoofs".

Vulnerability? by insecuritiez · 2004-07-30 22:11 · Score: 3, Interesting

Excuse me but isn't this "vulnerability" the same thing as saying the pop-up ads that look just like IE on Windows XP are a IE/Windows XP vulnerability? This customizability (albeit automatic by the webpage) is closer to a feature than a vulnerability if you ask me.

Re:Vulnerability? by kristofme · 2004-07-30 22:19 · Score: 3, Informative

I had the same opinion initally, but if you check out the spoofed Mozilla window you have to admit this could prove to be dangerous..
Having said that, I'll stick to Firefox nonetheless - let's just hope the Firefox team will find a way to fix it soon.
Re:Vulnerability? by NetNifty · 2004-07-30 22:20 · Score: 3, Insightful

It's probably possible to do with IE too, but the worrying part of this exploit is the fake security certificate it produces. Easy way to disable the exploit working is to disable allowing javascript to hide the status bar - the menus etc still comes up but you can tell it's fake because of the extra status bar.

--
Linux Wireless Hardware in the UK
Re:Vulnerability? by pinny20 · 2004-07-30 22:20 · Score: 5, Insightful

No, because it's using Chrome, so the fake window will have the same theme as the user is using, and if coded cleverly enough, even an experienced user wouldn't be able to easily tell the difference - e.g. Menus will operate in the same way etc.
Re:Vulnerability? by MoogMan · 2004-07-30 22:26 · Score: 4, Insightful

You are right in the sense that it is not a "standard" vunerability as such, but as is the case for IE "spoofing", it is still valid. It could still cause users to think a spoofed page is a real page, so in essence the browser is "vunerable".

As a sidepoint, I think the actual vunerability is the fact that XUL can be effectively imported and utilised from a website, rather than a vunerability saying "you can spoof the xyz browser using http user-agent flags and jpeg images" as a bad example :)
Re:Vulnerability? by drskrud · 2004-07-30 22:27 · Score: 1

By the same token, if you just don't use the default Firefox settings you'll be able to notice the differences.
Re:Vulnerability? by lachlan76 · 2004-07-30 22:56 · Score: 1

The only thing is that that window on the site doesn't have the web developer toolbar, the bookmark toolbar, and my 15 tabs, so for me it's easy to tell the difference. But it scares me too.
Re:Vulnerability? by FyRE666 · 2004-07-30 23:05 · Score: 4, Insightful

Excuse me but isn't this "vulnerability" the same thing as saying the pop-up ads that look just like IE on Windows XP are a IE/Windows XP vulnerability? This customizability (albeit automatic by the webpage) is closer to a feature than a vulnerability if you ask me.

Exactly - furthermore, you can easily do exactly the same with IE. You just create a new window, with the fullsize property set, then set the dimensions (so you then have a blank window with no chrome at all - not even a title bar) - after that it's simply a matter of adding your spoofed interface using DHTML... Game over.

--
Code, Hardware, stuff like that.
Re:Vulnerability? by mcsmurf · 2004-07-30 23:21 · Score: 1

The (first) fix will be that it isn't allowed to hide the statusbar anymore (by default). So on that spoof site you would actually see two status bars then (one fake, one real).
Re:Vulnerability? by bcmm · 2004-07-30 23:36 · Score: 2, Funny

And here is a perfect reversal of how /. usually works. Someone says "I can do X with FireFox, but not in IE", and someone else points out how to do the same with IE...

--
# cat /dev/mem | strings | grep -i llama
Damn, my RAM is full of llamas.
Re:Vulnerability? by NoMercy · 2004-07-31 00:01 · Score: 1

It's a feature and a vunribility, such features should only be available to trusted documents not by default to any website which wants them.
Re:Vulnerability? by MarkByers · 2004-07-31 00:03 · Score: 1

Even then, the real toolbar can be made to appear off the screen (on Gnome), so unless you resize the window, you won't notice that there are two status bars. Even when I disabled all advanced javascript options, the spoof site was still pretty convincing at first glance.

--
I'll probably be modded down for this...
Re:Vulnerability? by Rosyna · 2004-07-31 00:05 · Score: 1

See, this is precisely the only reason why I am glad Safari uses metal windows. Means any widgets the webpage uses will be apart of the normal aqua theme and not the metal theme.

Also because Safari also uses the OS provided widgets, it is much, much harder to fake because Apple has this silly thing where they redo the interface every major release (and some minor ones).
Re:Vulnerability? by gnu-generation-one · 2004-07-31 00:06 · Score: 1

On Mozilla 1.5, that link causes Mozilla to disappear completely (as in, shuts down all your open windows the same as a kill command would) -- this may be dependant on settings.
Re:Vulnerability? by Anonymous Coward · 2004-07-31 00:08 · Score: 0

not really as it's not a jpg in a popup window
Re:Vulnerability? by RzUpAnmsCwrds · 2004-07-31 00:38 · Score: 4, Informative

"Exactly - furthermore, you can easily do exactly the same with IE. You just create a new window, with the fullsize property set, then set the dimensions (so you then have a blank window with no chrome at all - not even a title bar) - after that it's simply a matter of adding your spoofed interface using DHTML... Game over."

This hasn't worked since Internet Explorer 6.0SP1. You can no longer resize a fullscreen window.

As of 6.0SP2 (due out soon, hopefully) you can no longer create a window without a statusbar.

Moreover, it is difficult to "fake out" the UI using DHTML. You may be able to fool inexperienced users, but it is much harder than doing the same thing using Mozilla's XUL.
Re:Vulnerability? by zerocool^ · 2004-07-31 00:49 · Score: 1

I clicked onto that website, and I clicked the link to show me the vulnerability... and it didn't work for me.

I got:
XML Parsing Error: undefined entity Location: http://www.nd.edu/~jsmith30/xul/test/browser.xul Line Number 233, Column 35: <key id="key_newMessage" key="&sendMessage.commandkey;" command="Browser:NewMessage" modifiers="accel"/>
I'm not sure why, i'm using firefox... Oh, wait, i just realized - I bet it's because I'm using 0.8 still.

Eh, whatever. Not earth shattering, it's not like it replaces system files.

~Will

--
sig?
Re:Vulnerability? by Anonymous Coward · 2004-07-31 01:27 · Score: 1, Insightful

Yes, it is. And that's a major vulnerability on IE as well, albeit one that probably won't be fixed. With Moz it can be fixed very easily - it relies on a setting being at it's default, specifically Web Features | Advanced | Allow Javascript to hide the status bar. Why that defaults to allow I don't know, I suggested years ago it shouldn't, and I always turn it off myself. If the Moz team would just set the default here sensibly this would no longer be a worry, because no one in their right mind would change it back unless they knew what they were doing and had a damn good reason to do so.
Re:Vulnerability? by Directrix1 · 2004-07-31 01:30 · Score: 1

I got the same thing using 0.9.2. The only thing earth shattering about it, is the possibility of snatching people's keystrokes.

--
Occam's razor is the blind faith in the natural selection of least resistance and in universal oversimplification. -- EF
Re:Vulnerability? by Anonymous Coward · 2004-07-31 01:44 · Score: 0

They can't tell what extensions/theme you are using. It's glaringly obvious if you use anything but the default when all of a sudden your icons and menus look different
Re:Vulnerability? by Anonymous Coward · 2004-07-31 02:09 · Score: 0

No it does not have the same theme as the user. It imitates the default theme in the default format, which will trick many, though. Did you even try the link in FireFox? Worse yet how did you get modded to +4 insightful?
Re:Vulnerability? by jafiwam · 2004-07-31 02:09 · Score: 1

..... which is not a big deal.

If the population sample I have experience with is any indication.... half the home computers out there already have key-loggers on them anyway so a few more won't matter.

Spyware is seriously bad. I can protect myself, but friends or family sure can't....
Re:Vulnerability? by spideyct · 2004-07-31 02:13 · Score: 1

Does the fact that IE (which is not known for its security, lately) might have the same issue make it less of a vulnerability?
Admit it, their proof of concept is pretty scary. If you care about safe browsing, you have to care about this.
And the argument about it being a "feature" won't fly. That's exactly the attitude that got Microsoft in so much trouble. Security has to trump features when it comes to networked software.
Re:Vulnerability? by KernelHappy · 2004-07-31 02:38 · Score: 2, Insightful

At first I thought maybe it's more difficult for an observant person to be fooled. So I opened up a spoofed window and compared it to a real window to see how many differences I could find. Now as a child I was pretty damn good at the spot the difference cartoons in highlights magazine, apparently use it or lose it is valid. Only after I specifically looked for them did I realize that my bookmarks toolbar was missing, and from my navigation toolbar several icons were missing and the search control was present again (I have it turned off). In other words if you're drilling through links on a site and suddenly a couple items disappear, I'm gonna guess it's really easy to not notice, regardless of experience levels (in fact maybe experience or more so familiarity make this even more effective an exploint).

The point being that even though I do fancy myself a pretty observant person (honestly I usually am) I didn't notice right off the bat what was missing from my usual interface and I bet most users wouldn't unless they looked for them on EVERY page load.

--
-- Button up, your ignorance is showing
Re:Vulnerability? by Halfbaked+Plan · 2004-07-31 02:43 · Score: 1, Troll

I went to that website you link that supposedly has a demo spoof page.

I use regular plain-vanilla Mozilla and have spurned the light-duty 'Firefox' (it doesn't have a 'compose' button on the lower left of the frame, which to me is a significant bug- a 'browser' that doesn't have the built-in capability to compose web pages sounds like 'consumer-grade' crap to me. Nobody who browses the web should be without some webspace of his/her own, and the tools to easily compose said web pages. Anything else is undemocratic and borderline fascistic.)

The 'demo' page preaches at me that I 'must get firefox!'

Uh, I think I'll skip downloading and installing a piece of software just to load up a sample exploit page and exhibit it's flaws.

--
resigned
Re:Vulnerability? by PReDiToR · 2004-07-31 02:50 · Score: 1

Oh, wait, i just realized - I bet it's because I'm using 0.8 still

Me too, I never found a good reason to upgrade without the extensions that I use becoming available, but that might never happen.

OTOH the "only for this session" option for cookies is a big reason to change over when they do.

--

Do not meddle in the affairs of geeks for they are subtle and quick to anger
Re:Vulnerability? by plj · 2004-07-31 04:04 · Score: 2, Interesting

Interesting thing though, that on OS X nobody's fooled, as the fake menubar appears on the top of the window as an empty bar (without changing the actual menu bar), which will instantly reveal that everything is not as it should be.

--
“Wait for Hurd if you want something real” –Linus
Re:Vulnerability? by iamacat · 2004-07-31 04:32 · Score: 1

Yes, but what to prevent you from creating a child floating window inside an existing page and making it look like a top level dialog box used by the OS, with any title bar you please?

Users will not know the difference unless they try to drag it outside the parent. If you are browsing over dialup and a dialog box pops up saying the connection is broken and you need to enter your username/password, would you really think much of it?

Hell, with Flash you can probably emulate *the whole* windows UI in a fullscreen browser.
Re:Vulnerability? by Anonymous Coward · 2004-07-31 04:47 · Score: 0

You should always look for the padlock in the status bar before entering sensitive information.
Re:Vulnerability? by Donny+Smith · 2004-07-31 04:57 · Score: 1

>As of 6.0SP2 (due out soon, hopefully) you can no longer create a window without a statusbar.

I can't wait for that - with the current version I can't make the goddamn thing _display_ a status bar after restart....
Re:Vulnerability? by FuzzyBad-Mofo · 2004-07-31 05:31 · Score: 1

Browsers allowing script access to the status bar is stupid to begin with. I think this is a "feature" we could all happily live without. Who thought this cousin to the BLINK tag was a good idea anyway?
Re:Vulnerability? by ikkonoishi · 2004-07-31 05:40 · Score: 1

Hmm strange it looked completely different than my theme.
Re:Vulnerability? by Anonymous Coward · 2004-07-31 05:47 · Score: 0

What makes you think there will be a 6.0SP2? They have said for quite a while now they won't be releasing stand alone versions anymore.
Re:Vulnerability? by VertigoAce · 2004-07-31 07:17 · Score: 1

The problem with doing this to WinXP and IE is matching the theme. You can target the old Win98 look and no one with a newer browser will be fooled. Or you can target the big blue and red theme, but users with the win2000 style won't be fooled.

This Firefox exploit matches your themes (OS and Firefox). I've never seen any spoof of IE that was as thorough as this one. Even details like the padlock icon in the bottom left. BTW if you open up the details of the security certificate, there's a line "Bud lights consumed: 9" under the category "Spoofed!". All in all, this is much more convincing than anything I've seen done under IE (made up for of course by all of IE's security flaws).
Re:Vulnerability? by Anonymous Coward · 2004-07-31 07:59 · Score: 0

That's great. Until an exploiter decides to send the browser a different page based on the agent string ... of course, they won't bother, because it's too much of an effort to target the 0.00001% share that Mozilla+OSX users represent.
Re:Vulnerability? by alatesystems · 2004-07-31 10:19 · Score: 1

I use regular plain-vanilla Mozilla and have spurned the light-duty 'Firefox' (it doesn't have a 'compose' button on the lower left of the frame, which to me is a significant bug- a 'browser' that doesn't have the built-in capability to compose web pages sounds like 'consumer-grade' crap to me. Nobody who browses the web should be without some webspace of his/her own, and the tools to easily compose said web pages. Anything else is undemocratic and borderline fascistic.)
You're a troll, but I'll bite.

Real men use vi.
Re:Vulnerability? by pknoll · 2004-07-31 10:37 · Score: 1

It also opened the new window "maximized" (or an attempt at it, anyway) which looked terribly wrong on my Mac. I never allow browser windows to take up that much space.
Re:Vulnerability? by Halfbaked+Plan · 2004-07-31 10:37 · Score: 1

There isn't a html rendering module in vi.

There is one in Emacs, and I use it sometimes.

Real men use Lynx. Sheesh, get with it, d00d.

--
resigned
Re:Vulnerability? by mewphobia · 2004-07-31 13:04 · Score: 1

Yeah but one thing remains. Unless the remote site can get the user to install privledged chrome, a 'spoofed' firefox window won't be able to show your bookmarks toolbar/bookmarks menu.

Remote XUL simply can't access the bookmarks RDF source.

So I guess, what i'm saying is that if you can see your personal bookmarks toolbar, you're safe!

game on!
Re:Vulnerability? by JessLeah · 2004-07-31 13:10 · Score: 1

Most users ARE inexperienced users.

--
Honey, I shrunk the Cygwin
Re:Vulnerability? by Anonymous Coward · 2004-07-31 19:47 · Score: 0

exhibit it's flaws

"its".

And whether or not you use vi (as another respondent suggested), browsing and composing are two different activities. Saying that a browser should allow you to compose web pages is like saying that a media player should allow you to compose music, or that a printer should allow you to enter text. It's just stupid on the face of it. Also, I browse 1000 times as much (or more) than I compose web pages. I update my web page less than once a month. Why should I have to put up with the bloat of having a page composer tacked on to my browser if I don't use it that often?
Re:Vulnerability? by Tony-A · 2004-08-02 15:12 · Score: 1

With Windows, this is a feature.
With Linux, this is a vulnerability.

Now guess which one gets all the malware.
And counting vulnerabilities gives you the wrong answer ;-)
Re:Vulnerability? by RzUpAnmsCwrds · 2004-08-11 19:17 · Score: 1

6.0 SP2 is included with Windows XP SP2.

-1 Flamebait by JamesKPolk · 2004-07-30 22:13 · Score: 0, Flamebait

Let the debate begin: Life would be better/worse/the same if 90% of users used HTTP clients based on Mozilla because...

Re:-1 Flamebait by Zeal17 · 2004-07-30 22:24 · Score: 1

Let the debate begin: Life would be better/worse/the same if 90% of users used HTTP clients based on Mozilla because...

You are right to a point, having close to 100% saturation by any software is a security risk. That is why they took some of the root DNS servers off of bind. The biggest problem with IE is that they use their market share to impose standards that suit them on the world. If there was a more even distribution of browsers out there, no one would have a majority and all of the browsers would have to conform to standards, or fade away.

--

"If it sucks without butter, it still sucks with butter, only creamier." - AC
Re:-1 Flamebait by Anonymous Coward · 2004-07-30 23:44 · Score: 0

My sentiments exactly.

Hopefully the Internet will learn to respect standard organizations like the W3C and WDG a little more as time progresses.

Until then, I don't think we'll ever see an end to the browser wars because there will be at least one side always that is "pushing" new technology. Internet Explorer does this, but in the wrong way. Mozilla at least puts out an effort to abide by the standards already set. Additionally, users from all over the world help create the standards these standards organizations push. And it certainly isn't limited to the imaginations of Microsoft programmers.
Re:-1 Flamebait by JamesKPolk · 2004-07-31 01:02 · Score: 1

How can I be right when I didn't say anything? I called for debate on whether things would be "better/worse/the same."
Re:-1 Flamebait by Fuzzle · 2004-07-31 02:51 · Score: 1

There seemed to be an inferred mockery of those who claim that 100% "is t3h 0|\|ly solu+i0n!!!!111" for the web. Obviously there wasn't, but I can see how s/he got that.
Re:-1 Flamebait by focitrixilous+P · 2004-07-31 05:51 · Score: 1

Let the debate begin: Life would be better/worse/the same if 90% of users used HTTP clients based on Mozilla because...
Evil will always win, because good is dumb.

--
SAILING MISHAP

Marked confidential? by Kristoffer+Lunden · 2004-07-30 22:16 · Score: 5, Interesting

According to the spoof demostration page, this has been known for five years(!) but the bug filed has been marked "confidential". You'd think that the Mozilla team could do better than security through obscurity - that is usually a reserved tactic for "the other team"....

--
Spine World

Re:Marked confidential? by Anonymous Coward · 2004-07-30 22:56 · Score: 0

Have a look at the bug report please. This kind of "bug" can be used with other browsers like IE, and the right way to fix it (if any) is all but obvious. You will at the same time learn a little more about the obscurity policy of the mozilla developers.
Re:Marked confidential? by Neophytus · 2004-07-31 00:26 · Score: 2, Informative

If a fix would be hard and/or time consuming to create then isn't it fairer for the majority of users that it isn't known outside the development group rather than having them rush out a kludge that may introduce more bugs.

That said, five years is a long time.
Re:Marked confidential? by LiquidCoooled · 2004-07-31 01:09 · Score: 1

I don't think this is an isolated case.

This isn't actually a coding error, it is an interface exploit that lets somebody display a semi fake page.

Out of interest, does anyone know why IS the chrome rendering support available to the inner html?

Makes you wonder what *other* bugs/exploits are locked away in their "confidential" list...

--
liqbase :: faster than paper
Re:Marked confidential? by Dausha · 2004-07-31 01:10 · Score: 1

I agree, but it seems the solution is to turn off the "default" Tools->Options->WebFeatures->(JavaScript Enabled) Advanced, the way the notice page suggested. I did that some time ago, because I'm a tad bit paranoid, so I tested the "exploit," and was greeted with something that showed the fishiness of it all. That makes it a tad bit harder to dup some poor, dumb schmuck.

--
What those who want activist courts fear is rule by the people.
Re:Marked confidential? by caino59 · 2004-07-31 01:56 · Score: 1

i have java script enabled, but if you go into the advanced options, and de-select the option to allow scripts to remove the status bar - you end up seeing 2 status bars.

I dont see why a script should be allowed to remove the status bar anyway...

btw, all the advanced option are unchecked...
Re:Marked confidential? by Anonymous Coward · 2004-07-31 02:06 · Score: 0

"Out of interest, does anyone know why IS the chrome rendering support available to the inner html?"

It's not an HTML. It's an xml file. Mozilla uses xml to draw the user interface so all it's doing it making the same tools available to the net. ...
Re:Marked confidential? by archen · 2004-07-31 02:21 · Score: 3, Insightful

I think the problem the Mozilla team has is the same problem that the IE team has, which is the same problem that the Opera team probably has - if you can make a blank window, you can redraw the interface pretty easy. But how do you fix it is the question? If you always draw the menu bar and the status bar you can still recreate the other elements. If you require that the browser always look like the parent window... well that would probably work, although many things on the web would look like crap.

I'm not making excuses for the Mozilla team (I mean this sort of freaks me out) , but I have no idea how to fix it. You could make all the bars "collapsed" on a "blank" window which would allow the user to always click them and look at the mormal UI again, but then you sort of expect that the user would know what those collapseable bars are for. Well it's better than nothing so maybe that's not such a bad idea... Anyway it's a problem with the way web browsers work as much as anything.
Re:Marked confidential? by LiquidCoooled · 2004-07-31 02:58 · Score: 1

What I am asking is why should a user browsable page be allowed to access the chrome library?
I understand the chrome is XML based, and this makes great sense, but it is the reasoning required to make it available in userspace. This is equivilent to allowing (for instance) full file access within the Java sandbox.

I just cannot see a valid reason for it being there.

--
liqbase :: faster than paper
Re:Marked confidential? by DavidTC · 2004-07-31 03:13 · Score: 1

It's not fucking complicated how to fix it, and the solution works for every browser out there: Stop letting web pages turn off the URL box and menus. DUH.
I've had issues with that ever since I learned it was possible.
Firefox lets you stop people from turning off the status line, which seems rather idiotic. It's easy enough to create a fake paypal login with links that point to the real site, and a 'login' form that doesn't...and forms don't update the status bar. The important thing is never ever ever letting people turn off the address bar, ever. (Also, don't let them size a window to offscreen.)
Microsoft, sadly, is solving this problem the same way as Mozilla 'solved' it, by not letting people turn off the status bar in SP2.
I, personally, are not vulerable to this, as both IE and Firefox have the buttons and the URL field next to my menu on the same line. However, it's not like this is the only computer I ever use.

--
If corporations are people, aren't stockholders guilty of slavery?
Re:Marked confidential? by GoofyBoy · 2004-07-31 03:58 · Score: 4, Interesting

So its ok for Mozilla/Firebird to utilize security through obscurity, yet when a closed source application?

And aren't a thousand eyes suppose to be looking at the code and fixing it? So shouldn't the fix come quickly? Isn't that the strength of OpenSource? If in theory it sounds good but in reality it doesn't work, what good is it to have a thousand eyes looking at the code for security purposes?

--
The surprise isn't how often we make bad choices; the surprise is how seldom they defeat us.
Re:Marked confidential? by Anonymous Coward · 2004-07-31 04:37 · Score: 1, Insightful

This isn't the exact same problem as seen on other browsers.

Here the fake page can use the exact same XUL UI controls as the real browser, instead of emulating them with DHTML. That lowers the bar significantly.
Re:Marked confidential? by Creedo · 2004-07-31 04:55 · Score: 2, Interesting

It is there to allow you to use Mozilla/Firefox as an actual application development platform. For more information, look here.

--
All that is necessary for the triumph of good is that evil men do nothing.
Re:Marked confidential? by Zaiff+Urgulbunger · 2004-07-31 04:55 · Score: 1

Even replace image? I would've thought that might break a few sites (I know mostly its just used for roll-overs, but there are functional uses for it too)
Re:Marked confidential? by Anonymous Coward · 2004-07-31 05:29 · Score: 1, Interesting

Fix it the same way Java fixed it many many years ago. If the user creates a window which is not a browser window, display a security warning at the bottom of it. I'm sure there are plenty of other ways to mark it as well (change window frame color, warning in titlebar, etc.)
Re:Marked confidential? by FuzzyBad-Mofo · 2004-07-31 05:36 · Score: 4, Insightful

That's the thing, this code didn't have the proverbial thousand eyes looking at it, because the asshats marked it 'confidential' until just recently. If anything, this proves that security through obscurity is a losing proposition..
Re:Marked confidential? by cgreuter · 2004-07-31 06:13 · Score: 1

It's not fucking complicated how to fix it, and the solution works for every browser out there: Stop letting web pages turn off the URL box and menus. DUH.
Not quite. The reason you can do this is so that you can use XUL to turn Mozilla into a custom app. For example, you could use Firefox as the front end for an in-house POS system where the terminals are just running web browsers and the smarts are in a server on the other end of a LAN. In that case, you don't want the client to look like a web browser at all, lest the staff start getting ideas. The fact that XUL is powerful is not the problem.
It's also really handy that you can, simply by clicking on a link on a web page (and clicking the "OK" button on the confirmation prompt), change the look and feel of your browser. This is also a really nice feature. (Well, not until someone writes goatse.xpi, anyway.)
The real problem is the combination of the two, that the extensions you can download with the click of a mouse also have pants-down-bent-over access to the web browser's capabilities.
The Right Solution (IMHO) is to split extensions into two groups with different extensions and MIME-types. One is easy to load but is really restricted in what it can do to the browser, the other has the run of the system but needs to be downloaded to disk and then explicitly installed using a separate Extension Manager. That way, there's a big perceptual step between doing something relatively harmless and something that could compromise security.
(The extension manager itself could probably be a browser tool. However, for installing extensions system-wide as root under *nix, we'll also need a command-line tool analogous to rpm or dpkg.)
Re:Marked confidential? by Anonymous Coward · 2004-07-31 06:16 · Score: 0

It's not really a "thousand eyes" problem to begin with -- Mozilla is Broken As Designed / It's Not A Bug, It's a Feature / etc etc.

Instead this is a policy issue that is going to be decided in the "cathedral". The only thing making it public will do is allow people to lobby.
Re:Marked confidential? by Spy+Hunter · 2004-07-31 06:46 · Score: 1

DHTML can do everything XUL can do, it's just a bunch more work and the code is uglier. Therefore this is an IE bug as much as it is a Mozilla bug. It's actually a "bug" in just about *every* browser; it's just that the exploit is made easier by the availability of XUL (which there really is no excuse for, but that's beside the point). The ONLY real fix is to do as the grandparent post suggested and *always* display the real menu, button, status, and address bars. Anything less is still vulnerable to this type of exploit. There is NO GOOD REASON to turn them off, ever. If you are writing a web application that assumes the back button doesn't exist, you're writing it wrong. If your application really *needs* to show windows without forward/back buttons and menu/status bars and stuff, chances are your web application would be much more appropriate as a *real* application. Either that or you really don't *need* those features as much as you think. (hint: if "I don't like the way they look" or "they take up too much space" is your reason for removing the menu/address bars, you don't really *need* to remove them. Your users will thank you for leaving them.).

--
main(c,r){for(r=32;r;) printf(++c>31?c=!r--,"\n":c<r?" ":~c&r?" `":" #");}
Re:Marked confidential? by danila · 2004-07-31 07:06 · Score: 1

The correct solution is that security features (including status bar, address bar, etc.) should be turned off by user. Of course, it should not be too easy (lest the users are tricked into doing it).

Then IT staff can easily turn the browsers into custom apps (by disabling status bar and other things for a particular server), but hostile sites can't do it remotedly. There is no reason a remote site should have access to such power directly.

BTW, I think that Opera does things right on this front. The program window is the program window, noone can mess with it. The sites are limited to small page windows and they can't take over my desktop from there.

--
Future Wiki -- If you don't think about the future, you cannot have one.
Re:Marked confidential? by LiquidCoooled · 2004-07-31 08:35 · Score: 1

Thanks, it shows then that this is as much a bug as writing a valid executable and running it.

Perhaps they should add an isEvilIntent property and pray people use it ;)

--
liqbase :: faster than paper
Re:Marked confidential? by ibbey · 2004-07-31 10:40 · Score: 1

It's not fucking complicated how to fix it, and the solution works for every browser out there: Stop letting web pages turn off the URL box and menus. DUH.

Actually, as others have pointed out, turning off the location bar can be a good thing. The easy fix is to not turn off the location bar without user permission. Simply putting up a dialog saying "The requested page wants to hide the location bar. This could be a security risk. Proceed?" would help prevent the problem. Allowing a page to be marked as trusted would help reduce the annoyances that this would cause.

An even better option would be to always display a 20-30 pixel wide warning bar along the left side of the page any time the location bar has been hidden. This would eliminate the necessity for a dialog box, but would still create a noticeable change in the appearance of the web page. Once again, marking the page as trusted would allow hiding this.

Neither of these solutions are perfect (a user could mark a page trusted that they shouldn't), but that's fine. You'll never be able to protect a stupid user from themselves completely, but at least these options would provide a hint for most users.
Re:Marked confidential? by ibbey · 2004-07-31 10:52 · Score: 1

There is NO GOOD REASON to turn them off, ever. If you are writing a web application that assumes the back button doesn't exist, you're writing it wrong. If your application really *needs* to show windows without forward/back buttons and menu/status bars and stuff, chances are your web application would be much more appropriate as a *real* application.

Bullshit. A Mozilla based app IS a real application, just one that has used the Mozilla toolkit for it UI. There is absolutely nothing wrong with that. The problem is that Mozilla lets a page change the UI -without permission-, and without giving any visual indication that it has done so. Simply fixing these issues prevents the problem, without being unnecessarily draconian.
Re:Marked confidential? by GoofyBoy · 2004-07-31 13:08 · Score: 1

No, the bug report didn't have thousands of eyes looking at it.

The code does have thousands of eyes looking at it, yet this one was missed for the past five years.

--
The surprise isn't how often we make bad choices; the surprise is how seldom they defeat us.
Re:Marked confidential? by FuzzyBad-Mofo · 2004-07-31 19:54 · Score: 2, Interesting

Good point, but chances are people aren't going to work their way full the source of a program on the off chance of finding a critical issue. With awareness of a problem, it's much more likely that J. random developer will take a look at it.
Anyway, as another poster stated, this is a problem with the XUL design, not really a coding error. I like the solution of just alerting the user that a website is attempting to run a custom XUL interface, and leave the decision whether to trust the site or not up to the user.
Re:Marked confidential? by Spy+Hunter · 2004-08-01 04:42 · Score: 1

Sure, a Mozilla based app can be a real application. But if you want it rendered without a browser UI, you can distribute a tiny executable that embeds Gecko, only displays your application, and doesn't even have browser chrome. That way you can also have access to local files and more stuff that Mozilla would never let you have because it's too much of a security risk to put in the browser. There is no reason to put blatant security holes into the browser just to allow it to embed desktop applications, which have no place in a BROWSER. Anyway, all current web applications would continue to work just fine if Mozilla didn't allow them to remove the browser UI from windows, so it's not a compatibility issue or anything. I have never understood why Mozilla offered this capability in the first place.
Your post was pointless because it didn't give a viable solution to the problem. "Simply fixing these issues prevents the problem"? I'm not sure you understand the issue. These pages aren't *changing* Mozilla's UI, they are *recreating* it in XUL or DHTML after they remove the real UI using Javascript. How do you suggest Mozilla tell whether a page is attempting to mimic its UI or not? It's impossible. The only way to fix the problem is to prevent removing the real UI in the first place.

--
main(c,r){for(r=32;r;) printf(++c>31?c=!r--,"\n":c<r?" ":~c&r?" `":" #");}
Re:Marked confidential? by Neophytus · 2004-08-01 06:48 · Score: 1

So its ok for Mozilla/Firebird to utilize security through obscurity, yet when a closed source application?

Same deal. If developers can not fix a problem there and then it's fairer to joe public that the script kiddies don't know about it - there's very few people who actually have the skill to find these problems themselves. The Mozilla team have failed in that a fix or workaround (security warning) hasn't been silently integrated since the bug was filed.
Re:Marked confidential? by ibbey · 2004-08-03 15:47 · Score: 1

Your post was pointless because it didn't give a viable solution to the problem. "Simply fixing these issues prevents the problem"? I'm not sure you understand the issue. These pages aren't *changing* Mozilla's UI, they are *recreating* it in XUL or DHTML after they remove the real UI using Javascript. How do you suggest Mozilla tell whether a page is attempting to mimic its UI or not? It's impossible. The only way to fix the problem is to prevent removing the real UI in the first place.

Actually, I did offer a solution. Admittedly, in this post, I didn't repeat everything that I had said elsewhere, but the solution could easily be inferred from what I did say: "The problem is that Mozilla lets a page change the UI -without permission-, and without giving any visual indication that it has done so." In other words, tell the user that the UI has been changed by the page. Certainly some users will still be fooled, but you can only hold the users hand so far. I see no reason to limit the flexibility of the the available tools simply because a few users are to stupid to pay attention to a dialog box.
Re:Marked confidential? by Spy+Hunter · 2004-08-03 16:31 · Score: 1

Hm, actually I hadn't thought of that (guess your subtle hint wasn't enough, and the fact that you say "change" the UI when it is clearly being replaced). If Mozilla popped up a giant obnoxious security warning every time a page removed the menu/address/status bars, that would be an acceptable solution. Not because I think it would prevent these kinds of attacks entirely, but because I think it would discourage legitimate sites from removing the address bar (nobody wants a giant security warning on their legit site). Once legit sites stop doing it the capability can really be removed in a later version of Mozilla, fixing the problem. (This would require Microsoft getting on board too with IE, but I think with their new security focus all it would take is one high-profile scam using this technique.)
I see no reason to limit the flexibility of the the available tools simply because a few users are to stupid to pay attention to a dialog box.
I'll have to disagree with you there. That statement is a classic example of the "blame the user" attitude so prevalent in computer science. The problem is that it doesn't matter who's at fault; blaming the user won't get you anywhere, and users are never going to change ("read your dialog boxes" public service announcements won't help). Since you can't fix these types of problems by changing the users, you have to fix them by changing the software, even if the software isn't "at fault" by some definition of "fault". Otherwise the problems will never be fixed.
Besides, you're hardly limiting the flexibility of any tools here. The only "flexibility" you're losing is the flexibility to make smaller windows and annoy the user by removing his UI. Your web applications can be just as powerful as they were before. I've wished for years I could disable this myself.

--
main(c,r){for(r=32;r;) printf(++c>31?c=!r--,"\n":c<r?" ":~c&r?" `":" #");}
Re:Marked confidential? by jcast · 2004-08-09 01:24 · Score: 1

Re-read The Cathedral and the Bazaar. The section titled Release Early, Release Often:

My original formulation was that every problem ``will be transparent to somebody''. Linus demurred that the person who understands and fixes the problem is not necessarily or even usually the person who first characterizes it. ``Somebody finds the problem,'' he says, ``and somebody else understands it. And I'll go on record as saying that finding it is the bigger challenge.''

Linus' law depends, in the published formulation, on bug discoveries being published among the entire happy horde of hackers. Remember: it's the published CatB that everything else ESR says refers back to; his public statements are summaries of that position. Sometimes he leaves details out. Every detail is crucial under some circumnstances. This happens to be an occasion on which this detail became crucial.

And the bug wasn't ``missed''. It was found, and filed.

--
There are reasons why democracy does not work nearly as well as capitalism.
-- David D. Friedman
Re:Marked confidential? by GoofyBoy · 2004-08-09 01:49 · Score: 1

>And the bug wasn't ``missed''. It was found, and filed.

And then hidden. In this way its no different than closed source.

But what should have prevented it was that more people should, in theory, have found it. The more people who find it, the harder it is to hid it. And this is one of the more popular Open Source projects.

"But its hard to find bugs" does nothing for the argument for open source. How can you argue that its more secure/bug-free if its hard to find bugs in the first place? A thousand eyes missed this one. You might have just had 3 paid testers looking for it because its the same result.

--
The surprise isn't how often we make bad choices; the surprise is how seldom they defeat us.
Re:Marked confidential? by jcast · 2004-08-09 02:40 · Score: 1

And then hidden. In this way its no different than closed source.

Exactly. This is not a failing of open source---because open source procedures weren't followed. Breaking the rules does diminish the likelihood of success.

But what should have prevented it was that more people should, in theory, have found it. The more people who find it, the harder it is to hid it. And this is one of the more popular Open Source projects.

How do you know it wasn't found multiple times, reported multiple times, and hidden multiple times? I'm not saying it was, I'm just asking how you know.

"But its hard to find bugs" does nothing for the argument for open source. How can you argue that its more secure/bug-free if its hard to find bugs in the first place? A thousand eyes missed this one.

Possibly. But, you can't argue that one event makes a statistical trend. There are always exceptions to any rule. The question is: does having more reviewers increase the probability of finding bugs significantly, not does it guarantee finding bugs. Bugginess is a fuzzy property, not a binary one.

--
There are reasons why democracy does not work nearly as well as capitalism.
-- David D. Friedman

whoops by ceejayoz · 2004-07-30 22:16 · Score: 4, Interesting

Bug 22183. This is the first mention of the problem that I am aware of. It was marked confidential for five years until 7-21-2004.

Gotta love that security-by-obscurity...

Re:whoops by bunratty · 2004-07-31 00:27 · Score: 1

Gotta love that security-by-obscurity...
Yeah, all those encryption algorithms that use private keys are totally bogus! Wait...

--
What a fool believes, he sees, no wise man has the power to reason away.
Re:whoops by Anonymous Coward · 2004-07-31 03:48 · Score: 1, Insightful

Just like my "obscure" password that I use to log into my machine! I sure hope it is never unobscured, or my security might be shot!
Re:whoops by Soli · 2004-07-31 04:51 · Score: 1

The no-longer-confidential bug 22183 talk about bug 182078 which is still marked confidential as of now. Is this a good sign??

Gotta love that security-by-obscurity... (well, they do love it)
Re:whoops by jesser · 2004-07-31 07:48 · Score: 1

I just made bug 182078 public. Thanks for pointing it out to me.

--
The shareholder is always right.
Re:whoops by Anonymous Coward · 2004-07-31 09:06 · Score: 0

Excerpt from a post (Feb 24, 2003) in the bugzilla discussion on this bug:
"The purpose of the security group is to keep script kiddies from using Bugzilla as a manual for mischief, which is why this bug needs to remain confidential for now. Expert "bad guys" know all of this and more - those who don't already know will not learn about it here."

Two observations:
1)It seems to me the poster implies that disclosing the bug would do more harm (script kiddies exploiting the bug) than good (open source community -- outside the Mozilla security group -- supplying fixes for the bug).
2)The Mozilla developers knew that the "expert bad guys" knew about the bug.
Re:whoops by _Sprocket_ · 2004-07-31 09:23 · Score: 1

There's a distinct difference between having a key and keeping that key under the doormat.

What the hell? by King_of_Prussia · 2004-07-30 22:17 · Score: 4, Insightful

Of course, that won't stop me from using Firefox.

What kind of blind OSS zealotry is this? If somebody said something similar of IE there would be a unanimous uproar of upbraids from the slashdot community against whoever said it.

Is it somehow tolerable for OS software to have faults, even serious ones? Security through obscurity is no security at all, as I'm sure many Firefox users will learn one day. Personally, I believe statements like that, and the people that make them are what is holding OSS back from becoming a serious contender to the juggernauts of mocrosoft. If we continue to sit on laurels gained only through lucky ineptitude we will get precicely nowhere.

PS seems like google has started another round of gmail invites, I just got six. Logged in users tell me your funniest joke involving tux the linux penguin and the six funniest will recieve an invite (use a throwaway account, I'm sure this post will be followed by cowardly un-obfuscating trolls).

--

Making the moon less necessary since 1998.

Re:What the hell? by tirenours · 2004-07-30 22:33 · Score: 5, Funny

And from the linked page, a gem that we shouldn't overlook:

"if you don't have Firefox (you should get it!)"
Re:What the hell? by Pharmboy · 2004-07-30 22:44 · Score: 1, Insightful

This is why I use Windows, which is more secure because hackers can't search the code for vulnerabilities to exploit.
</stupidity>

But it does make me glad I have both installed on all computers. It is ironic tho, with all the MS bashing, and this is actually a more serious exploit the last few IE exploits. Firefox doesn't have the quantity of bugs that IE has, but it makes up for it with the quality I guess.

As for me, I'm gonna start surfing in a shell with Lynx.

--
Tequila: It's not just for breakfast anymore!
Re:What the hell? by 4lex · 2004-07-30 22:50 · Score: 2, Interesting

Since it doesn't affect the Mac OS X version (just checked), it won't stop me using Mozilla Firefox, for sure ;)

--
My journal. Mainly about freedom.
Re:What the hell? by Threni · 2004-07-30 22:50 · Score: 3, Insightful

> What kind of blind OSS zealotry is this? If somebody said something similar of
> IE there would be a unanimous uproar of upbraids from the slashdot community
> against whoever said it.

Who cares what the `slashdot community` says? There's a mixture of people here. You don't have to listen to everyone. I'm not a zealot and i'm going to be sticking with Firefox, as I don't believe i'm at risk of this particular exploit, as I have a local webpage on my hard drive which is just a list of URLs to sites I use regularly, so unless that gets hacked i'm going to end up where I expect.

> Is it somehow tolerable for OS software to have faults, even serious ones?

All software has faults. IE has loads, Firefox has a few. On balance, it would appear that users of non-microsoft software are less at risk than microsoft users, and the problems get fixed more quickly. Or do you think this most recent security issue tips the balance back in favour of IE being the safest browser to use?
Re:What the hell? by rsheridan6 · 2004-07-30 22:59 · Score: 1

If you're waiting for a web browser without serious faults, you'll be waiting a long time. Firefox is still the best, AFAIK, despite this weakness.

--
Don't drop the soap, Tommy!
Re:What the hell? by Spellbinder · 2004-07-30 23:00 · Score: 5, Interesting

i am not even sure if this shoud be called bug
there is nothing it is not doing like it should
it may be stupid to allow javascript to hide the toolbars etc.
maybe it would be wise to disable those features in the next firefox version per default
it is easy to change right now...
and i don't see why this is worse than IE permitting execution of code on your machine

--

stop supporting microsoft with pirating their software!!!!!
Re:What the hell? by Jugalator · 2004-07-30 23:04 · Score: 1

Firefox is still the best, AFAIK, despite this weakness.

With "this weakness" -- do you mean the fact that they're developing a product with secret bugs (security by obscurity), or do you mean this particular bug?

--
Beware: In C++, your friends can see your privates!
Re:What the hell? by Pharmboy · 2004-07-30 23:13 · Score: 1

technically, IE didn't permit execution of code, since Mozilla would do the same thing. Both simply handed the URL over to the OS (shell:// I believe) so the problem was actually OS related, NOT browser related. Both browsers were doing what they were supposted to do. The fix was to disable the shell:// URL type in both Mozilla and IE.

But anything that allows you to produce a certificate for SSL that looks real, as well as create a false window that appears to be from a place it is not originating from, IS a bug, since the original intention was not to facilitate fraud.

--
Tequila: It's not just for breakfast anymore!
Re:What the hell? by Anonymous Coward · 2004-07-30 23:16 · Score: 0

Obviously the fact that there is a serious spoof possibility in Firefox should get you thinking. The thing is, there is no browser to switch to. Javascript allows you to open chrome-less windows and fill them with fake browser-UI. A good and valid reason not to switch browsers is that Firefox has a way of preventing this attack: You can set the various dom.disable_window_open_feature.* preferences to deny hiding of the real UI. An attacker could still pretend to open a new window by making an area of the page look like another window, but again, every browser is susceptible to that.

The question is if the browser should deny hiding of browser chrome by default or if there is a better solution. Plus it's a real shame that this known threat potential was ignored for so long, but the actual exploitable flaw is not Firefox specific.
Re:What the hell? by mm0mm · 2004-07-30 23:23 · Score: 1

What kind of blind OSS zealotry is this? If somebody said something similar of IE there would be a unanimous uproar of upbraids from the slashdot community against whoever said it.
I thought the reason IE gets bashed harder than Moz/FireFox was because the browser is integrated to the OS by default, making all sorts of spoof activities like popup warnings for false Windows updates possible, even when you are not browsing the web. If you don't like FireFox because it's vulnerable, just uninstall it and find alternatives. Can you do the same with IE?
p.s. BTW, the OS I am using now is not integrated with IE. Although I use Windows also, it is a stand alone machine with no network connection.
Re:What the hell? by rsheridan6 · 2004-07-30 23:34 · Score: 1

Either. "Best" is a relative term, and I don't know of a better browser than firefox, secret bugs and spoofable UI and all. I'm not saying it doesn't bother me (mainly the secrecy), but what would I switch to that would be better?

--
Don't drop the soap, Tommy!
Re:What the hell? by FooBarWidget · 2004-07-30 23:41 · Score: 3, Insightful

There are many, many people out there who continue to use IE, even after knowing there are alternatives and that IE has many security holes. So what? Why doesn't anybody label those people as "MS zealots"? But when someone says he still continues to use FireFox he gets flamed down for being a zealot?
Re:What the hell? by RC515 · 2004-07-30 23:47 · Score: 0, Offtopic

http://www.stufflikethat.org/~david/gfx/tux-tow2.j pg
http://n.manet.nu/daemon-vs-tux-1024-768.jpg
http://www.pcpages.com/varelanmx/l/Cropcircle-Tux. jpg
http://www.pcpages.com/varelanmx/l/Cropcircle-Tux. jpg

junkmail-receptacle arcor.de
Re:What the hell? by Spellbinder · 2004-07-31 00:02 · Score: 1

if you can hide the status/menubars you can just use a image.. ok it has to fit the browser / layout if the user is a little bit suspicious but most would even click on not fitting stuff ...
there is no easy fix to this (turning of XUL would be like unpluging your windows machine to make it secure)

--

stop supporting microsoft with pirating their software!!!!!
Re:What the hell? by pebs · 2004-07-31 00:16 · Score: 1

there is no easy fix to this (turning of XUL would be like unpluging your windows machine to make it secure)

Maybe have some kind of warning like "You are about to view a remote XUL page" or have some kind of indicator that it is remote XUL. It's still going to be a problem in those cases, though, because you'll have people who click yes to everything, etc.

--
#!/
Re:What the hell? by StormReaver · 2004-07-31 00:16 · Score: 1, Insightful

"If somebody said something similar of IE there would be a unanimous uproar of upbraids from the slashdot community against whoever said it."

Yep, you are absolutely right. We would be blasting IE from every (virtual) rooftop.

That this bug was hidden away in the Bugzilla annals for over 4 years as Confidential is really intolerable. It reeks of trying to sweep an embarassing problem under the rug, which is the complete antithesis of Open Source development.

One of my coworkers who recently defected from I.E. to Firefox stated, upon the last Firefox vulnerability, that if he had to frequently upgrade his Firefox because of security issues, he may as well just stay with IE. And he unfortunately has a valid point.

If a person, or group, can't be mature enough to admit a big, "oops, I/we made a really big design mistake. We'll fix it because many people are depending on us," then that person or group has no business working on such a fundamentally important piece of software as a web browser.

A workable solution to this kind of problem has been around for many years. Java applets, when run from appletviewer, display a very prominent notice telling the user that very thing.

I hate Javascript with a passion, and disable it except for those crucial sites (broken as they are) that will not work without it. But for those sites, it's just common sense for the browser to to inform the user from within all Javascript popup windows that the window is a result of Javascript.

Actually, every user interface that is not a built-in part of the application should contain an unremovable notice (ala appletviewer) to make user interface spoofing (a very well known security risk) unworkable.
Re:What the hell? by pebs · 2004-07-31 00:32 · Score: 5, Insightful

Of course, that won't stop me from using Firefox.
What kind of blind OSS zealotry is this?

You know, I never advocate using Mozilla/Firefox due to lack of vulnerabilities; because deep down inside, I know there are a ton of vulnerabilities just waiting to be found. This is a problem for any reasonably complex software. Two reasons to use Mozilla/Firefox:

1. Feature-wise, it completely blows away IE
2. Standards compliant, which will help make the web a better place for all browsers

Also, it runs on many OS's, but that's not a good reason for everyone.

Currently, most of the malware/viruses/etc are for IE. But I have seen sites that try to get you to install Mozilla extensions that could be potentially malicious. With Mozilla's new-found popularity, it's only a matter of time before Mozilla gets attention from the malware writers. Get ready for it.

--
#!/
Re:What the hell? by simcop2387 · 2004-07-31 00:36 · Score: 1

in my case when looking at the site, i see two status bars, i think it might have to do with javascript not being able to turn off the status bar or change it, that alone would indicate what is going on to me, now if i can keep it from turning off the other stuff
Re:What the hell? by zsau · 2004-07-31 00:38 · Score: 1

Well, this hasn't stopped me using Firefox. The utterly appalling interface on Linux has stopped me using Firefox. I gave it a try when it was new, but went crying back to Galeon, something that actually tries to make an effort to look good amongst other GTK+ 2 programs. I'm unlikely to pick up using it until this has been fixed, though!

--
Look out!
Re:What the hell? by Anonymous Coward · 2004-07-31 00:46 · Score: 0

you are a dickhead.
Re:What the hell? by gfxguy · 2004-07-31 00:46 · Score: 1

And instead of being annoyed all the time, I'd click on the "Don't show me this message again" checkbox.

Or at least it should remember XUL sites so that it didn't bug me all the time, in which case someone could still gain people's trust and then change it.

Being nagged is not a good solution.

--
Stupid sexy Flanders.
Re:What the hell? by Spellbinder · 2004-07-31 00:49 · Score: 1

such messages make deaf
most people just click next or ok ... because that is what they learn
would you like to explain to a user what teh heck XUL is
it is hard enough to explain to them they have to push the powerbutton for their computer to start

--

stop supporting microsoft with pirating their software!!!!!
Re:What the hell? by numark · 2004-07-31 00:50 · Score: 1

Well, that's only partially true. It does look slightly odd when you load the exploit in OS X's version of Firefox, but it's possible that someone, looking at the screen in a hurry, could realize that it's different only after entering their user name and password and hitting submit.

That being said, I'm slightly upset at the fact that this problem was known for 5 years, and it took someone just happening to find this bug for the Mozilla developers to ever admit that it existed. I'm a big fan of Firefox (it's my main browser now), but I expect the development team to be a little more forthcoming when it comes to identifying and fixing these bugs.

--
Want Slashdot headlines on your site? Try SlashHead
Re:What the hell? by fzammett · 2004-07-31 00:59 · Score: 2

Then using myIE. Now you have a feature set that blows away Firefox, and everything else, while still having IE under the covers (if you want that... I happen to like IE, and myIE makes it tremendously powerful, and even a little bit more secure).

--
If a pion (n-) collides with a proton in the woods & noone is there to hear it, does lamdba decay into the source pa
Re:What the hell? by CanadianCrackPot · 2004-07-31 02:21 · Score: 1

My roommate is a MS zealot. We use my computer to play DVD movies on the TV in our living room. Just about any problem that comes up he'll end up saying that its because I violate the "Mircosoft standard". I hate that he never accepts my explainations either, once my X server wouldn't start working and he started going on about this would never happen with MS and all.

After reinstalling the NVIDIA drivers for my card things worked fine but he still thought it was a linux problem and not just a simple card driver problem.

The funniest time was when I told him my computer did follow Microsoft standards. The one very rare time I had a Microsoft Moment and my computer completely and utterly locked up.

--
Good programmers drink beer to relieve job stress.
Great programmers drink hard liquor and work best hungover.
Re:What the hell? by Anonymous Coward · 2004-07-31 02:53 · Score: 0

spaarvarken@xs4all.nl ? whats that?
Re:What the hell? by TRACK-YOUR-POSITION · 2004-07-31 03:13 · Score: 1

I think if you compare the MyIE features to what's available here, it will definitely not be Firefox that gets blown away. I also disagree with the parent--Mozilla actually reacts to bugs more quickly, and has a stricter notion of what qualifies as a security bug than the developers of Internet Explorer. (this one doesn't count--Mozilla, IE, and Opera all have this problem. You've seen all the banner ads that look like they have IE widgets.)
Re:What the hell? by gnu-generation-one · 2004-07-31 03:19 · Score: 1

"What kind of blind OSS zealotry is this? If somebody said something similar of IE there would be a unanimous uproar of upbraids from the slashdot community against whoever said it."

Well since most of us can't run Internet Explorer (it's not available for the operating system we use) that can be quite a moot point. Besides, you've got to pick one, and it may as well be the one which didn't run all those viruses we saw over the last two years.
Re:What the hell? by nmk · 2004-07-31 03:22 · Score: 1

First of all, there is nothing zealous about continuing to use Firefox because a couple of exploits have been discovered. There hare hundreds, if not thousands, of exploits for IE. So on the security front, it's still a safer proposition. It also happens to have a lot more features than IE. Even putting the security issue aside, one must remember that IE is an obsolete piece of software.

That being said, I think that the proceeding months/years will be interesting. This really is the first time a non-MS product is going to be put under the microscope by the public eye. MS has long argued that their software is not inherently less secure than the alternatives, be it operating systems or web browsers. I don't think we're about to see MacOS or Linux put through their paces the way Firefox is about to be any time soon.

In the following years, Firefox may become a champion of OSS, showing that MS really doesn't know how to design secure software. It may well validate, perhaps unfairly, the security claims made by Linux, MacOS, and a host of other non MS products.

Alternatively, It could fall flat on its face, and be a step back for OSS. If Firefox exploits become as common as IE exploits have been, MS will be yelling I TOLD YOU SO louder than anyone in history. In this scenario, I can see a lot of tails tucked between legs.
Re:What the hell? by unixbob · 2004-07-31 03:55 · Score: 1

Although the tabbed browsing and popup blocking in MyIE2 is indeed a benefit over standard IE, there's no way that it blows away Firefox.

That comment is not me being an open source zealot, but from a MyIE -> Firefox convert. MyIE2 has the most irritating and frustrating bookmark organisation I've ever come accross. In that regard it is actually a downgrade on standard IE. And the development team is also less than helpful. There are lots of posts on the MyIE2 forums from users who complained about not being able to drag and drop bookmarks or change their order to suit. The postings tended to look like:

Q. How can I change the order of my bookmarks?
A. You should use the bookmarks sidebar to manage your bookmarks
Q. But I've spent ages in IE getting them in the correct order. I don't want to use the bookmark sidebar. How do I do it in the bookmark menu?
A.You don't understand, read the FAQ and use the bookmark sidebar.

I used MyIE2 for 6 months and was prepated to put up with the bookmark thing and it's various other irritations, but after using Firefox for a month now there's just no comparison.

--
The Romans didn't find algebra very challenging, because X was always 10
Re:What the hell? by haralder · 2004-07-31 03:58 · Score: 1

> There are many, many people out there who continue
> to use IE, even after knowing there are
> alternatives and that IE has many security holes.
> So what? Why doesn't anybody label those people
> as "MS zealots"?
Lusers, they are labelled lusers.
Re:What the hell? by Dwonis · 2004-07-31 04:36 · Score: 4, Informative

That this bug was hidden away in the Bugzilla annals for over 4 years as Confidential is really intolerable. It reeks of trying to sweep an embarassing problem under the rug, which is the complete antithesis of Open Source development.
...
If a person, or group, can't be mature enough to admit a big, "oops, I/we made a really big design mistake. We'll fix it because many people are depending on us," then that person or group has no business working on such a fundamentally important piece of software as a web browser.
A workable solution to this kind of problem has been around for many years. Java applets, when run from appletviewer, display a very prominent notice telling the user that very thing.
The sad this about all this is that it's not even a fundamental design problem. Firefox has configuration options to eliminate this problem:
All you need to do is put something like this in your user.js file:
// disable target="_blank" (open in same window): user_pref("browser.block.target_new_wind ow", true); // prevent Javascript from trapping the context menu user_pref("dom.event.contextmenu.enabled", false); // ---- Stuff from http://flii.us/myworks/phoenix/pages/user.html ---- // don't allow popups to disable features // if you know what the blank commented parts do, plz let me know // so i can update my file here. :) THANKS! // + special thanks to devin pohly for looking some of these up // Prevent Javascript from changing window focus user_pref("dom.disable_window_flip", true); // Prevent JavaScript from resizing your browser + user_pref("dom.disable_window_move_resize", true); // Prevent the Close button from being disabled user_pref("dom.disable_window_open_featu re.close", true); // same as dom.disable_window_open_feature.locationbar ?? or nothing + user_pref("dom.disable_window_open_feature.dire ctories", true); // Prevent the URL bar from being disabled? user_pref("dom.disable_window_open_feat ure.location", true); // Prevent the Menu bar from being disabled user_pref("dom.disable_window_open_featu re.menubar", true); // Prevent the Minimize button from being disabled user_pref("dom.disable_window_open_featu re.minimizable", true); // Prevent the Bookmarks Toolbar from being disabled user_pref("dom.disable_window_open_featu re.personalbar", true); // Prevent window resizing from being disabled user_pref("dom.disable_window_open_featu re.resizable", true); // Prevent scrollbars from being disabled user_pref("dom.disable_window_open_featu re.scrollbars", true); // Prevent the Status bar from being disabled user_pref("dom.disable_window_open_featu re.status", true); // Prevent the Title bar from being disabled user_pref("dom.disable_window_open_featu re.titlebar", true); // Prevent Javascript from hiding toolbar in new windows? + user_pref("dom.disable_window_open_feature.tool bar", true); // Prevent Javascript from changing status bar text + //user_pref("dom.disable_window_status_change", true);
Re:What the hell? by AnotherBlackHat · 2004-07-31 04:54 · Score: 1

Of course, that won't stop me from using Firefox.

What kind of blind OSS zealotry is this?

Perhaps the author was thinking that since you can do essentially the same thing on IE,
switching wouldn't escape the vulnerability?

-- less is better.
Re:What the hell? by Trailer+Trash · 2004-07-31 05:55 · Score: 2, Funny

There are many, many people out there who continue to use IE, even after knowing there are alternatives and that IE has many security holes. So what? Why doesn't anybody label those people as "MS zealots"?

They do. You apparently missed the memo...

--
Do you have ESP?
Re:What the hell? by Goalie_Ca · 2004-07-31 06:09 · Score: 1

Firefox isn't even 1.0 yet.... ;)

--

----
Go canucks, habs, and sens!
Re:What the hell? by FerretOnMountDew · 2004-07-31 06:35 · Score: 1

Many of those people are too lazy/uninformed/misled by FUD/"computer illiterate" to switch to mozilla, firefox, or any other open source alternative. Most people who use firefox, etc., especially on this forum have made a choice to do so.

Choosing to use faulty or insecure software and posturing as a fanboy does deserve a label like "zealot".

That said, I'm still most likely to use fox or moz even though this problem is coming out. Until I hear a little more proof to the contrary, it still appears that those OS options are more secure than IE.

--
Please, do not read this sig
Re:What the hell? by Khazunga · 2004-07-31 06:51 · Score: 1

But, alas, no standards compliance yet. This is an extremely important point, as any half-decent web developer can explain you.

--
If at first you don't succeed, skydiving is not for you
Re:What the hell? by fzammett · 2004-07-31 09:03 · Score: 1

I agree with you, to an extent... IE is actually quite standards-compliant, just not up-to-date. I'm not saying that's a whole lot better, but a standards-compliant site that isn't using the latest specs works quite well.

As a rather accompished web developer myself (my achievements to date make that statement not a boast but a statement of fact), I can also tell you that most users don't give a damn about standards compliance, and especially if you play in a domain where cross-browser is less of a concern (or no concern at all, which frankly is the environment I develop in most of the time), it's even less of an issue.

In addition, there is, at least in the business world, a general trend away from web development that would require the latest specs. People are actually dumbing-down their interfaces across the board from what I've seen. This to me is sad and a definite step in the wrong direction, but it further implies that standards-compliance is less of an issue because the less complex (and frankly functional) the interface, the easier it is to make it cross-browser, whether standards are involved or not.

I'm not saying any of this is good mind you... I've made a name for myself in my job because my web applications look, feel and work very much like fat-clients (at the price of being IE-only, which is acceptable as far as my organization is concerned), but if a mandate ever comes down that says my apps have to be cross-browser and/or standards-compliance (not automatically the same thing!), then my life will be much more difficult because if they still want my apps to be as accessible and frankly as cool as they have been so far, dealing with IE is going to be a pain rather than the near pleasure it is now (believe me, IE allows you to do some incredibly cool things on the client that you either can't do with other browsers, or more likely is just harder and will obviously increase development time to make work on both).

--
If a pion (n-) collides with a proton in the woods & noone is there to hear it, does lamdba decay into the source pa
Re:What the hell? by fzammett · 2004-07-31 09:07 · Score: 1

That's fair, and you've hit upon the one real sore spot that his pissed me off with myIE, the bookmark thing that is (I have no experience dealing with the developers). If they fixed that one issue alone, I'd be happy as hell.

I've played with Firefox a bit lately, and I'm personally not all that impressed. Mind you I'm saying that when comparing it to myIE, not plain IE, which it is certainly superior to in most ways. The one thing I find Firefox to really be better at is developer tools. I'm really impressed with the DOM Inspector and just the Javascript console is very nice. Otherwise, I'm personally quite happy with myIE.

I'm not looking to convince anyone, but I do think it's fair to point out that if you do happen to generally like IE, as I do, there are ways to make it better, myIE being one of them, and I think that yields a better comparison to Firefox and Mozilla and the life than does IE itself.

--
If a pion (n-) collides with a proton in the woods & noone is there to hear it, does lamdba decay into the source pa
Re:What the hell? by mpe · 2004-07-31 09:34 · Score: 1

Then using myIE. Now you have a feature set that blows away Firefox, and everything else, while still having IE under the covers (if you want that...

Since it requires IE it comes with all the problems and limitations of IE. Including only working with Windows.
Re:What the hell? by ibbey · 2004-07-31 11:10 · Score: 1

It is ironic tho, with all the MS bashing, and this is actually a more serious exploit the last few IE exploits. Firefox doesn't have the quantity of bugs that IE has, but it makes up for it with the quality I guess.

But this isn't a Firefox vulnerability. As others have pointed out, the same class of vulnerability also affects IE and most other browsers as well. Even with issues like this Firefox is more secure for two reasons:

1) The developers usually respond more quickly (present bug excluded).

2) I hate to say it, but security through obscurity. IE commands >90% of the browser market, so the vast majority of exploits are still directed at it.

While neither of these mean Firefox provides rock solid security, I can almost guarantee you that you'll have far fewer security problems on Firefox then you will on IIE.
Re:What the hell? by ibbey · 2004-07-31 11:14 · Score: 1

Since it doesn't affect the Mac OS X version (just checked), it won't stop me using Mozilla Firefox, for sure ;)

Are you sure? Ok, so the POC may not have worked, but that doesn't mean that you're not vulnerable. If you are sure, what is it about the MacOS version that makes you invulnerable?
Re:What the hell? by Khazunga · 2004-07-31 13:41 · Score: 1

I agree with you, to an extent... IE is actually quite standards-compliant, just not up-to-date. I'm not saying that's a whole lot better, but a standards-compliant site that isn't using the latest specs works quite well.
Only if the standard you are talking about is HTML4. IE's CSS support is bad enough for the box model itself to be wrong, leading to all kinds of weird behaviours. There are workarounds, but it's poor standards support anyway you look at it. You can do amazing stuff with HTML+javascript/vbscript, I'm not questioning that. What you can't do is write style into CSS in a predictable manner, which costs uncountable development hours. MS did a poor job, and web developers pay the price.
believe me, IE allows you to do some incredibly cool things on the client that you either can't do with other browsers, or more likely is just harder and will obviously increase development time to make work on both
You can do pretty amazing stuff with IE. However, you're mistaken on the cost of doing the same stuff with other browsers, namely mozilla. XUL allows you to write interfaces that are pretty much as powerful as native applications' (fat clients, if you put it that way). XUL is, today, the power for web development that Microsoft is promising to deliver two years from now.

--
If at first you don't succeed, skydiving is not for you
Re:What the hell? by dgoodman · 2004-07-31 15:32 · Score: 1

The fact that on a Mac, the menubar is attached to the top of the screen, whereas the spoof tries to create a fake menubar attached inside the window (ala Windows or X)...it a) doesn't quite work and b) even if it did, it would look highly suspicious to a Mac user. That said, I'm sure there's a way around it, it may only be a matter of time...so I won't say "invulnerable", just "not many people are going to code in that special condition to capture another small percentage". maybe.
Re:What the hell? by ibbey · 2004-07-31 19:25 · Score: 1

This prevents a generic spoof, but any spoof that checks the platform would still work. It just would not display the menubar on the Mac version. Like you said, most script kiddies probably won't bother, but you should still be aware of the problem.
Re:What the hell? by Anonymous Coward · 2004-08-02 04:33 · Score: 0

Then using myIE. Now you have a feature set that blows

I'm with you 99%

Javascript should be enabled. by Anonymous Coward · 2004-07-30 22:18 · Score: 0

This is the problem, what sort of moron would let a webpage run code on his machine anyway? Disabling javascript will stop upwards of 70% of IE exploits too. Now all we have to do is teach clueless "web developers" about html, css and noscript tags. YAwn, welcome back to 1997.

Re:Javascript should be enabled. by adam+mcmaster · 2004-07-30 22:43 · Score: 4, Insightful

what sort of moron would let a webpage run code on his machine anyway?

The average user.
Re:Javascript should be enabled. by nawlej · 2004-07-31 03:41 · Score: 1

Yes, and sadly, the good majority of them know about it.

Its a Known Vulnerability in Mozilla by poofyhairguy82 · 2004-07-30 22:18 · Score: 1

This issue appears to be the same as Mozilla Bug 244965

.

--

Open Source Sushi

Fix the Colors! by imag0 · 2004-07-30 22:19 · Score: 1, Insightful

Mod me up if you hate the color scheme. Here's a fixed link using the "old" slashdot colors:

http://slashdot.org/article.pl?sid=04/07/31/003721 0&tid=154&tid=128&tid=172

(I sound like a broken record. I know that. But if it gets said enough times perhaps someone will notice and change something.)

Re:Fix the Colors! by Anonymous Coward · 2004-07-30 22:24 · Score: 0

What? IMHO this is the best color scheme slashdot has.
Re:Fix the Colors! by Anonymous Coward · 2004-07-30 22:27 · Score: 0

Or login and set preferences to lite html!
At least Post a decent URI
Re:Fix the Colors! by Cameroon · 2004-07-30 22:31 · Score: 1

Well then I guess we need an equal or larger number of "Don't change the scheme, it's the best one you've got." comments as well.
Re:Fix the Colors! by poofyhairguy82 · 2004-07-30 22:32 · Score: 0, Offtopic

(I sound like a broken record. I know that. But if it gets said enough times perhaps someone will notice and change something.)
Either that, or the butt ugly colors will give you god-like mod points.

--
Open Source Sushi
Re:Fix the Colors! by Anonymous Coward · 2004-07-30 23:21 · Score: 1, Funny

Mod me up if you hate the color scheme. Here's a fixed link using the "old" slashdot colors:

i really want to mod you up, but since i followed your link in mozilla, i don't dare log in, since i can't really be sure of what i'm looking at...
Re:Fix the Colors! by Anonymous Coward · 2004-07-31 00:34 · Score: 0

Here are all the other colors, if you're interested.
Apache
Apple
AskSlashdot
Books
BSD
Developers
Games
Interviews
Linux
Science
YRO

Your comment has too few characters per line (currently 8.6).
Well, I guess I'll have to bring that number up a bit. I really don't think any of the color schemes are so bad that they need to be whined about constantly. Damn, what is the minimum characters per line? I know it is more than 15. I wonder how many I have now. Hang on, I'll check.... 16.5. Still not enough. Let me get rid of some of the blank lines, maybe that will help.
We have a winner!!!!!!!11!!
Re:Fix the Colors! by Quobobo · 2004-07-31 01:11 · Score: 1

I'd mod you up if I could. God, it hurts my eyes...

Use 0.8 by Anonymous Coward · 2004-07-30 22:19 · Score: 0

Firefox 0.9+ are ugly-ass. Stay in the dark ages with me! All I got was an XML Parsing Error: undefined entity.

Firefox, huh ? by ElVirolo · 2004-07-30 22:20 · Score: 4, Funny

Of course, that won't stop me from using Firefox But then how do you know you ARE using the 'proper' Firefox if the interface is spoofed ?

Re:Firefox, huh ? by MegaFriedolin · 2004-07-31 00:15 · Score: 1

If you are working under Linux, you can choose Galeon/Epiphany. I'm not sure, but I think they aren't using XUL directly, but the UI is GTK + mozilla embedded. So the spoof doesn't work.
Re:Firefox, huh ? by Spunk · 2004-07-31 01:46 · Score: 2, Funny

I don't have to worry, I use Mozilla Superchicken.
Re:Firefox, huh ? by TheLittleJetson · 2004-07-31 06:50 · Score: 1

don't let javascript hide status bar or contextual menus. it's in the prefs.

Doesnt do tabs by isorox · 2004-07-30 22:21 · Score: 2, Interesting

I use middle-click tab a lot (practically every link), the proof of concept doesnt show the tabs (still opens them though)

Re:Doesnt do tabs by NetNifty · 2004-07-30 22:22 · Score: 1

Doesn't javascript opened windows not go to tabs anyway?

--
Linux Wireless Hardware in the UK
Re:Doesnt do tabs by isorox · 2004-07-30 22:29 · Score: 1

Doesnt do address bar stuff either, but he says that's cause he's lazy and could do it.
Re:Doesnt do tabs by Sancho · 2004-07-30 22:52 · Score: 2, Insightful

Not with the Tabextensions module. You can make EVERYTHING go to tabs..
Re:Doesnt do tabs by betelgeuse-4 · 2004-07-31 01:46 · Score: 1

Also, if you have a setup where the buttons and toolbars aren't in the standard positions, you'll notice that something's wrong straight away. I have my navigation buttons, menu bar, address box and google box all on one line so the spoof looks nothing like my setup.

--
Decode these

Confidential bugs in open source projects by October_30th · 2004-07-30 22:21 · Score: 2, Insightful

"Confidential" bugs in an open source project. Really?

--
The owls are not what they seem

Double standards? by bamf · 2004-07-30 22:24 · Score: 4, Insightful

Of course, that won't stop me from using Firefox.

If this was an issue with IE and not Firefox, I hope you'd still be saying the same thing?

However I suspect that you'd be denigrating IE as loudly as possible, while insisting that everyone should move immediately to Firefox.

Re:Double standards? by Anonymous Coward · 2004-07-30 23:00 · Score: 0

If you RTF bug report you'll see that this bug can also be used with other browsers such as IE.
Re:Double standards? by Anonymous Coward · 2004-07-30 23:09 · Score: 0

Of course, that won't stop me from using Firefox.
Oh, I read that as - I'll now be off and FIXING firefox. ...
There's always that option available unlike IE
Re:Double standards? by FooBarWidget · 2004-07-30 23:43 · Score: 1

Well... yes. Many, many people continue to use IE even after knowing there are alternatives and that IE is full of security bugs. Those people don't get labelled as "zealot". But somehow it's wrong to do the same thing with FireFox?
Re:Double standards? by HiThere · 2004-07-31 00:37 · Score: 1

Actually, for some meanings of "fixing", this has already been accomplished earlier in the thread.

The solution provided is to browse to about:config and turn off the ability to hide menus, toolbars, status bars, etc. This doesn't actually prevent the "spoof" from occuring, but it prevents it from being convincing. (Doubled status bars, menus on dialogs, etc.)

It seems to me that this is the way that the browsers should come set originally, and you should need to reset the flags if you wanted web-apps to look like normal applications...

There may be other, better, solutions, but this is one that you can implement on your own browser in less than 2 minutes.

--

I think we've pushed this "anyone can grow up to be president" thing too far.
Re:Double standards? by soloport · 2004-07-31 01:35 · Score: 3, Insightful

It works like this:
a) If you use anything Microsoft, you're an idiot.
b) If you use anything Linux, you're a maniac.

Sort of like slow-driver/fast-driver syndrome.
Re:Double standards? by naelurec · 2004-07-31 02:00 · Score: 1

If this was an issue with IE and not Firefox, I hope you'd still be saying the same thing?

Yes, it still wouldn't stop me from using Firefox. :)
Re:Double standards? by 1010011010 · 2004-07-31 02:28 · Score: 1
I can think of a few fixes
1. An option for "Do not load remote XUL", enabled by default, with the ability to whitelist certain servers/domains (such as the company intranet).
2. Warnings with confirmations that cannot be disabled when loading remote XUL, even when loading XUL from remote HTTP servers is enabled.
3. Different and distinct window styling for remotely-loaded XUL apps. I'm not sure what form this would take, but perhaps the title bar could include "REMOTE XUL APP" or something.
4. Disable the ability to load XUL by using Javascript inside a regular (html/xhtml) webpage.
I would like to point out that "Longhorn", Microsoft's XAML-enabled browser/operating system, will be vulnerable to this type of phishing as well, but on a perhaps greater scale, as IE/XAML is "integrated with the OS."
--
Napster-to-go says "Fill and refill your compatible MP3 player", which is a lie. It's not MP3. It's WMA with DRM.
Re:Double standards? by Halfbaked+Plan · 2004-07-31 02:58 · Score: 1

Indeed.

A NetBSD system, all nicely configured using FVWM2 and good solid well-known X configs (the O'Reilly X Window System Reference set is your friend) is probably the wisest choice.

Using FVWM doesn't give you much room to be a zealot or hothead, though.

--
resigned
Re:Double standards? by TRACK-YOUR-POSITION · 2004-07-31 03:18 · Score: 1

I think it's your final point that explains why Mozilla won't do your 4 numbered points--people at Mozilla are anticipating Longhorn, and hoping to offer some sort of similar functionality in Mozilla. If any way of solving this problem other than eliminating remote use of local widgets can be found, Mozilla would definitely prefer that, I suspect.
Re:Double standards? by Anonymous Coward · 2004-07-31 04:29 · Score: 0

I went to the spoof demonstration site and could not get it to work. Then I relized that I was trying to open the link in a new tab (I don't really like having lots of web browsers open). So, it seems tab browsing will keep me save!
Re:Double standards? by Anonymous Coward · 2004-07-31 05:09 · Score: 0

OK, you're not an idiot, maniac, zealot, or hothead. But you are a cromagnum for using such a 1993ish setup.
Re:Double standards? by Anonymous Coward · 2004-07-31 05:13 · Score: 0

MS has always been clear that Longhorn/Avalon will have some sort of security model that will be significantly better than the ActiveX debacle.

Maybe Mozilla should "anticipate" security as well -- otherwise XUL will be considered unsafe, will be disabled, and will be useless. (XPI is another good example where Mozilla didn't lock it down until after they saw XPSP2.)
Re:Double standards? by FuzzyBad-Mofo · 2004-07-31 05:46 · Score: 1

What about Apple users? (just curious) :)
Re:Double standards? by cbiltcliffe · 2004-07-31 05:52 · Score: 1

But you are a cromagnum for using such a 1993ish setup.

Cromagnum? Is that the new Dodge hopped-up Hemi-powered station wagon with nicely programmable customizable windows? (Ok...maybe it's not called the Magnum outside of the US and Canada...if it's even available...)

I believe the word you were looking for was cromagnon.

--
"City hall" in German is "Rathaus" Kinda explains a few things......
Re:Double standards? by alonsoac · 2004-07-31 06:25 · Score: 1

Everyone should move immediately to Firefox and then keep using it, regardless of this new bug. Don't you think?
Re:Double standards? by soloport · 2004-07-31 08:00 · Score: 1

What about Apple users? (just curious) :)

Well, they seem to be the drivers on the road that no one notices. Good drivers, though.

(BTW, yours is one of the coolest sigs. I've seen in a while.)
Re:Double standards? by FuzzyBad-Mofo · 2004-07-31 08:40 · Score: 1

Thanks, I just changed it (too many sig ideas, too little time).. At first I thought of using the * operator then realized that would be the value of 'here', not it's location.. ;)
Re:Double standards? by TRACK-YOUR-POSITION · 2004-07-31 12:00 · Score: 1

Okay, so they've got 2 years of time until Longhorn is released to change one a configuration defaults and fix this "problem". I think Mozilla will manage. ;)

flamebait? by Anonymous Coward · 2004-07-30 22:24 · Score: 0

I took that to be more funny than flamebait. Bravo other AC.

Modder must not be a true geek.

how is the specific to firefox? by Daniel+Ellard · 2004-07-30 22:26 · Score: 1

Couldn't someone hack together a javascript program that mimics the UI of IE/Safari/Opera/etc just as easily? Maybe XUL makes this easier but that's about it.

--
Disclaimer: I work for a company, but I don't speak for them.

Re:how is the specific to firefox? by Anonymous Coward · 2004-07-30 23:49 · Score: 0

Yes. and it has been done already on IE. Many times, I'd say, though I don't think it has been used with intention of fraud... yet.

In fact, in IE you can open windows even without 'chrome' (title bar and min/max/close buttons), so you can spoof even those things.

But I think of this more as a probably unwanted feature than a bug.

Bear in mind... by Aluminum+Tuesday · 2004-07-30 22:28 · Score: 5, Informative

Bear in mind that this spoof only looks convincing if you haven't changed your Firefox toolbar at all, ie. you haven't switched to smaller icons or added/removed/moved buttons.

It also fails to appear properly on the Macintosh.

If someone wanted to make some kind of exploit with this, they'd want to target a specific platform and Firefox revision. (eg. 0.9 on Windows) Since Firefox is in constant development, it could well change between revisions and render these spoofs obsolete.

I don't really see this as a Firefox vulnerability. Use any browser without a popup blocker, and you'll see a lot of popup ads pretending to be legitimate OS windows and dialogs. This is really just a variation of that.

Re:Bear in mind... by Anonymous Coward · 2004-07-30 23:22 · Score: 0

Since Firefox is in constant development, it could well change between revisions and render these spoofs obsolete.

I don't really see this as a Firefox vulnerability.

That's ridiculous. You can only use one version of Firefox at a time, and the vast majority of people don't fiddle with their toolbars. It's all very well complaining about the people who don't bother looking at the address bar then they go to http://paypal.scammers.com and put their details in, but what happens when the address bar shows https://www.paypal.com? What happens when you go to the Tools | Page Info menu item, and it tells you it is Paypal? What happens when you click the padlock icon and it tells you that it's certified as Paypal and encrypted? How is any reasonable person going to be able to tell the difference between a scammer's website and the real thing?
Re:Bear in mind... by Anonymous Coward · 2004-07-30 23:32 · Score: 0

A bad "feature" nonetheless. If we are trying to "sell" Firefox to the non-geekazoid community, we should make it as safe as possible.

Of couse IE is more "dangerous" because it comes with the OS and that is what most people would use. With all the recommendation to dump IE and use an alternative browser like Firefox, we surely do not want everybody to just install Firefox and trust it because _it_is_not_IE.

and the "not or Macintosh" point is weak - remember, the bad guys out target the product with the most market share. (I'm not anti-Mac BTW)

my two cents ...
Re:Bear in mind... by JRIsidore · 2004-07-31 00:32 · Score: 3, Insightful

Bear in mind that this spoof only looks convincing if you haven't changed your Firefox toolbar at all, ie. you haven't switched to smaller icons or added/removed/moved buttons.

Sure, if a toolbar suddenly looks like the default config all users will suspect a faked UI and get alerted instantly... you expect too much. IMHO many will simply assume the browser messed up their config and keep on browsing. Even if the majority gets suspicious, the small percentage that is fooled is most likely to be profitable enough for the phishers.
Any fresh Firefox installation asks about sending unencrypted form data, but not about executing arbitrary XUL stuff? This is a serious design flaw.

--
:w!q
Re:Bear in mind... by Aluminum+Tuesday · 2004-07-31 01:34 · Score: 1

I had a Mac with me and gave it a try. I wasn't making a point.
Re:Bear in mind... by Aluminum+Tuesday · 2004-07-31 01:39 · Score: 1

You've missed the point. Of course you're likely only to use one version of Firefox at a time, but the point I made is that updated versions of Firefox are likely to render obsolete spoofs that rely on the old versions' features or appearance.
Re:Bear in mind... by Anonymous Coward · 2004-07-31 02:53 · Score: 0

Also, if you open a new tab, it opens a blank page rather than a tab (since the toolbars are hidden). Of course I'd rather not do this with every web page 'just in case'.
Re:Bear in mind... by Atrax · 2004-07-31 03:33 · Score: 1

Yeah, but the folks most likely to be taken in by these things are also the folks least likely to be on the immediate upgrade train. This vulnerability will linger for a while, though the fact that Firefox is still a minority product does mean that users are more likely to either be:

Savvy themselves
Have a friend or relative who is savvy
Be someone who keeps up with the "net trends" therefore will find about this

hence mitigating the vulnerability somewhat.

This particular vln would catch me out though. The demo was very convincing (aside of course from the red text saying "hey this is a fake". But of course no self respecting scammer would leave such a blatant clue)

--
Screw you all! I'm off to the pub
Re:Bear in mind... by ScrewMaster · 2004-07-31 03:54 · Score: 1

Better yet, don't depend upon the browser as the be-all and end-all of your Web security. Set up a good filtering proxy server on another machine, and browser through that.

--
The higher the technology, the sharper that two-edged sword.
Re:Bear in mind... by Anonymous Coward · 2004-07-31 05:16 · Score: 0

> Bear in mind that this spoof only looks convincing if you haven't changed your Firefox toolbar at all,

Bear in mind that 90% of users will never change the default configuration.

Not sure how they'll fix this... by AC-x · 2004-07-30 22:29 · Score: 2, Informative

Without disabling XUL, I mean it's the equivilent of using images and text forms to spoof the IE menu bar, it just so happens that Firefox gives you tools that can be used to do a better job of it.

At any rate this can be overcome quite easily by changing the javascript prefs so that sites can't hide things like the status bar and menus.

Re:Not sure how they'll fix this... by Fnkmaster · 2004-07-31 06:33 · Score: 1

Like you said, the default javascript prefs need to be changed. Status bar should be immutable. And XUL links should always require some sort of authentication step from a user, warning them that they are about to open a XUL link ("You are about to execute an application from an untrusted source on the Internet. If you do, you may be vulnerable to certain security risks. You should only run such applications from trusted sources. Trust this source? Yes, No, Always"). The immutable status bar is then a last line of defense for users that are too dumb to know to say 'no' to a scary-looking warning box.

But you are right, XUL does provide a better/easier mechanism than IE DHTML or ActiveX for these spoof attacks right now. Seems like the fix is pretty darned easy, since the nature of the attack makes it somewhat limited in scope (unlike ActiveX attacks, which are virtually unlimited in scope).

Actually, perhaps a better idea would be to just ship Firefox/Mozilla with Internet-based XUL disabled. In other words, the XUL renderer can only load local XUL files by default and all attempts to load XUL from the Internet are blocked unless the user changes the default settings.

Javascript window "features" by Ianoo · 2004-07-30 22:29 · Score: 5, Informative

The real problem here is not so much XUL, but Javascript!

Why does the browser even allow Javascript to create popup windows without toolbars, menu bars and status bars? This has to be one of the most annoying features of any web browser, I can't for the life of me understand why anyone would think up or need such a feature.

Without this Javascript, you couldn't turn the real menubars and toolbars off, and the problem would be much less severe since although you'd have a second set of interface controls within the browser window, the real status bar would be at the bottom, and the real menubar would be at the top.

Firefox already has a way to block JS from doing this and using several other of its most annoying features, and indeed I personally have these limits switched on already. Put about:config in the address bar, and change these entires to the following values (or look up how to make a user.js file on Google):

dom.disable_window_move_resize = true
dom.disable_window_open_feature.close = true
dom.disable_window_open_feature.directories = true
dom.disable_window_open_feature.location = true
dom.disable_window_open_feature.menubar = true
dom.disable_window_open_feature.minimizable = true
dom.disable_window_open_feature.personalbar = true
dom.disable_window_open_feature.resizable = true
dom.disable_window_open_feature.scrollbars = true
dom.disable_window_open_feature.status = true
dom.disable_window_open_feature.titlebar = true
dom.disable_window_open_feature.toolbar = true
dom.disable_window_status_change = true

Now try the example given in the summary again.

Re:Javascript window "features" by Anonymous Coward · 2004-07-30 22:51 · Score: 0

I was only thinking about changing these to true only yesterday. I don't know why these are not enabled by defualt.

Well atleast .location and .status and possibably .titlebar, .close, directories, .toolbar and .personalbar

For more info
http://kb.mozillazine.org/index.phtml?title=Firefo x_:_FAQs_:_About:config_Entries

-AC
Re:Javascript window "features" by Moridineas · 2004-07-30 23:17 · Score: 2, Informative

I've used javascript to open windows without toolbar, status bar, etc. in an app where I think it is a quite useful feature.

Situation is web interface to a database. Popup windows are used to search database and fill in parts of the main form (product search, customer search, etc).

It saves a lot of screen real estate turning off those unnecessary things--and it's helpful for the user to have both the main form as well as any search windows open at the same time.
Re:Javascript window "features" by riscthis · 2004-07-30 23:39 · Score: 1

According to this comment in another bug, DOM events can still change the status bar text despite those config changes:

http://bugzilla.mozilla.org/show_bug.cgi?id=252811 #c9

(you may need to copy & paste the link, as they block slashdot referrer URIs)
Re:Javascript window "features" by doru · 2004-07-31 02:00 · Score: 1

Thanks for pointing that out. I have Javascript enabled, but with all the "Advanced Javascript Options" unchecked. I was very surprised (and annoyed !) to see that the spoof page could hide my toolbar. Sure enough, at a closer look only the status bar is covered.
I guess the easiest thing would be to have these preferences "true" by default and add them in the Javascript options, should a user want to change them...
Re:Javascript window "features" by killjoe · 2004-07-31 03:04 · Score: 1

The real problem is that browsers were never meant to be front ends to databases.

--
evil is as evil does
Re:Javascript window "features" by Svartalf · 2004-07-31 03:22 · Score: 1

Yes, and it's a damned security risk- just like all the "convienient" features of IE, like ActiveX scripting.

The WWW wasn't meant for the sort of thing you're describing. Just because it's convienient for you doesn't mean that it's a good idea- or that it's safe.

With this little "feature" I can't reccomend Firefox or Mozilla to any of my clients. As much as I want to, I can't, because it's as much a National Security risk as IE is right now.

--
I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
Re:Javascript window "features" by Enucite · 2004-07-31 03:39 · Score: 1

And instead you'll recommend?
Re:Javascript window "features" by RickHunter · 2004-07-31 04:01 · Score: 1

Also, if you use even any reasonably advanced featuers (like look in your bookmark menu, or look at your search engines bar, or even have the quicklinks bar turned on) you'll notice immediately that something's very wrong. Even if you haven't reconfigured your tooblar.

In short, it's temporarily convincing, and is a serious problem that the Mozilla developers need to fix and not mark "confidential" and ignore for years on end. But it's not anywhere in the same league as IE, which allows spyware viruses and such to infest your computer just by visiting a page.

I think that if a security patch isn't issued for this in about a week, multiple bugzilla bugs need to be opened continuously until one is.
Re:Javascript window "features" by FuzzyBad-Mofo · 2004-07-31 06:01 · Score: 1

Sorry, but that's just poor design. My college portal has something similar, and I abhor it. Instead of using a popup to select the criteria, try using a select box populated at runtime (or dynamic using script). It's much more intuitive and faster to use.
Re:Javascript window "features" by PetoskeyGuy · 2004-07-31 06:40 · Score: 1

Bless You Sir

This is awesome. I can't stand popup crap that takes away my menus to enhance my "experience".

Awesome.
Re:Javascript window "features" by Selanit · 2004-07-31 09:22 · Score: 2, Insightful

Why does the browser even allow Javascript to create popup windows without toolbars, menu bars and status bars? This has to be one of the most annoying features of any web browser, I can't for the life of me understand why anyone would think up or need such a feature.
This feature is useful:

1) Whenever you have to show the user some information that is not directly related to the task at hand. Example: you have a multi-page "wizard" style form allowing a user to enter information into a database. It is a fairly complex process, in which the options offered on later pages will depend on which options were selected on earlier pages. Scattered across each page, you have links that open a glossary to define a particular term. Opening the glossary information in a new window (one without toolbars, etc), allows you to provide that information to the user without interrupting their workflow. Toolbars are extraneous to the window, since it never shows anything but the glossary page. Showing them would be pointless, and would detract from the look-and-feel of the application.

2) When you want to offer a user the ability to view an arbitrary item from a list without reloading the page. Example: you have a bunch of images, and you want to let a user preview each one. You list each filename and other file details, then you have a link entitle "Preview", which opens up a new window (with no toolbar, etc) showing that image. Subsequent previews will resize the existing preview window and change its url rather than opening an entirely new one. If the preview button left the index page to preview each picture, it would increase the amount of traffic on your web server, with each new request for the index page. This may seem trivial, but if the index page is generated using information from a database, that can mount up fast, especially if you have multiple concurrent users. Again, toolbars are extraneous to the function of the window in this situation.

3) In any situation where you want to make two windows easily distinguishable from one another. If you have ever watched inexperienced or non-proficient web users, you will note that they frequently become confused when dealing with multiple browser windows, and this is especially true when the page author adds a target="_blank" attribute to a link. The new window opens, taking up all the available screen real estate, and looking exactly like the previous window, so the user naturally tries to use the "Back" button to return to what they were just looking at. But it doesn't work, and so they have to stop and study their open programs to figure out what happened. If, on the other hand, that content were opened in a smaller window with no toolbars overlaid on the parent window, it is instantly obvious that it's a new window, and the user is much less likely to get confused, leading to a better experience with the web site.

The first and second examples come from real life uses of window.open() -- both in my own pages. The third is applicable to virtually any proper use of JavaScript window control. I hate pop-up ads as much as anyone, and I'm profoundly grateful that FireFox blocks unsolicited calls to window.open(). Two other things make me glad: firstly, that you have the option of turning all that stuff off because you hate it; and secondly, I am glad that you're not in charge of FireFox development, because I suspect that a lot of "annoying" pages might not function properly in FireFox if you were.
Re:Javascript window "features" by Ianoo · 2004-07-31 09:38 · Score: 1

Opening the glossary information in a new window (one without toolbars, etc), allows you to provide that information to the user without interrupting their workflow. Toolbars are extraneous to the window, since it never shows anything but the glossary page. Showing them would be pointless, and would detract from the look-and-feel of the application.
Agreed there are some circumstances that it's useful, but I think the problems outweigh the benefits, ultimately. In your examples, why not use CSS positioning with some Javascript to make a popup definitions and windows for subtasks?
Re:Javascript window "features" by Moridineas · 2004-07-31 11:43 · Score: 1

Hah, that you would even make that suggestion shows how little real-world design you have done.

Try making a select box, however you want, that displays results from searching up to 9 different fields, and 80k records. The popup is simply a better method.
Re:Javascript window "features" by ibbey · 2004-07-31 12:48 · Score: 2, Informative

The real problem is that browsers were never meant to be front ends to databases.

Bullshit. As far as I know, Mosaic 1.0 had basic forms. Coupled with a cgi script, Mosaic was a DB front-end from the beginning. On top of that, Mozilla is, of course, the direct descendent of Netscape, which was designed by Marc Andressen, the original developer of Mosaic. Andressen stated repeatedly that he wanted to make Netscape a platform rather then just a browser, so your point is quite thouroughly shot to hell.

But even if your statement was remotely correct, it would still be irrelevent. Just because the original designers didn't foresee an application, doesn't mean that the application is somehow verboten. Innovation happens. Deal with it. The browser makes the IDEAL front end to a database. Properly implemented, it provides near write-one, run-anywhere capabilities to application developers. If you are developing an kind of database application, and you want to be able to support all users, regardless of OS, one of the easiest possible solutions is to create a browser based app. Sure you could do it in Java, but not everyone has Java installed or turned on (I don't). And sure you could write a frontend in Python (or whatever), but most users won't have the necessary software installed. By making it web based, and coding carefully, with a liittle effort you can support probably 98% of all users, without requiring anything of your users except that they be running a recent browser.

This spoofing exploit is a serious issue, but it's not one that suggests that we should throw away the "browser as platform" concept. The problem needs to be addressed, but there are several ways to do that without crippliing the browser.
Re:Javascript window "features" by ibbey · 2004-07-31 13:37 · Score: 1

All of these are excellent examples of why shutting off toolbars can be a good idea. They are also good examples of why the solution I suggested much earlier would work well...

Whenever a new window is opened, and the default UI is changed, place a vertical warning bar along the left side. This would be fairly clutter-free and non-intrusive, but provide a simple, clear indication to all but the most naieve user that something isn't right. As long as the warning is distinctive, and cannot be disabled code, it should provide sufficient protection from spoofing.
Re:Javascript window "features" by FuzzyBad-Mofo · 2004-08-01 08:46 · Score: 1

Hah, that you would even make that suggestion shows how little real-world design you have done.

Wow, nice attitude. You should try to accept constructive criticism instead of lashing out.

Try making a select box, however you want, that displays results from searching up to 9 different fields, and 80k records. The popup is simply a better method.

The problem is not trying to add that much functionality to a select box, it's about reducing the complexity so that a simple interface is all that's needed.

For instance (using my school's web portal again), to select my current semester, the page opens a pop up window where I select my major. Then, it opens another pop up window where I select my semester. Finally, I select 'Go', and my classes are displayed. There is absolutely no reason my program and semester couldn't be simple select boxes, instead of these complicated pop-up interfaces. Or at the very least, they could use cookies to remember my last choices.

I don't know what your project requirements are, but pushing unnecessary complexity on the end user is always bad design.
Re:Javascript window "features" by Svartalf · 2004-08-01 13:12 · Score: 1

Opera right at the moment. It's at least a little harder to pull the same stunt off with it than Firefox.

The whole thing's a bad idea from the get-go- right on up there with some of the IE bad ideas.

The WWW is not an application framework. That you can do many applications under it is a testament to it's overall power and flexibility, but it doesn't mean you should do intrinsically bad things to make making application use "prettier" or "easier".

--
I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
Re:Javascript window "features" by Moridineas · 2004-08-01 13:29 · Score: 1

Wow, nice attitude. You should try to accept constructive criticism instead of lashing out.

Hey, I'd love some constructive criticism.. What I love less is blanket statements like "Sorry, but that's just poor design." without knowing details of the project, etc.

If you're interested, one such app is an internal order app used to take phone orders. you can use most of it without using the mouse. When a customer calls the order taker clicks "lookup customer" .. a popup .. pops up, with 5 search fields--zip code, customer number, name, previous order dates, purchase order numbers. after searching for something here the possible customers are displayed in a list, where the proper one can be clicked, and all available customer info is displayed. At this screen is a "this is the customer" button, which fills in a fraction of all the info to the main order form page (also closes the popup).

There is also a product lookup that works basically the same way . There there is a shipping cost calculator.

Now like I said, if you've got any constructive criticism other than "Sorry, but that's just poor design." I'd love to hear it :-p
Re:Javascript window "features" by Anonymous Coward · 2004-08-04 14:02 · Score: 0

Take a look at Digikey's part search webpage, I think it does a much better job at basicly what you're talking about. True, it has a much smaller selection space, but you can probably replace most of the select boxes with typed in values.
Their film capaciter search: http://www.digikey.com/scripts/dksearch/dksus.dll? Criteria?Ref=248904&Site=US&Cat=30540500
Their list of other part searches you can do: http://www.digikey.com/scripts/dksearch/dksus.dll? KeywordSearch&site=us

There's something rotten in Firefox. by cyclop · 2004-07-30 22:29 · Score: 5, Insightful

And not just for the bug itself (that probably will be fixed quite rapidly). There are two issues behind this.

(1).The problem was known 4 years ago, but it was marked confidential. I'm not familiar with BugZilla,so I didn't even know there could be a "confidential" bug. This is the antithesis of Open Source philosophy. This is pure security-through-obscurity, in pure M$ style. If the bug wasn't "confidential",I'm sure we should have seen this fixed years ago.
I just hope most of the other open source/free software projects I rely on every day (Linux,KDE,Mplayer,Kile,Thunderbird,Nicotine and so on...) don't follow such a moron habit.

(2)How can the browser load XUL code and use it without warning? This is not a bug: this looks more like IE-like flawed design. Correct design shouldn't even *read* any data of this kind, let alone running it and let it deface the browser itself!

The Mozilla family of browsers/mail clients is still a crew of wonderful programs,and I'm proud of using them. But they will rapidly become IE-like crap, if they continue this way.

--
-- Patent no.123456: A way to personalize /. comments with a sig attached to the end.

Re:There's something rotten in Firefox. by AC-x · 2004-07-30 22:44 · Score: 3, Interesting

I certainly think having confidential bugs was a very bad idea (who gets to see them I wonder?) but running XUL code is hard not to without making it quite useless, at work we plan to look at it with the view to using it in our web applications instead of HTML (which I think is one of the things it was originally for).

I mean, it's basically the same as using images to spoof the IE toolbars, Firefox just gives you the tools to do a better job of it.

The only thing I can think of that wouldn't make using XUL a total pita is to warn the users first time a site trys to use it, something like

"Do you want this site to create an interface in XUL (phishing warning blah blah blah).
[Yes] [No] [x] remember this for xyz.com
Re:There's something rotten in Firefox. by October_30th · 2004-07-30 22:53 · Score: 1

The problem was known 4 years ago, but it was marked confidential. I'm not familiar with BugZilla,so I didn't even know there could be a "confidential" bug.
Me neither. The exploit itself appears to be relatively insignificant, but the way it has been kept buried for 4 years is not.
If this cover-up is indeed true, how can we be sure that there aren't other, confidential and perhaps even more serious bugs and exploits in all Mozilla family products?

--
The owls are not what they seem
Re:There's something rotten in Firefox. by cyclop · 2004-07-30 22:57 · Score: 1

I'm not too much inside the XUL thing, but AFAIK you can use it for rapidly creating plugins and extensions to the browser. And OK,this is cool. But why in the hell it should be automatically loaded and executed? The pop-up dialogue you propose is IMHO useless. How can the user know if it's a Good XUL interface or an Evil XUL interface? Everyone would click OK,and get somehow spoofed.

--
-- Patent no.123456: A way to personalize /. comments with a sig attached to the end.
Re:There's something rotten in Firefox. by Jugalator · 2004-07-30 22:59 · Score: 3, Insightful

The problem was known 4 years ago, but it was marked confidential. I'm not familiar with BugZilla,so I didn't even know there could be a "confidential" bug. This is the antithesis of Open Source philosophy.

I fully agree this is a very bad idea. All it takes is someone to get hacked, or in another way disclosing information about these secret bugs, and then they might start circulating among "underground" hackers without us knowing it, and voila we have an exploit for an issue a very large group of the developers didn't even know exist.

If they did know, they could of course have offered help in resolving the bug much earlier.

They need to start thinking about these things now as the browser might start to gain momentum. Even if it's not huge problems revealed, merely the fact that secret bugs exists and are revealed now and then (I have no doubt we'll see more in the future since this is probably not the only one), is severe negative publicity for the Mozilla products. It wouldn't be nearly as bad if the bugs weren't secret.

--
Beware: In C++, your friends can see your privates!
Re:There's something rotten in Firefox. by smittyoneeach · 2004-07-30 23:06 · Score: 1

How about a fundamental question: how can you dynamically tweak an interface using without opening up the possibility that Bad Things will creep in?

--
Get thee glass eyes, and, like a scurvy politician, seem to see things thou dost not.--King Lear
Re:There's something rotten in Firefox. by Spellbinder · 2004-07-30 23:11 · Score: 1

(1). can you prove this somehow? (2). the problem is the java scrip hiding the original toolbars/statusbar/ usw. without it there would be no danger.
i think it would be easy to change the color of any XUL delivered from a website -> could be integrated into the themes so it does not stick out to hard
so you could see what is website stuff and what browser

--

stop supporting microsoft with pirating their software!!!!!
Re:There's something rotten in Firefox. by Anonymous Coward · 2004-07-30 23:16 · Score: 2, Interesting

The problem was known 4 years ago, but it was marked confidential. I'm not familiar with BugZilla,so I didn't even know there could be a "confidential" bug. This is the antithesis of Open Source philosophy. This is pure security-through-obscurity, in pure M$ style.

The problem isn't that it was confidential - very few people advocate *immediate* full disclosure without warning the vendor first. The problem is that the confidential bug report wasn't addressed.

I would like to see confidential bugs viewable within BugZilla, but with the actual report itself hidden (just the metadata like title, reporter, date reported, etc visible). I would also like to see confidential bugs have a time limit of a month before they become publically viewable (with email reminders to the proper parties of course).

I agree that there should be a warning before rendering a XUL interface without normal toolbars, etc.
Re:There's something rotten in Firefox. by sanctimonius+hypocrt · 2004-07-31 00:05 · Score: 1

The problem isn't that it was confidential...
Well, I kind of think it is the problem. Who's cleared for this classification? Who has the "confidential" stamp, and the authority to use it? I want to wait and see the facts come out, and not make a judgement based on slashdot comments, but if this stuff is true, the coverup will hurt their reputation more than the bug.

Power corrupts; Give someone a "classified" stamp and they'll abuse it.
Re:There's something rotten in Firefox. by mcsmurf · 2004-07-31 00:27 · Score: 2, Informative

Either a reporter can mark his own bug confidential or a member from the security group can mark it confidential (or remove that flag). The members can be found here. Those are either members of the Mozilla Foundation, people who have done coding for Mozilla for many years now or were in any other way involved for a long time in the security of Mozilla. Or earlier (like one year ago) it were also people from Netscape, but i don't know how many people from Netscape actually had access to those bugs.
Re:There's something rotten in Firefox. by sanctimonius+hypocrt · 2004-07-31 01:09 · Score: 1

Thanks, that's good to know. I'm relieved to see that they're open about it, and there's community oversite. I guess this is an example of oversite in action. Beats a congressional hearing, anyway.
Re:There's something rotten in Firefox. by AlXtreme · 2004-07-31 01:23 · Score: 3, Insightful

The only thing I can think of that wouldn't make using XUL a total pita is to warn the users first time a site trys to use it, something like
How about just disabling the execution of remotely-retrieved XUL files from within Firefox by default? I'm surprised Firefox didn't warn before loading the spoof from the remote site, it clearly should as a minimum. However as more and more new users with the click-before-you-read syndrome try out Firefox having it disabled by default seems the only sane thing to do.
If you want to view your web applications internally using XUL, having a whitelist akin to the popup blocker seems the best way (don't bother user unless he figures out something is missing and he clicks on the disabled-window icon). For all us people just wanting to browse some HTML, automatically (or even after prompting) running XUL from a remote server is a flaw and potentially dangerous, and should be considered as such. I'm amazed this hasn't received more attention.

--
This sig is intentionally left blank
Re:There's something rotten in Firefox. by arantius · 2004-07-31 03:33 · Score: 1

Let's say there's a really big, really bad exploit. It takes two lines of code and gives anyone who wants it 100% control of your computer.
It's gonna take a week to fix. How about we give the developers a week to fix it before we just go shouting out to the world "Hey big massive security hole here!"

Confidential is not purely bad. Leaving a bug confidential for years ..... very bad.

--
Health is simply dying at the slowest rate possible.
Re:There's something rotten in Firefox. by ScrewMaster · 2004-07-31 03:58 · Score: 1

It wouldn't be bad at all if the bugs weren't secret. Nobody with half a lobe expects Mozilla to be bug-free, but we have (given all the hype) come to expect them to be honest. Now I'm not so sure. This is a much bigger black mark against them than any exploit would be. True hypocrisy.

--
The higher the technology, the sharper that two-edged sword.
Re:There's something rotten in Firefox. by Anonymous Coward · 2004-07-31 04:03 · Score: 0

(2)How can the browser load XUL code and use it without warning? This is not a bug: this looks more like IE-like flawed design. Correct design shouldn't even *read* any data of this kind, let alone running it and let it deface the browser itself!

XUL is not code, it's just structural markup like HTML. You could do similar things, though with a lot more work, with regular HTML and CSS.

It is disturbing that this problem has been sitting, hidden, for 4 years, but the solution is far from clear and simple.
Re:There's something rotten in Firefox. by Anonymous Coward · 2004-07-31 04:46 · Score: 0

Hypocrisy? The secret security bug policy is spelled out on their website:
http://www.mozilla.org/projects/security /security- bugs-policy.html

Furthermore, this isn't at all unique in the OSS world. Apache, Linux-Kernel, Sendmail, Bind, and so on all have "back channels" for security bugs. Why do yo think when a bug is released, every distro has a patch within 24 hours?

The worst thing about this bug is not that it was marked Secret, but that they had/have no real intention of fixing it.
Re:There's something rotten in Firefox. by WuphonsReach · 2004-07-31 06:48 · Score: 1

The problem was known 4 years ago, but it was marked confidential.

Four years ago... The Mozilla Foundation is only what, a year old? So that means that four years ago it would've been under the control of AOL? Who was in control of the group at that point?

What were the defined procedures for handling security-related bugs at that point in time? Did someone just forget about this one? (Dig through Bugzilla sometime... there are lots of bugs outstanding that look like they've simply been lost in the shuffle.)

--
Wolde you bothe eate your cake, and have your cake?

Not really an exploit.. Not really new either by auzy · 2004-07-30 22:29 · Score: 0

This is basically a screenshot of a toolbar at the top of the browser.. I barely think its classed as a true exploit anyway, so the author got it wrong really..

The good thing is that I'm guessing people will fix it, but regardless, the only way to get tricked by it would be to click something on a webpage, so its unlikely that theres an easy way to give the link to the user without them noticing its dodgy.. Either way, its probably something which should be fixed, but its not something which can be fixed easily..

Either way, even if its fixed, its pretty trivial to make something with javascript that does exactly the same effect but does it better.. so I'm not worried at all.. Something like this can be done on any browser, so I think rat144 is using very poor judgement, and at the end, is:
-Causing ppl to worry about something which can be done in other ways anyway almost as well..

-Has now given a bad idea to blackhat crackers around the world, which is great, especially because there is no effective way of fixing this other then forcing a taskbar at the bottom with the effective address, which wont help everyone, and at the very least informing script kiddies of attacks like these will encourage them to attack every server..

I wonder why people like announcing problems like these without trying to implement a solution themselves, so at least they know if its possible before causing havoc online for everyone..

Re:Not really an exploit.. Not really new either by auzy · 2004-07-30 22:37 · Score: 1

Actually, just read the discussion and seems they agree with what I thought.. So seems Rat's just trying to get some attention..
Re:Not really an exploit.. Not really new either by Anonymous Coward · 2004-07-30 22:42 · Score: 1

Either way, even if its fixed, its pretty trivial to make something with javascript that does exactly the same effect but does it better.

Have you got proof-of-concept of that hidden away somewhere? The padlock-icon spoofing was damn scary.
Re:Not really an exploit.. Not really new either by AC-x · 2004-07-30 22:55 · Score: 1

> I wonder why people like announcing problems like these without trying to implement a solution themselves, so at least they know if its possible before causing havoc online for everyone..

Oh dear, the old "if you can't fix it yourself don't complain about it" attitude.

If he can figure it out on his own then so can hackers, not telling anyone just means that *no-one* can work on a fix (which is why no bugs should ever be maked as confidential unless one of the main developers plans to release a fix for it very soon, eg not after 5 years).

At any rate I can't see how this could possibly create havoc, the spoof didn't look anything like my toolbar and I think most phishermen (or whatever they're being called these days) will still be targeting IE while it's userbase is +90% (and there are plenty of ways of spoofing with IE just as well)
Re:Not really an exploit.. Not really new either by auzy · 2004-07-30 22:58 · Score: 1

You can pretty much just use javascript to open a new window anyway.. For the people who are unthemed, javascript works just as well, and ppl who are, most would just assume that its a bug which causes the theme to change back.. Throw in precaching and HELLO.. those buttons load instantly

Same thing, just different implementation, and cant be stopped either without disabling javascript.. My issue with this is that attacks like these have been known throughout the community for years, but not many people knew about it. because of their nature, they can even be implemented in html without javascript, so they cant be stopped.. Now these geniuses have made it a big enough issue so that every spammer and script kiddie in the world knows, so has informed spammers of an easy way to harvest emails, frauders an easy way to pretend that their purchases are valid and credit card kiddies with a credit card harvester..

Basically, thanks to him, from this time on, we'll probably see a massive increase in spam and online fraud..
Re:Not really an exploit.. Not really new either by nothings · 2004-07-30 23:36 · Score: 1

Dude, you seem to have missed the part where they ALREADY marked the bug unconfidential on bugzilla (before this particular demo of the exploit was released) and where a bunch of researchers at Dartmouth published several papers on it.
Re:Not really an exploit.. Not really new either by Nailer · 2004-07-30 23:48 · Score: 1

This is basically a screenshot of a toolbar at the top of the browser..

Sure, if by 'basically' you mean 'not'.

It's not an image, it's chrome, as a parent poster notes, and will show a toolbar using your current theme that tellss lies in place of the real one.

I agree with the other poster who said websites shouldn't be able to disable toolbars.
Re:Not really an exploit.. Not really new either by zsau · 2004-07-31 00:55 · Score: 1

Umm... as far as I'm concerned, if normal users will get confused and abused by it (and if normal users used Firefox, they would by this), it's an exploit (well, not entirely true, use your brain to understand what I mean, not find exceptions).

Secondly, all exploits can be fixed. A webpage has no reason to look/behave like a browser, so it should not. It should not have the ability to.

Thirdly, not everyone knows how to fix the exploit. Because blackhats now know how to abuse it, it must and will be fixed. The Mozilla developers can't use the excuse of not having had sufficient warning; by now any excuse for not having corrected the problem has been exhausted and it was most appropriate to release this.

FOSS is not exempt from the same considerations of commercial software. Knowing that this was marked 'confidential' scares me. Aren't we the very group of people who have been cursing propriatory software makers from abusing security through obscurity?

--
Look out!
Re:Not really an exploit.. Not really new either by bwy · 2004-07-31 01:34 · Score: 1

Parent should be modded all the way down. There are enough replies that show this post to be complete garbage.

This is basically a screenshot of a toolbar at the top of the browser
NOPE

its pretty trivial to make something with javascript that does exactly the same effect but does it better.
NOPE

the only way to get tricked by it would be to click something on a webpage
yeah, when browsing I never click on pages so no threat there.

5 Insightful? Christ.
Re:Not really an exploit.. Not really new either by bwy · 2004-07-31 01:38 · Score: 1

the spoof didn't look anything like my toolbar and I think most phishermen (or whatever they're being called these days) will still be targeting IE while it's userbase is +90%

So Firefox used to be safe because it was "rock solid." Now, it is safe because nobody uses it anyway so it isn't a target, and anyways- people customize their toolbars so the spoof will look fake to them. Man, OSS has went to the shitter fast. But, I like the part about it being safe because nobody uses it. Classic.
Re:Not really an exploit.. Not really new either by veritron · 2004-07-31 02:09 · Score: 1

You're not being observant.

a. A screenshot wouldn't have convincing drop-down toolbars.

b. More importantly, look at the bottom with the security certificate. I've seen much, much less convincing phishing schemes work than this one.

If it were just a screenshot the menus and security certificate dealee wouldn't work at all - but they look and work virtually identical to the firefox config now. Click on the security panel and watch as a window with a TABBED INTERFACE IDENTICAL TO FIREFOX'S comes up.

True, you can disable some stuff in javascript to make this completely ineffective, but it's damn scary.

MouseGestures! by ptarjan · 2004-07-30 22:32 · Score: 1

I guess this is another triumph for mouse gestures.

If you try to do any gesture on that page with the "All-In-One Gestures" extension installed, a bright red bar apears at the top and grows with each gesture.

Maybe they didn't code for this, but is sure is noticeable.

Re:MouseGestures! by numark · 2004-07-31 00:59 · Score: 1

This proof-of-concept page seems to be a quick hack to simply prove that it can be done. If the author spent enough time, I'm sure they could code something that would fix many of the weird quirks that are in the current XUL version. And, frankly, that's what concerns me.

--
Want Slashdot headlines on your site? Try SlashHead

Its not mine, its not a story, by kayen_telva · 2004-07-30 22:36 · Score: 0, Offtopic

and it may not even be funny anymore: Tux and his buddy

Re:Its not mine, its not a story, by kayen_telva · 2004-07-30 22:38 · Score: 0, Offtopic

whoops. way too early. forgot the email addy fbdsl @ hotmail.com

How to spot the spoof! by Anonymous Coward · 2004-07-30 22:36 · Score: 0

Just customize your tool bar. If you right click on the toolbar and choose customize, you can add/remove and move your buttons and what not around. If you hit a spoofed site and your buttons have been moved about, you know your being had.

going home - read this... by imag0 · 2004-07-30 22:39 · Score: 0, Offtopic

Ok guys, run with it for a while and see if someone notices. I imagine enough threads with this modded up the better chance of this color scheme going away.
the evil color scheme starts with http://it.slashdot.org...blah. just pull off the 'it.' and the color scheme switches back to normal.
Here, a nice copy-and-paste template, just populate it with the edited link like so:

Fix the Colors!

Mod me up if you hate the color scheme. Here's a fixed link using the "old" slashdot colors:

<a href=""></a>

that's it. Good luck!

(P.S. This is not for Karma. It's already excellent. I could care less. I would like to stop flinching when I bring up a page, however.)

Re:going home - read this... by Anonymous Coward · 2004-07-30 22:42 · Score: 0

Changing the third level domain only works if you have a numeric sid. At least get it right.
Re:going home - read this... by arcanumas · 2004-07-30 22:46 · Score: 1

So those who actually like the colors should mod you down?

--
Slashdot Sig. version 0.1alpha. Use at your own risk.

pagerank is finally available for firefox by zboubi · 2004-07-30 22:44 · Score: 1

Here is the plugin : http://www.tapouillo.com/firefox_extension/

Too much zealotry by brainnolo · 2004-07-30 22:45 · Score: 4, Interesting

Well, this IS a bug, and a very nasty one, as the author of that page said, everything in that page can be made to work. With some Javascripts you could even identify which version of browser is running and adapt to it. I've been impressed by clicking on the pad lock. I don't think web pages should ever need to load XUL, this is bad design for me. I don't get how can you say that this is not a bug, that this can be done also in IE. Is not true! Those for IE are almost all just gifs and are very easy to notice. But wait, Mozilla loading XULs via HTTP:// without even popping-up an alert is a feature, IE loading ActiveX is..bad design! Why? At least ActiveX's CAN be useful! Please stay with your feet on the floor.

Re:Too much zealotry by AC-x · 2004-07-30 23:00 · Score: 2, Insightful

Using XUL through HTTP can be _very_ useful, we're looking at it to replace using HTML in our web applications and it looks like it would be do a very good job at it (I think that's one of the things it was built for).

As for ActiveX, that's actually running code on your computer, XUL is just an interface language. You can't run XUL that'll install spyware on your machine for example.
Re:Too much zealotry by brainnolo · 2004-07-30 23:10 · Score: 1

While XUL can't install spyware, it can really spoof the interface, if i didn't know that thing was i spoof i may have been fooled very easily. Also i don't get why you are all saying that the same thing can be done via gif's, that's not true, gif are images, change theme in the browser (or the whole OS) and they are useless, instead via XUL the same page looks with the right style on Windows, Linux and Mac and i guess it adapts to whatever theme is installed. Currently i don't know of any example of useful XUL through HTTP, i think there are more risks then benefits. Also, isn't XUL supported by Mozilla's family browsers?
Re:Too much zealotry by AsbestosRush · 2004-07-31 00:46 · Score: 1

Currently i don't know of any example of useful XUL through HTTP

Narrowband. The content is already on the user's computer, the user is already accustomed to the UI look/feel. Just to name 2 off of the top of my head.

--
EveryDNS. Use it. It works.
AC's need not reply

Damn.. by sw155kn1f3 · 2004-07-30 22:46 · Score: 1, Insightful

> Of course, that won't stop me from using Firefox.
I used to say the same about IE 2-3 months ago, you insensitive clod!

--
- Arwen, I'm your father, Agent Smith.
- Well, you're just Smith, but my father is Aerosmith!

That's it... by canavan · 2004-07-30 22:46 · Score: 2, Interesting

now I'll go back to browsing with telnet and openssl s_client.

This is pretty bad... but... by ravydavygravy · 2004-07-30 22:47 · Score: 2, Interesting

Well, I have to say that this exploit is particularly serious - but not the end of the world. I've every faith we'll see a fix fairly soon...

It's pretty bad because it has the end results of several techniques rolled into one handy package - URL spoofing, fake certs, browser highjacking...

Several workarounds being mentioned - using a non-standard toolbar (add at least one extra button/menu-item so you can identify a fake version...), and possibly a non-standard theme would work (though I'm not so sure about this one...)

Anyway, net result - firefox has a pretty bad security problem, with a fairly easy workaround, and no doubt a fix in the works... - how about not allowing remote sites to run XUL without first warning the user (with the option to turn this warning feature off of course - it's all about choice, right?)

Dave

Re:This is pretty bad... but... by Anonymous Coward · 2004-07-30 22:59 · Score: 0

I've every faith we'll see a fix fairly soon...
Perhaps not. It's been five years since this vulnerability's been known by the Mozilla devs. That disturbs me. Methinks there might be something fundamentally flawed with the XUL architecture.
Re:This is pretty bad... but... by imbaczek · 2004-07-30 23:10 · Score: 1

They haven't fixed it for 5 years, why should they do it now? This rather means that they don't know if it's even a security threat.

How about webapps by Anonymous Coward · 2004-07-30 22:50 · Score: 1, Informative

The issue is that Firefox/gecko is advertised as a way to make a popup look and act like a real app : if you don't allow scripts to remove the browser part, a xul application wouldn't look like a real application anymore, would it ?
At work, I have managed to convince my bosses to use xul/php/postgres/soap instead of java/.net for our core project partly because of that (though i don't really care about that, portability and ease of devellopment is the main reason i pushed xul).
If you remove that, I don'think xul really stands out as a framework ; it would be too much tied to a browser.

Re:How about webapps by Ianoo · 2004-07-30 23:17 · Score: 1

Well, how about a popup dialog box, for example telling the user that "the page you are viewing is trying to use XUL..." or something more friendly?
Re:How about webapps by Anonymous Coward · 2004-07-30 23:59 · Score: 0

Actually the mozilla team is working on it :
http://www.xulplanet.com/ndeakin/archive/2004/6/22 /

You are right, Mozilla should be very restrictive by default and very permissive if the user allows it. But that not specific to this browser, IE has implemented such features and :
- It doesn't work because users click "Yes" on every popup you throw at them (I've seen an friend on XP click yes on this personnal firewall message : "Do you want to allow access to xxx.xxx.xxx.xxx on port xxx ?")
- It can be hacked (how many IE exploits use the IE secure area ? i'm sure it will be the same for gecko)
Re:How about webapps by HiThere · 2004-07-31 00:22 · Score: 1

OK. But perhaps that option shouldn't be on by default. Since it's as easy to change as browsing to about:config and double clicking a few lines, perhaps that should be required to open the vulnerability.

If it were off by default, then there would be scant chance of any exploit propagating, and it could still be used in the manner desired.

--

I think we've pushed this "anyone can grow up to be president" thing too far.
Re:How about webapps by Svartalf · 2004-07-31 03:14 · Score: 1

Webapps shouldn't be able to manipulate things that closely. Anything that allows a spoof attack is a security risk- and therefore SHOULD NOT be available for use. Simply put, let the apps be local or via something like VNC, but don't let them manipulate the UI of the browser in such a way as to allow this sort of thing- if it's via the web, it needs to look like it's via the web.

Convienience should never take precedence to security on the Internet- and it's the lack of applying that thinking to Windows (they've got it exactly BACKWARDS...) that has made it the virus/worm/trojan haven that it is today.

--
I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas

I'm protected in three ways... by Mr.+Smoove · 2004-07-30 22:54 · Score: 2, Interesting

1. I use a custom theme (Qute as it happens) with small icons

2. I've cutomised my toolbars to reduce them into one (plus bookmarks)

3. I have Tab Browser Extensions installed and I run in Single Window mode so all pop-up windows get opened inside my one browser window.

This is the power of Firefox!

--
Mr. Smoove

Re:I'm protected in three ways... by Anonymous Coward · 2004-07-30 23:48 · Score: 0

I use a custom theme (Qute as it happens) with small icons
This point is not relevant, XUL will render it's chrome using whatever theme you have active.

OK by sw155kn1f3 · 2004-07-30 23:01 · Score: 1

These funny colors at slashdot, broken IE, broken Firefox...
Bye bug-infested and eye-sore world, I'm going to live in a cave and use text-based browsers on good ol' green 300 baud terminal.

ThanNO CARRIER

--
- Arwen, I'm your father, Agent Smith.
- Well, you're just Smith, but my father is Aerosmith!

What is all the fuss about? by Ath · 2004-07-30 23:05 · Score: 1

That's not a bug, it's a feature.

Re:What is all the fuss about? by Anonymous Coward · 2004-07-30 23:57 · Score: 0

That's not a bug, it's a feature.

Do you work for Microsoft?

too bad, Mozilla suite suckers! by frankie · 2004-07-30 23:10 · Score: 5, Informative

We fans of the "bloated" original Mozilla are once again left in the dust by Firefox. Loading the test page results in:

XML Parsing Error: undefined entity Location: http://www.nd.edu/~jsmith30/xul/test/browser.xul Line Number 20, Column 1: <window id="main-window" ^

In seriousness, that's probably just an artifact of Firefox-specific XUL in the example, and could be fixed by a dedicated black hat. I agree with Lanoo, all versions of Moz should disable javascript toolbar-hiding by default.

Re:too bad, Mozilla suite suckers! by CableModemSniper · 2004-07-31 00:36 · Score: 1

Yeah I got the same thing using Galeon (1.3.15)

--
Why not fork?
Re:too bad, Mozilla suite suckers! by Pembers · 2004-07-31 04:02 · Score: 1

The same thing happened to me (Mozilla 1.6). Before spitting out that error message, the page maxed out my CPU and hammered away at my swap partition for about a minute. If I hadn't already known what it was, this would've been a good clue that something dubious was going on.

--
Just another wannabe fantasy novelist...
Re:too bad, Mozilla suite suckers! by tiptone · 2004-07-31 07:59 · Score: 1

not disagreeing with you here, but it's not as if that fact should come as much of a surprise. the second sentence of the first paragraph after the heading reads,
"This particular demo does not work in the Mozilla Browser, but I know of no reason one could not be created."
so i don't know if the line you pointed out is in fact the culprit, but it's surely something Firefox specific somewhere.

--
Please don't read my sig.
Re:too bad, Mozilla suite suckers! by Ernesto+Alvarez · 2004-07-31 15:56 · Score: 1

In seriousness, that's probably just an artifact of Firefox-specific XUL in the example, and could be fixed by a dedicated black hat.

BZZZT WRONG!!!

You just haven't RTFA.
Check the "original" vulnerability in the secunia report.

http://bugzilla.mozilla.org/show_bug.cgi?id=244965

In the first message post there is a PoC that "steals" your master password with a similar trick, and it works ok in mozilla classic 1.2.1.

It is definitely NOT firefox specific.

The PoC:
http://bugzilla.mozilla.org/attachment.cgi?id=1495 00&action=view

WARNING: It fscks up the keyboard controllability of mozilla.

--
GPG 0x1B479C78
Re:too bad, Mozilla suite suckers! by Anonymous Coward · 2004-08-01 01:06 · Score: 0

BZZT WRONG!!!

You just haven't read the parent post.

The example at nd.edu is Firefox specific, true, and different XUL works in Mozilla, also true.

Variation, but not new by Anonymous Coward · 2004-07-30 23:11 · Score: 0

While this is a vulnerability, and XUL does make it easier, this is nothing more than a variation on a theme. The same thing can be done with gifs and javascript to suppress the menubar.

Given the way JS works, a fix is not really possible. Even if the FireFox team completely disabled XUL being downladed, the menubar could still be imitated using other methods. This is true in IE, Mozilla, Firefox, and Opera.

Using a customized interface would make the spoofed site look incorrect, but many gullible users would still fall for it.

shit! by t_allardyce · 2004-07-30 23:12 · Score: 1

Pretty surprised at Mozilla for having confidential bugs - is this something old from less open days or something? The browser window must be a sandbox thers no other way, this goes for every browser out there and most other things. Java, Javascript and any other styling or scripting languages must be implemented in some sort of sandbox, i know people want to have pop-up windows that hide or control the interface but there must be sacred parts (such as the address and status) that cannot be changed by anything - including extensions, no-one needs to put scrolling text in the status bar or change the reported address and users need to check that they are where they think they are before doing anything confidential. the padlock has to be the most worrying bit, and i hope the proof-of-concept writer kept their identity otherwise paypal will probably go nuts on them and cite some DMCA crap or something.

--
This comment does not represent the views or opinions of the user.

This is a feature..... by Anonymous Coward · 2004-07-30 23:13 · Score: 1, Funny

....to make former IE users feel at home...

Konqueror by bbqchips · 2004-07-30 23:17 · Score: 1

I switched to Linux because a friend sent me a link that infected my pc with internet explorer (all updates installed), now there is a vulnerability for Firefox that can spoof a secure website... Looks like the only alternative is Konqueror. Too bad it lacks some of the adblocking features.

Re:Konqueror by NoMercy · 2004-07-31 00:13 · Score: 1

Don't give up on firefox, one proof of concept that will probably be fixed in the near future, in the mean-time if your ultra-paranoid before puting confidential information into your browser just check your bookmarks are still there :)
Re:Konqueror by noktuo · 2004-07-31 00:33 · Score: 1

I don't think this bug is reason enough to change your browser. Firefox is a very good software. But if you fell insecure, you can try Galeon.

don't allow pop-ups without menu/location/etc by orabidoo · 2004-07-30 23:17 · Score: 5, Insightful

in about:config, or in user.js:

user_pref("dom.disable_window_open_feature.locatio n", true);
user_pref("dom.disable_window_open_feature.menubar ", true);
user_pref("dom.disable_window_open_feature.minimiz able", true);
user_pref("dom.disable_window_open_feature.resizab le", true);
user_pref("dom.disable_window_open_feature.scrollb ars", true);
user_pref("dom.disable_window_open_feature.status" , true);

This makes all pop-ups have a full navigation bar, location bar, status bar, and forces them to be resizable and scrollable.

It may look uglier than plain-window pop-ups, but it does keep you in full control of your browser.

With these options set, the spoof pages look obviously like what they are: a fake browser within a real browser.

Re:don't allow pop-ups without menu/location/etc by argent · 2004-07-31 01:41 · Score: 2, Informative

You can put this right next to the section where you disable blinking text and other stupidities.

Really, there should be a single preferences option that turns all this off though. Of course when Netscape does their re-release of Mozilla *their* version won't have that option. :)
Re:don't allow pop-ups without menu/location/etc by Anonymous Coward · 2004-07-31 04:25 · Score: 0

A serious question: What is about:config or user.js? Are they files? Where do I find them under XP?

Please don't call me a stupid, idiotic user. I'm just ordinary.
Re:don't allow pop-ups without menu/location/etc by bobsledbob · 2004-07-31 04:52 · Score: 1

I'm probably feeding an ac troll, but...

In Firefox or Mozilla, you can type 'about:config' into the main url address location bar. This is a special feature of the browser to allow simple modification of browser preferences.

You can also create user.js file manually (it's a plain text file). You create it in the same directory as the 'prefs.js' file is in. Usually C:\Documents and Settings\[your user name]\Application Data\Mozilla\Firefox\Profiles\default.[random string]\

Just create a user.js file with notepad and add the poster's changes there. Then, restart your browser.

--
Beware of geeks bearing formulas.
Re:don't allow pop-ups without menu/location/etc by Anonymous Coward · 2004-07-31 05:09 · Score: 0

Bobsled,

I did not mean this to be a troll.

Thanks for the reply. It was very helpful. The about:config feature is especially cool. I never would have guessed it.
Re:don't allow pop-ups without menu/location/etc by HermanAB · 2004-07-31 06:37 · Score: 1

Where does one put this in Linux???

I found:

/home/username/firefox/firefox-installer/default s/pref/firefox.js

is that it?

--
Oh well, what the hell...
Re:don't allow pop-ups without menu/location/etc by bobsledbob · 2004-07-31 08:52 · Score: 1

It should be in your home directory under the .mozilla directory.

Here's a link: http://texturizer.net/firefox/edit.html

--
Beware of geeks bearing formulas.

Yes, it gives a richer user experience, but... by Hognoxious · 2004-07-30 23:19 · Score: 1

Mozilla and Mozilla Firefox don't restrict websites from including arbitrary, remote XUL (XML User Interface Language) files. [...]
The Mozilla user interface is built using XUL files.

Methinks that's the problem: no clear demarcation (both from a technical, and a user POV) between the browser itself and the page it's displaying. Not that it's the only browser that suffers from that, of course.

--
Confucius say, "Find worm in apple - bad. Find half a worm - worse."

The real question by Anonymous Coward · 2004-07-30 23:20 · Score: 0

is what else is marked "confidential" ?, i thought OSS was supposed to be "open", now when i read about bugs being hidden (like certain closed source companies) i have to seriously evaluate if we can trust having Mozilla on our machines anymore
if i wanted security by obscurity i would choose MSIE, makes you wonder what else is marked confidential ? backdoors ? worse exploits ?

Crashes Firefox 0.8 on OpenBSD 3.5 by HighOrbit · 2004-07-30 23:25 · Score: 1

I don't know if its good or bad, but the proof of concept crashes firefox 0.8 (under fluxbox) on OpenBSD 3.5.

One more reason to turn off JavaScript by default. by Anonymous Coward · 2004-07-30 23:34 · Score: 0

Or to use PrefBar, at least.

Here is the patch by Anonymous Coward · 2004-07-30 23:35 · Score: 0

right here

Re:Here is the patch by Anonymous Coward · 2004-07-30 23:44 · Score: 0

Opera is definitely looking better after this news.
My hope is that Konqueror can get ported to Windows. The Mozilla folks love to claim dominance in the Windows secure browsing arena. Maybe some khtml open source competition with Firesomething might get the devs to fix this bug.

remote content should only control "client area" by nothings · 2004-07-30 23:40 · Score: 4, Informative

Although there are other strategic fixes discussed in the bugzilla discussion, it seems to me the first point of order is to NOT allow disabling/hiding of the toolbars and status line. These are tools for the user; there's no reason for "untrusted" sites to be able to do this. There seems to be a strange mentality of trusting the remote site's opinion over that of the user, rather than "sandboxing" the remote site's control into a limited part of the browser (the "client area" aka the "content area").

Some site authors may say "but I really want to author a popup that doesn't have all that crap etc," but I don't see how it can be that important, especially given all the consequent badness. The only case I can see for this is that sometimes you do trust the content author--that there is a notion of Mozilla as a platform for application development. And, hey, ok, code reuse is good, but using Mozilla as a platform for a company-internal application is a totally different scenario; can't we recognize that as a different scenario and give it different rules instead of using one browser to rule them all?

Now, without being able to disable the location bar, you can't spoof the location bar trivially. You could put up a second one and hope people don't notice, and yeah, some people won't. Unfortunately, as pointed out on bugzilla, there's a case that this won't stop: you create an entire faux window, one that appears to be in front of the main one, but is actually just a part of it. So in the middle of your page you have a seeming popup window with a seeming location bar with a faux address. It wouldn't be draggable outside of the client area of the main window, but some people wouldn't notice it.

It's hard to see how to defend against that, although I am a wacky retro guy who thinks all of this DHTML stuff has given content creators way more power than they really need, and there would be nothing wrong with just pushing back on the standards until things weren't spoofable. (Remember when standards meant you wrote an RFC about something you had already implemented and figured out really worked; it didn't become a standard until people had exercised it in the field? Whatever happened to that?) Or maybe Ian Hickson is right and we're all just raving paranoic nutjobs. But it seems like exactly the sort of 'power before security' attitude that's gotten MS in a lot of trouble.

An entirely different way of looking at the problem of spoofing is that we transmit our secrets "in the clear" to the remote site. (Obviously encrypted by https or whatever.) If the remote site is spoofing, they get our password (and can maybe even open a connection to paypal or whatever and pass through everything so we don't know it's been spoofed). There's no need for us to give the secret to the remote site, though; just prove that we know it. For example, the server can give us some random data, and we use a non-reversible encryption algorithm to combine the random data and the password, and return the result of that. The server can verify that it's the right result without anyone transmitting the actual password (though the server must store the actual password, and not a hash of it). If this were the technology we were using, a spoofer wouldn't be able to use the password, unless the spoofer DID open a connection to the real site first, and get the challenge; then it could pass it through, but then the spoofer would have only this one chance to make use of the spoofed data, since the next time the real site challenged, the spoofer is stuck; whereas currently a spoofer just captures the user/password combo and keeps it around for later processing. This would raise the complexity bar for making effective use of spoofing (including email phishing!), although I don't know if it's high enough. But good luck getting it into browsers AND making it impossible for spoofers to create what looks like a login prompt of this kind but actually is just a plain old plaintext submit.

Very, Very OT: Your Sig. by Anonymous Coward · 2004-07-30 23:42 · Score: 1, Funny

"Making the moon less necessary since 1998"

Are you claiming to be so fat, that by sprinting around the equator, you can sustain tides and stabilise the Earth's attitude?

nope by calculadoru · 2004-07-31 00:04 · Score: 1

I'm using Firefox 0.9.2 and that proof of concept proved nothing for me, all I got was a big fat error and no spoofing. Oh well, that was exciting then.

--
The power of accurate observation is commonly called cynicism by those who have not got it. -- G.B. Shaw

Secunia, just a clipboard by Anonymous Coward · 2004-07-31 00:05 · Score: 0

"Reported in Mozilla Firefox by:
Jérôme ATHIAS (also created a PoC)

Reported in Mozilla by:
James Ross"

Secunia just steals credits on the news from the original authors. Will you people ever stop crediting compagnies which are only COPY PASTING WHAT HAPPENS ON BUGTRAQ and credit the REAL AUTHORS ??

It pisses me off.

I thought FireFox users are Geeks.... by kc_cyrus · 2004-07-31 00:08 · Score: 1

The Fake menubar is a lame attempt which only fools the average IE users. I am sure each of us has lots of extensions installed in our FireFox menubar. So what is the use of a fake menu bar with standard icons?

If I go visit a paypal site, in a new pop-up window, with standard icons which i certainly changed 3 years ago and the fact that the window is not tabbed along with the fact that non of the menubar submenus actually works, wouldn't i be like hey...wait a mniute!!! It's all wrong! This is not what is supposed to be!
So who they are fooling?
We all know for whom this trick works. The people, hearing about all FireFox buzz and fuzz recently, trying to use it and think about it in the wy they use IE for all of their short internet life.

Not only it doesn't work on MAC, but also it won't work for average FireFox users.
So it also will not stop me to use my FireFox! I just report it as a bug, that's all!

Re:I thought FireFox users are Geeks.... by GoldMace · 2004-07-31 03:19 · Score: 1

But do most users, even advanced users that read Slashdot, try clicking various menus while in the middle of browsing?

I don't even touch the menu bar most days.

It doesn't look quite right on my computer because I moved the toolbars around, and changed the icons to have text and icons(looks much better that way, even if it does take up more space), and that spoof only has icons, but if I was paying attention to the content of the page, I might not even notice.
Re:I thought FireFox users are Geeks.... by kc_cyrus · 2004-07-31 21:48 · Score: 1

And....above all..If you have a different theme than default grayfox, then the spoof is as clear as sun in the first second! ;-)

What's the fuss about? by bigHairyDog · 2004-07-31 00:19 · Score: 1

OK, so Firefox lets people use XUL to make a fake menu bar. You could do it in IE using a gif image.

From the Bugzilla page:

There's nothing to stop someone from creating a chromeless popup window containing a styled edit box on top of a GIF that looks like our chrome area, so this can be done without any XUL support, in any browser.

I recommend that we make this bug public. This is clearly not going to be fixed anytime soon and it probably affects other major browsers.

Remember it only affects the kind of person who clicks on Phishing emails anyway.

--

foo mane padme hum

Re:What's the fuss about? by numark · 2004-07-31 01:09 · Score: 1

How so? What's the stop the author of your favorite page (other than Slashdot ;), who happens to unwittingly be less than honest, secretly preloading the XUL on his/her page, and then including a link labeled "Donate to RandomSite using Paypal!" which, when clicked, actually uses a similar exploit? Phishing emails are easy to identify, but this exploit is far from limited to just those. I think the implication that you and others on Slashdot are superior to those "simple IE-using folk" who click on phishing emails is simply wrong. This exploit could affect any of us.

--
Want Slashdot headlines on your site? Try SlashHead

Mod parent +5, solves problem by RPoet · 2004-07-31 00:26 · Score: 1

Following those instructions, the problem will be marginalized -- every attempt at a spoof will look completely bogus.

I'd do the modding myself if I weren't banned from moderating :(

--
"Oppression and harassment is a small price to pay to live in the land of the free." -- Montgomery Burns.

Use shit.slashdot.org :) by Anonymous Coward · 2004-07-31 00:32 · Score: 5, Informative

Use link to get the pretty green colors back.

Re:Use shit.slashdot.org :) by Anonymous Coward · 2004-07-31 04:45 · Score: 1, Informative

Wow. fuck.slashdot.org works too
Re:Use shit.slashdot.org :) by Anonymous Coward · 2004-07-31 05:12 · Score: 0

You, sir, are looking like a good candidate for my friends list.
Re:Use shit.slashdot.org :) by ggambett · 2004-07-31 07:23 · Score: 0, Redundant

Nice. However, it's shit.slashdot.org which should use the shitty color scheme

--
My website
Re:Use shit.slashdot.org :) by Anonymous Coward · 2004-07-31 09:26 · Score: 0

why does that work
Re:Use shit.slashdot.org :) by roosterx · 2004-07-31 14:04 · Score: 1

*.slahdot.org works. it's just re-directing.
Re:Use shit.slashdot.org :) by ColMustard · 2004-07-31 14:54 · Score: 3, Informative

Because it is the subdomain which determines the theme. There is no 'shit' section, so it reverts to the default theme. Try it with a real section: replace the 'it' subdomain with 'apple' and you'll see the Apple section theme.

--
Moof.

IE can do it too. by Retep+Vosnul · 2004-07-31 00:33 · Score: 1

I build this intranet system that mimics an app. Starts from IE and produces a complete GUI Pulldowns, browser window and everything. ( works in mozilla /NS / opera and safari too ) With a little effort one could make that look just like IE, No problems at all. I Think this is an issue for all modern browsers and what kinds of functionality are set on by default.

--
-- forget /. It's gone.

Re:IE can do it too. by argent · 2004-07-31 00:52 · Score: 1

Yeh, I run into this kind of thing all the time on the web, usually being used for advertising or just because the website designer is nuts about controlling the user experience.

It shouldn't be possible. There is not sufficient reason why a website should even be able to override my window options, let alone remove the toolbars and status bars from a window... whether or not they can emulate them. There's lots of mediocre and superficially convincing reasons, but none that are good enough to make it worth the annoyance that it causes, let alone the dangers of spoofing.

Um. Yes, this *IS* an exploit, albeit not new. by philovivero · 2004-07-31 00:33 · Score: 1

Reading the bug debate is rather annoying. You've got the sensible "Either fix this or make it public so someone else can" guys, and then the "No, we must come up with a perfectly-engineered 100% solution or just hide the bug forever" guys all kind of duking it out, and the "let's just hide it forever" guys finally win, because they're in charge.

And I love the "nothing to worry about here" posers like the 5-rated comment (who moderated that up to 5?) that says this is like a screenshot of a toolbar at the top of your window.

Uh, excuse me? It can turn off the existing chrome and the replacement chrome has functional menu items, toolbars, and everything. This is not a screenshot. This is actual "fool hardcore UI experts" territory. This bug should have been public years ago. The type of "Nothing to be alarmed about, let's just keep it secret" attitude displayed in the bug comments really should be reserved for Microsoft. We at least expect it of them.

--
fifth sigma, inc.

Re:Um. Yes, this *IS* an exploit, albeit not new. by Anonymous Coward · 2004-07-31 01:55 · Score: 0

Reading that bugzilla page is pretty scary. What else is hiding in there? Its obviously not as bad as all the many bugs in IE popping up all the time, but its just insane that people think there is no problem with this spoof.

Isn't Firefox trying to be a browser for the average user? Is the average user going to have a different skin or tabs or anything but the default settings? No, making it a really successful spoof.

Even if you have an above average user who knows to look at the URL bar and check the lock icon they could still easily fall for this. Just send out some some official looking email from PayPal with your normal @ spoofed link and start collecting logins. All you have to do is get the user past that original @ spoofed link and you got them.

There is no good solution to website spoofs like this, but this allows too good of a "working" copy of the UI. I suspect it could be even worse and "read" your preferences by some poking around what UI elements are available to javascript.

This bug should have been fixed years ago. A website has no reason to access XUL.
Re:Um. Yes, this *IS* an exploit, albeit not new. by jesser · 2004-07-31 08:17 · Score: 1

Reading that bugzilla page is pretty scary. What else is hiding in there?

Bug 22183 was by far the oldest security-confidential bug. The next oldest is bug 149895, which is not a security hole but a reminder to review a specific feature for security holes.

There are 80 NEW, ASSIGNED, or REOPENED bugs marked as security-confidential. I'm the reporter of 6 of them.

--
The shareholder is always right.

Faking Out Users Is A Feature? by reallocate · 2004-07-31 00:35 · Score: 1

You think faking out users is a feature? Great.

Of course, this is a vulnerability. So what if Windows has the same problem? You want me to smile and be happy about open source after sending my money to a thief? Some consolation.

--
-- Slashdot: When Public Access TV Says "No"

Re:Faking Out Users Is A Feature? by Anonymous Coward · 2004-07-31 03:46 · Score: 0

I'm not sure if I'd call this a vulnerability.. It's sort of like saying that MSPaint has a vulnerability where I can place a screenshot of the desktop as a background image and then move all the real icons off. That will fake out the user for a few seconds, but there's nothing really "wrong" with the apps, per se.
Re:Faking Out Users Is A Feature? by Karl+Cocknozzle · 2004-07-31 06:05 · Score: 1

Of course, this is a vulnerability. So what if Windows has the same problem? You want me to smile and be happy about open source after sending my money to a thief? Some consolation.

1) Windows and IE do have the same problem, as a couple dozen people have pointed out.

2) "Human-nature" to steal is not the OSS communities fault, (nor MS', really, if we want to be fair. But this is Slashdot, why be fair?)

3) It is true that there are probably a dozen simple ways to fix this, but the problem is that fixing this specific exploit does not solve the problem of a malicious person being able to visually recreate trusted ecommerce vendors' web-sites inside a phony browser window. Dozens of other posters have suggested other implementations of the same idea, so fixing this one doesn't really prevent anything. If you were a volunteer coder, would you invest your free time fixing an exploit that has 1,000 vectors for use?

4) I don't know if I believe that this exploit even really works or not since the "proof-of-concept" code didn't work for me, or a ton of other Firefox users. Maybe because I took the time to configure my browser to my (paranoid) liking.

5) If it pisses you off that much, download the source tree and submit a fix. If you do a good enough job Bill Gates will steal your idea and put it in IE, and that will make everbody more secure, right?

--
Who did what now?
Re:Faking Out Users Is A Feature? by Anonymous Coward · 2004-07-31 06:24 · Score: 0

Umm, no, because you can't change someone's desktop remotely (without authenticating in some way).
Re:Faking Out Users Is A Feature? by reallocate · 2004-07-31 06:45 · Score: 1

>>..."fixing this specific exploit does not solve the problem of a malicious person being able to visually recreate trusted ecommerce vendors' web-sites inside a phony browser window".

No, but if the Mozilla and Fireforx developers can prevent it, they ought to. The existence of malicious people doesn't justify exercising due diligence.

>>"4) I don't know if I believe that this exploit even really works..."

Well, I can attest it doesn't work in Firefox 0.8."

>> If it pisses you off that much, download the source tree and submit a fix."

Doesn't particularly piss me off. But I'm a user, not a developer. But, hey, I forget, open source is closed to users.

--
-- Slashdot: When Public Access TV Says "No"

Expect this to get more prevalent by gedhrel · 2004-07-31 00:37 · Score: 4, Insightful

It's a serious problem. XAML, XUL and even SVG are positioning themselves as web-delivered application delivery platforms. The idea is to provide a mechanism for web-delivered apps to NOT look like they're running in a browser; instead, permitting more integration with the desktop.

This kind of spoofing is going to become more problematic, not less.

Re:Expect this to get more prevalent by argent · 2004-07-31 00:58 · Score: 1

It's old news, it will get more prevalent, and the real fix is to not allow any kind of GUI override from the webpage unless the end-user explicitly approves it each time.

Pop-up window blocking is the first line of defense, of course, but the user should be able to enable popups without turning on all GUI overrides.

Here is a simple way to combat this "bug". by t7 · 2004-07-31 00:40 · Score: 1

I first thought changing themes would be sufficient to trick the "trickster", but I soon found out it called the current theme's images.

Spoof Stick is a plugin which allows you to see the real address of the website you are currently viewing.

All in all that spoof is very impressive from a web developers standpoint.

Re:remote content should only control "client area by mcsmurf · 2004-07-31 00:42 · Score: 1

The point is: Webapps, as you already mentioned. But how should Mozilla (or FF) know it is loading a file from a server in a WAN or from a server in a LAN. The only solution would be then that Mozilla/FF asks if this site should be granted access to chrome (disabling urlbar, statusbar, etc.). Can be very annoying, if it would be only for XUL, maybe acceptable. But then for sure someone would come up with "Security Bug: Loading many XUL sites can DoS Mozilla" :-). So you can do it as you want, in some way it's always "insecure".

Should I switch from mozilla to firefox? by hal9k · 2004-07-31 00:43 · Score: 1

I've been using mozilla since 1.3.1 and have been extremely happy with the updates to the browser. I've looked at what firefox offers, and to me it seems just like mozilla without mail+ composer built in. Is that it, or is there something more firefox offers?

Spoof doesn't work for me by nwbvt · 2004-07-31 00:45 · Score: 1

First of all, I'm seeing a different theme in the new browser. Second the layout is different (I have the address bar up by menubar), I don't see the padlock, and there are various other differences in the interface. Is this because this is a crappy proof of concept or is this bug just unable to correctly mimic customized features of the browser?

--
Mathematics is made of 50 percent formulas, 50 percent proofs, and 50 percent imagination.

It's not just a bug, it's a bad user interface! by argent · 2004-07-31 00:45 · Score: 4, Insightful

The ability for web pages to override *any* part of the standard user interface, even if they can't then replace the UI with their own imitation, is something that I've been pissed off about for years. If you want to build an application development platfrom that can do anything, make it a separate program... leave me in control of the user interface of my own software.

There shouldn't be a mechanism in the HTML/script/etc to do things like pop-ups, pop-behinds, moving windows, windows without toolbars and status bars... there should be an unbreakable firewall at the edge of the document portion of the browser.

Well the obvious thing... by Anonymous Coward · 2004-07-31 00:46 · Score: 0

to do is do like java with its "JAVA APPLET WINDOW" in big letters at the top of every java popup - make it it clear that the window might be spoofed if any downloaded XUL is used:

"Untrusted XUL Window" at the top should dissuade most sane people from believing it's a certificate window.

Not smart by Anonymous Coward · 2004-07-31 00:47 · Score: 0

What happens when I put a hacked telnet server on port 80 and spoof your command line interface?

shouldn't that be by Tracer_Bullet82 · 2004-07-31 00:55 · Score: 1

ssh

--

Timang tinggi tinggi
parang sudah asah
alang alang mandi
biar sampai basah

Not bad at all by VStrider · 2004-07-31 00:59 · Score: 1

XUL is UI made easy. Someone can spoof an interface, so for that reason alone we should scrap this technology?? Disabling the browser from running XUL?? That's disabling web services. Warning the user?? XUL in itself is not dangerous. It just renders UI. Maybe a better solution would be to prevent websites from reading/using user prefs/skins. and btw, what do you people think XAML (MS-XUL) is all about? a browser based on XUL can be spoofed? Wait for longhorn...a whole operating system based on XAML ;-)

--
VStrider.

What bugs me more by eraserewind · 2004-07-31 01:00 · Score: 0, Flamebait

Is that I had disabled javascript from doing "everything" to windows in the javascript preferences, but lo and behold I find (from reading here) that it seems I need to also set a dozen crypric about:config preferences. That is really lousy security, and completely misleading.

All the people saying "well, IE is just as bad" completely miss the point. IE is recommended to not use by CERT, and the department of homeland security. You got really low standards if you think being no worse than that is some kind of mitigating factor.

The "trusted" part of the Browser UI should be unchangable by the remote site, period.

Parent Informative by gumpish · 2004-07-31 01:05 · Score: 1

Oh man, I wish I had some mod points...

Is there anyway to always have links referencing "it" changed to "shit"? I don't see any user preference...

Re:remote content should only control "client area by oxygene2k2 · 2004-07-31 01:06 · Score: 1

how about: only allow sites to tweak certain UI features when they're in a list inside the browser.

unknown XUL is displayed with full chrome and an additional toolbar "disable browser UI for this site", if the XUL site gives a base URL (that matches)
the mechanism when you click could be the same as with XPIs, wait two secs, confirm - then the site is trusted, its base url ends up in the preferences and everything is good.

Really? by airjrdn · 2004-07-31 01:06 · Score: 1

Of course, that won't stop me from using Firefox.

I find myself wondering if you would continue using it if it were found to be as "holey" as IE.

--

My Tech Posts on Twitter

Uselss Spoof by elbondo · 2004-07-31 01:15 · Score: 1

The spoof does not show my tab bar, or my link bar, or the proper icons. I don' think it will fool you. Until someone writes a spoof that imports my exact settings, then displays a website with those, I'm not too worried.

Re:Uselss Spoof by argent · 2004-07-31 01:23 · Score: 2, Informative

I do support for about 150 users, most of whom are programmers. I'm starting to have to clean spyware out of three or four computers a week, and a couple of times I've seen "spoofs" that looked like they were trying to trick people into allowing the bogus code to run, and none of them look like exactly like "real" IE or other application windows to my eye.

Yet, based on their track record, they do the job.

So an exploit that does a better job than that, well, it's a problem. The problem should be blocked at the source... starting with removing the ability to change the browser window decorations even if you DO still allow popups.

Re:remote content should only control "client area by argent · 2004-07-31 01:15 · Score: 1

100% Agreement!

There is and will continue to be a tension between the content creators and the users.

The user doesn't much care about the last couple of percent closer to their vision that the content creators get from being able to control things outside the document area of the browser. They may find this or that trick makes things a little nicer, but it's not something they'd really miss if the websit author couldn't do those tricks.

The user does care about the things that malicious websites do with the same capabilities: popups, pop-behinds, bouncing windows, adware, and so on. Ask the user if they'd mind losing that last few percent if they could get rid of the crud for good, the majority would say yes.

...

I'm reminded of an ad that Adobe ran back in the '90s in a print magazine advertising Acrobat and promoting the PDF format. They had side-by-side pictures of an HTML page where some user had increased the font size so all the stuff the author had lined up looked strange, across from a PDF with the same content and all the text looking right purty.

What I saw, as a user, was a webpage I could read and a PDF that I had to bring right up to my eyes to make out... and my eyes were a lot better then they are now. Oh, yes, you can zoom in on the PDF when it's on the screen but then you spend all your time scrolling around as you read... it's technically a solution to the problem but just making the font bigger than the author intended and to heck with his layout and page breaks is a BETTER one.

This ad illustrated the conflict between the author and the reader perfectly. For a web browser, where the author may actually be malicious, the reader should always win.

+/- responses by Anonymous Coward · 2004-07-31 01:23 · Score: 0

If the news here is about IE, the percentage ratio of negative and positive responses here would've been reversed, wouldn't it ?

Mod this fucking troll down by Anonymous Coward · 2004-07-31 01:24 · Score: 0

This is not insightful, it's an outright lie.

"This is basically a screenshot of a toolbar at the top of the browser."

Bullshit. It's an XUL spoof of the toolbar, complete with WORKING DROPDOWNS and everything else. The whole thing works and can be programmed to do whatever the hacker wants, not limited to rewriting the location bar.

Again, NOT A SCREENSHOT. This dipshit didn't even try out the proof-of-concept...

Re:Mod this fucking troll down by Anonymous Coward · 2004-07-31 08:30 · Score: 0

Are you always such a fucking asshole?

People like you on the internet is a far scarier issue than stupid shit like this browser "bug".

This is actually an IE bug!! by flibberdi · 2004-07-31 01:31 · Score: 1

In Firefox you right click on the button (We assume the "right" way to do the exploit is to link the javacode to a buybutton") in question, e.g (I found this buy button on the internet) on the bottom of this page there is a "buy" button, and the properties shows you what it is linked to (https://www.paypal.com......). On the other hand, do the same in IE and you get ??? As I said this is an IE -bug (hehe nice eh?).

Re:remote content should only control "client area by argent · 2004-07-31 01:34 · Score: 1

But how should Mozilla (or FF) know it is loading a file from a server in a WAN or from a server in a LAN.

The public browser that's downloaded from mozilla.org shouldn't have these capabilities at all.

If you want to enable this kind of thing on your intranet, then your company's base install should include a copy of Firefox, Internet Explorer, and so on that's modified to allow it for your own websites. Users who want to use another browser should get a page that says "the fnord incorporated intranet site requires the standard fnordco browser. Download it from the fnordco home page or call the fnordco helpdesk."

What version of Mozilla on Windows do I have? by Anonymous Coward · 2004-07-31 01:36 · Score: 0

ok, I know this question sounds stupid, but...

I've installed and run Suse 7.4 (I think), Suse 8.0, Suse 8.1, Suse 8.2, Red Hat (the one with the submarine pre-release name), Slackware (don't remember the release numbers, 4.0, 7.x I think), Debian stable, Debian testing, Debian unstable, Knoppix, Mandrake 8.0, and Bonzai, and I can't figure out which Mozilla version I have on Windows 98 right now.

I went to the help -> about Mozilla, and all it does is go to a Mozilla page that says Mozilla on it. I click on that, and it goes to another page that says Mozilla 1.7

So do I have Mozilla 1.7 installed? Or is it taking me to the page of the latest release, Mozilla 1.7?

After checking a few more pages, it looks like there is a 1.7.1 release. From the above, it looks like I don't have 1.7.1, so what are the steps to upgrade? Download and reinstall a .x release, like when I upgraded from 1.6 (iirc) to 1.7?

No, I don't have the previous download file to check the version number. I normally download the file and keep it in a folder that shows the version number, but thanks to the greatness of Windows, I've had to reinstall, and lost that folder in the reinstall. I've checked all the other Mozilla pull down screens in the menu to get a version number, but I don't see anything.

OK, I've found the path to the executable, and the folder show dates of June 16 on some files and July 8 on some sub-folders (chrome, etc.), so I'm assuming that's what I have.

how would I be able to tell what version I'm running without checking release dates as compared to what appears to be my downloaded or installed files date?

wouldn't it be better to show the version number immediately in the first window of about -> Mozilla?

what's the upgrade procedure (I'll be looking on the site now), shouldn't this be listed on the same page that shows the version number, how to upgrade at a minimum to a bug fix release (1.7.x)? Or just a link to minor upgrade instructions?

Reason I'm asking about the minor upgrade info is that I saw an article on a comparison (perhaps on Newsforge) between the difference on the Windows IE vulnerability, and the minor vulnerability that existed in Mozilla that was fixed hours later, where the journalist said he simply clicked on a link, and was patched/protected against the vulnerability. Is it this simple to upgrade a bug fix or security fix, normally a 1.7.x release, instead of a download and install (re-install?) of the entire .exe and all related files and folders?

Reason I listed the questions the way I did is so that hopefully the Mozilla developers see the confusion I'm having, and may decide to make a change to the about Mozilla page, or how the version shows up when that option is chosen in the pull down menus.

And a big thanks to the Mozilla developers! Feature request, if it hasn't been implemented already, enable right clicking on a link, and opening in background a tab, instead of opening and going to the new tab immediately, like I can do with Konqueror by middle clicking. Unless I missed how to do this somehow already.

Re:What version of Mozilla on Windows do I have? by mcsmurf · 2004-07-31 04:46 · Score: 1

Do you have JavaScript enabled? The about page doesn't work without it (or only displays Mozilla is you have it). Unfortunatelly there are various reasons why the about: page depends on JavaScript enabled :/

Make that 5 years and two days. by NeoBeans · 2004-07-31 01:40 · Score: 1

The only point of concern in this whole matter is... why has this bug been lurking for five years?

I have every confidence the Mozilla team will address it, but this doesn't make open source appear any better than closed source (re: Microsoft's timetable for fixing IE flaws).

Re:Make that 5 years and two days. by TheLink · 2004-07-31 07:11 · Score: 1

Open source isn't necessarily better than closed source, especially when it comes to security problems. PHPNuke Sendmail, BIND, [insert other poor track record OSS here] have been open source for years.

It's a matter of who is writing the programs (and often _why_), not whether it's open source or closed source.

Many eyes do NOT find security bugs. It takes _experienced/skilled_ eyes to find them.

The fallacy of saying many eyes make bugs shallow is like saying a billion monkeys will write Shakespeare (the works not the name). There aren't enough monkeys, so you need quality and not quantity for such things.

The average joe doesn't even _see_ the error message that flashes in front of him before he clicks OK/Cancel to dismiss it. Many even deny clicking OK or Cancel too. Billions of average joe eyes are useless for finding security bugs. They're useful for finding UI usage bugs (doh).
--
- Too many replies beneath your current threshold

Firefox 0.8 by Zaffle · 2004-07-31 01:46 · Score: 1

I'm using Firefox 0.8 and the vuln doesn't work for me (I'm strangely sad about this).
Instead, it simply takes down my X session by making X consume all its ram.

This could be another bug in X though. Since when I load lots of images in firefox, after awhile, X consumes all available ram.

In the case of the vuln however, X rapidly starts consuming ram, but when I -9 firefox, it stops and returns back to normal.

--

I use to have a funny sig, but slash cut it off, and I forgot what the punchline was.

re: "so am I really seeing slashdot?" by nusratt · 2004-07-31 01:47 · Score: 1

"so am I really seeing slashdot, or is someone trying to spoof me, while at the same time ironically warning me about said Firefox spoofs?"

the slashdot which removes uncertainty is not The True Slashdot.

This. by Raven42rac · 2004-07-31 01:47 · Score: 1

This won't stop me from using Safari.

--
I hate sigs.

Signed Xul or trusted XUL sites by tweek · 2004-07-31 01:49 · Score: 2, Insightful

I'm wondering why the moz team doesn't just implement signed XUL. We love using XUL for our internal applications at our company but somehow having to sign it wouldn't be a problem.

I realize we now have dialogs that warn us about everything AND that most people just click through but having trusted XUL sites or signing it somehow would be just fine by me.

What really annoys me is that:
A) The bug was marked confidential for 5 freaking years!
B) The people saying that it isn't a big deal.

It IS a big deal or else the damn thing wouldn't have been marked confidential for 5 years. Sure it doesn't allow you to overwrite system files but I can recover from a virus. It's harder to recover from having a bank account wiped out because you used and unprotected debit card on a spoofed website ( forgetting that anyone who uses a debit card instead of a real credit card online is just asking to be screwed ).

Really the best route for this is to disallow remote XUL execution by default with an option to enable it in the prefs with a list of trusted XUL sites.

--
"Fighting the underpants gnomes since 1998!" "Bruce Schneier knows the state of schroedinger's cat"

Gmail invite please by Tinidril · 2004-07-31 01:52 · Score: 1

Two penguins walked into a bar. The third one ducked.

-----------------------
Whats black and white and red all over? Tux after smashing that anoying butterfly.

-----------------------
Tux had to take his car for engine repair. The mechanic told him to leave his car with him for about two hours to find out whats wrong.

So Tux went across the street to a grocery store and climbed into a freezer to eat vanilla ice cream. When the two hours was up the he went back to the garage to find out what happened to his car.

When the he entered the garage, the mechanic looked at him and said, "Looks like you blew a seal."

Tux replied, "NO way, thats vanilla ice-cream!"

nospam (at) biped.us

--
XML is the best data format; unless your data needs to be read or written by a human or a computer.

Feh by Anonymous Coward · 2004-07-31 01:54 · Score: 0

Give me a permission to use (copyrighted) IE icons, and I'll do the same thing for IE in a day, using only DHTML and JavaScript. Same for Opera.

The 'Confidential' question and feature/bug by mawhin · 2004-07-31 01:55 · Score: 1

For ***** sake.

If Mozilla was a shell script for me and my buddies, then you can go jump. My stuff, I'll do what I like.

If Mozilla were some weirdo l33t browser for the seriously hardcore, it's a feature, caveat emptor.

But aren't we trying to get the world to switch to Mozilla? Yep. Does the world have the first clue about anything? Nope. So it's a bug. If it helps my mum get scammed cos she's not got the first clue and just clicks stuff, it's a bug.

At the very least, the hardcore should have to go find the option to hide decorations.

So far as bugs marked 'confidential'. For shame guys. For shame.

Mart

--
Why are you looking at me like that?

what? by Ender+Ryan · 2004-07-31 02:11 · Score: 4, Insightful

Seriously, people have been doing this sort of thing for years, with every browser. This one happens to be a bit more ambitious than most, but I've seen the same thing done with IE in the past.

I've never heard anyone say it was MS's fault that people can make a convincing fake browser interface to fool people. Hell, all of slashdot has discussed this type of thing before, with the old ads some companies made to look like popup dialog boxes. Those fooled a lot of people, but I've never heard anyone say it was MS's fault.

But there's a very simple solution, and I can explain it in one sentence.

Never let anything, popup windows, javascript, etc., hide any part of the browser interface.

That's it. 100% solution to the "fake browser interface" problem. In fact, Firefox already has that partly covered, "Allow scripts to: [*] Hide the status bar" => "Allow scripts to: [ ] Hide the status bar". That setting should default to unchecked, and it shouldn't be user-modifiable. On my system, I immediately saw a double status-bar. But that's not enough, the menu bar and browser controls shouldn't be hidable either.

--
Sticking feathers up your butt does not make you a chicken - Tyler Durden

Re:what? by Fuzzle · 2004-07-31 02:42 · Score: 1

I'd wager to say that I've seen MS be bashed for this many a times. They get no quarter, especially when it comes to IE and it's vunerabilities. Many of which they simply couldn't anticipate (pop up ads mimicking explorer anyone?). Moz deserves a similar treatment this time around.
Re:what? by It'sYerMam · 2004-07-31 04:17 · Score: 1

My menu bar, etc weren't hidden. It opened in a new tab, as did the popup about VeriSign. For me, it was a dead giveaway.
I have a script that causes all instances to open in a new tab, though. Even those with odd _target=s.

--
im in ur .sig, writin ur memes.
Re:what? by irokitt · 2004-07-31 04:40 · Score: 2, Informative

In Firefos, that would be Tools->Options->Web Features, and under the Javascript box use the Advanced tab.

--
If my answers frighten you, stop asking scary questions.
Re:what? by bob65 · 2004-07-31 06:24 · Score: 2, Insightful

Never let anything, popup windows, javascript, etc., hide any part of the browser interface.
Exactly...I don't know why javascript even allows popup windows, or altering the browser interface. The browser should contain a save, self-contained viewport on the world wide web. Anything that a webpage does should *only* occur within the viewport.
Re:what? by TheLink · 2004-07-31 06:59 · Score: 2, Interesting

Heck, my excolleague has done similar things years ago too.

He played a prank on another colleague that involved making the desktop background a centered image of a windows error message - one of those serious looking "illegal exception" things if I recall correctly.

Naturally when the victim clicks on the OK or Cancel it doesn't work. Then the victim actually got rather worried...

My colleague got pretty worried when I installed the bluescreen screen saver on his PC as an april fool's joke.

I dunno about you but I sometimes find myself clicking the OK/Cancel buttons on example images on some websites. This even tho I set my personal colour scheme different from the normal windows standard (to intentionally help combat this problem).
--
- Too many replies beneath your current threshold
Re:what? by dedazo · 2004-07-31 09:15 · Score: 1

I've never heard anyone say it was MS's fault that people can make a convincing fake browser interface to fool people. Hell, all of slashdot has discussed this type of thing before, with the old ads some companies made to look like popup dialog boxes. Those fooled a lot of people, but I've never heard anyone say it was MS's fault.
That's ridiculous, it happens every single time. Every virus that requires user intervention is Microsoft's fault; every piece of malware on a user's machine is Microsoft's fault.
I don't care much for defending them, but if it quacks like a duck then let's stop pretending our poultry is magically superior and call it a chicken just so we can feel smug.
Mark my words - we are going to be seeing many more of these as time goes by. I knew this would eventually happen; it had to. There's nothing wrong with having bugs. Mozilla is a complex piece of software. What pisses me off is the whole "this is a confidential bug" thing. The Mozilla folks have done a fantastic job but this detracts enourmously from their good image.

--
Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo
Re:what? by tombeard · 2004-07-31 12:01 · Score: 1

Nothing new here. Back in the Win3,11 days a favorite prank was to save a screenshot of the desktop as the wallpaper and hide all the icons under one nobody ever used, Hours of fun.

--
The reason we subjugate ourselves to law is to better procure justice. If law does not accomplish this purpose then it m
Re:what? by Anonymous Coward · 2004-07-31 15:10 · Score: 0

Heh.
I sometimes take screenshots and then annote the image using a paint program.
If the image has an OK button, I will sometimes try to click it when I'm through,
Re:what? by Anonymous Coward · 2004-07-31 15:12 · Score: 0

"Every virus that requires user intervention is Microsoft's fault; every piece of malware on a user's machine is Microsoft's fault."

That's true, even when running Mozilla on Linux.
Re:what? by geordie_loz · 2004-08-01 21:32 · Score: 1

This has been an issue in Explorer for years, just about every page i visit tries to convince me I'm using IE with it's adverts.. Obviously I'm not fooled because I'm running Firefox on Linux, so why would there be an XP application running??

This is pretty much the same thing, except that the gui is not gifs and JavaScript..

Sure some XUL securing could probably be done, but by no means has anyone bashed MS becuase of this, it's a spam tactic.. been around since win95 days.. maybe before that even..

2 status bars by Anonymous Coward · 2004-07-31 02:15 · Score: 0

It was pretty good, but I see 2 status bars which gives it away.

I've already seen similar spoofing used to phish by Anonymous Coward · 2004-07-31 02:17 · Score: 0

It's more than proof of concept already, to spoof a dial up accounts error message and log in dialogs.

I'm using a dial-up account, which can easily be traced by the IP numbers, and I have seen a pop-under that replicated the password prompt this client has for switching screenames, while creating a situation that makes it seem a connection is lost.

Here is the social engineering behind the phish, and why it nearly worked. On an older OS, I had probably fifty windows open, using a non-tabbing browser from Redmond. I hit a site that hangs my connection waiting for content to fill the page to the point where I cannot navigate further, so I start closing windows, thinking I have hit a memory wall. By the time I have closed all the browser windows, I find a dialog, that appears to suggest what I suspect already, that I have lost my dial up connection. But, rather than just saying that, it asks me to log on again, with password. In this particular situation, and my attention diverted, I almost fell for it, and who ever wrote that pop-up could have phished my log in info for that account and all it leads to, financial information, etcetera.

If I had quit MSIE altogether rather than rather than trying to free up memory, I would not have seen the dialog, but I did, and it almost worked, because of the situation.

Or do them better. by khasim · 2004-07-31 02:19 · Score: 1

Popups - This is Mozilla/Firefox!!! They should open another tab! That is, if they are enabled at all.

Popunders - see popups.

Moving windows - If you can't do it in a tab, it don't get done.

Windows without tool/status bars - NOTHING should be able to touch my toolbar. EVERYTHING a website shows should be in the content part of the tab.

You are completely correct about the demarcation between the browser and the document.

Is there any reason to not have that demarcation?

Gmail account, pretty please? by Martin+Wolf · 2004-07-31 02:20 · Score: 1

What is black and white, black and white, black and white?

Tux the penguin, rolling down a hill.

What is black and white and laughing?

The penguin that pushed him.

Re:Gmail account, pretty please? by Martin+Wolf · 2004-07-31 02:25 · Score: 1

Oh, and please send the invite to mwolf@xs4all.nl. Thanks!

bad reasoning by Ender+Ryan · 2004-07-31 02:22 · Score: 1

I'm not a zealot and i'm going to be sticking with Firefox, as I don't believe i'm at risk of this particular exploit

I'm a huge fan of OSS. That said, I must point out that that sort of reasoning is stupid. When Microsoft simply says, "Only browse sites you know are safe," (which someone at MS said once... ridiculous! I will not tolerate that from anyone, OSS or otherwise!) OSS supporters get up in arms. And for good reason! The web should be safe. Networking in general should be safe. Nothing you don't want to allow to get in should ever get in.

BTW, I explained a very simple solution to these sort of browser interface spoofing problems somewhere above, for all browsers.

I'd also like to point out, as I'm using Galeon, I'm not vulnerable to these problems ;p Haha, so I am invincible... INVINCIBLE!! Hehe, j/k :)

Cheers!

--
Sticking feathers up your butt does not make you a chicken - Tyler Durden

Re:bad reasoning by Threni · 2004-07-31 03:39 · Score: 1

I'm a huge fan of OSS. That said, I must point out that that sort of reasoning is stupid. When Microsoft simply says, "Only browse sites you know are safe," (which someone at MS said once... ridiculous! I will not tolerate that from anyone, OSS or otherwise!) OSS supporters get up in arms

I don't care what other people say. My arms stayed exactly where they were when I heard about the IE exploit. Only browsing sites you know are safe is perfectly sound advice. If some people have taken it upon themselves to do banking (etc) over the net without checking they're on a safe site (that is, the correct site) then it's their problem. Enough of todays society is geared towards making life painless for morons. But I don't agree with that. Stupidity is supposed to be painful.

> BTW, I explained a very simple solution to these sort of browser interface
> spoofing problems somewhere above, for all browsers.

So did I. Just keep a bookmark list or local homepage, and use that to link to security-critical sites.
Re:bad reasoning by Ender+Ryan · 2004-08-01 02:18 · Score: 1

Are you daft, man? The point of this article is that it is possible for sites to make it (nearly) impossible to tell what site you're really on; user stupidity has fuck all to do with it. How the hell are you supposed to use the web like that? I guess you don't ever google or anything, otherwise you might end up on an untrustworthy site.
The simple solution(to this particular problem) is to not allow sites to hide any browser component, which would make it impossible to spoof a browser interface in the browser.

--
Sticking feathers up your butt does not make you a chicken - Tyler Durden
Re:bad reasoning by Threni · 2004-08-01 08:42 · Score: 1

> Are you daft, man? The point of this article is that it is possible for sites
> to make it (nearly) impossible to tell what site you're really on; user
> stupidity has fuck all to do with it. How the hell are you supposed to use the
> web like that? I guess you don't ever google or anything, otherwise you might
> end up on an untrustworthy site.

I think you'd have to be stupid to use Google to give you the address of a site you'd subsequently give your bank account details, yes. You think this isn't stupid behaviour? When you sign up to a service for which security is important, write down the address on a piece of paper and keep it near your PC, and check that you're entering it properly each time you log on. Or keep a local webpage on your harddisk. What's the problem with this?

> The simple solution(to this particular problem) is to not allow sites to hide
> any browser component, which would make it impossible to spoof a browser
> interface in the browser.

I don't know what you're talking about. What's a 'browser component'? Who does the 'not allow'ing?
Re:bad reasoning by Ender+Ryan · 2004-08-02 00:57 · Score: 1

Sorry to be harsh, but in your original post you indirectly made the claim that you are smarter than the stupid masses(who deserve what they get even... sheesh), which, judging from your comprehension of the security problem discussed in the article, was a very arrogant proclamation indeed. Elitist attitudes, such as yours, are always, always(!) the result of egotism.
Sorry, I may be overstating it a bit :)
Here's the thing... It is relatively easy to spoof a browser interface, as demonstrated in the article. So if you go to an untrusted site, while searching or whatever, it is possible to get a window that looks like your browser, but is actually a site that spoofs your browser interface.
Now, perhaps you're intelligent enough that you understand that can be done, and so everytime you go to a site you trust to, say, enter credit card info, bank account details, et cetera, you will close and restart your browser before doing so.
If, OTOH, you're just a person with above average intelligence, and not a brilliant person like you, you may just enter the address of the trusted site into your location bar, not aware that said location bar is actually a spoofed piece of the browser interface, which then intercepts the address and loads a fake, or altered-via-proxy, page that looks like the site you are intending to visit. As in the demonstration, this site will appear to have a secure certificate, which is simply another spoof. Congratulations, you are now giving your bank account info, social security number, credit card numbers, et cetera, to a theif. But that can only happen to "stupid" people, right? People who don't have their own little start page with links to trusted sites... *rolls eyes*
I don't know what you're talking about. What's a 'browser component'? Who does the 'not allow'ing?
I was referring to any component of the browser interface, eg. address bar, toolbar, bookmark bar, menubar, statusbar, et cetera. If none of these pieces of the interface are hidable, it would then be impossible to spoof them in a browser window.

--
Sticking feathers up your butt does not make you a chicken - Tyler Durden

Not perfect on OSX by skahshah · 2004-07-31 02:23 · Score: 1

The spoof is not perfect (but it would generally be effective) on OSX: I have the normal Mac menubar at the top of the screen, and a second one (without menus) at the top of the Firefox window.

XP SP2 does this by spideyct · 2004-07-31 02:26 · Score: 3, Interesting

Good suggestion.

Also, Internet Explorer with Windows XP SP2 will prevent websites from creating pop-up windows without a status bar, or with the status bar positioned off screen. Microsoft has recognized that the status bar should always be visible, I think the Mozilla/Firefox team should follow suit.

http://www.microsoft.com/technet/prodtechnol/win xp pro/maintain/sp2brows.mspx#XSLTsection137121120120

Why is this article specific to Mozilla? by jdkane · 2004-07-31 02:26 · Score: 3, Insightful

I don't understand why this cannot be done without XUL/Mozilla. E.g. Why can this spoof not happen through Mozilla & plain DHTML (no XUL), or in IE too? Without XUL I can also pop up a new window without any chrome and then create my own fake chrome elements through DHTML (including drop-down menus, status bar acorss bottometc etc)

What am I missing when I don't understand why this problem is specific to XUL in Mozilla?

Re:Why is this article specific to Mozilla? by jdkane · 2004-07-31 02:37 · Score: 1

Additionally, this post suggests a simple configuration file fix for Mozilla to solve the spoof problem
I doubt other non-Mozilla browser (i.e. IE -- don't know about Opera) would have a simple fix built in. (Makes you wonder why the Mozilla creators didn't think about turning on that config fix in the first place).
In Mozilla there should be groups of about:config preferences that you can switch between, one for lan scope, another for the public internet, etc. Then you could switch to less secure settings for your intranet projects and back to more secure settings for general surfing. Better yet give Mozilla the ability to automatically choose the best config settings based on the IP.
Re:Why is this article specific to Mozilla? by pr0c · 2004-07-31 03:33 · Score: 1

You are missing that it is open source and easily addressed. You are missing that we tell users that mozilla products take security very seriously and not to worry to much about it. You are missing that 90% of users never change their theme or even customize their firefox so they CAN NOT tell the difference between the spoof and real. You are missing that 90% of sites tell users... Look at the https in the address bar and click on the lock to view the security certificate. And no, without XUL no you can't do these things even remotely as well.

Bottom line, this is a security issue that should have been addressed a long time ago. Every single security hole no matter how remote should be immediately addressed. Half the argument to using open source is additional security...
Re:Why is this article specific to Mozilla? by ScrewMaster · 2004-07-31 04:04 · Score: 1

This relates to a recent Joel Spolsky article where he points out that that bugs should be fixed as they occur, not put on to some list for maintenance at some point in the distant future. In general, if you fix things while they're fresh in your mind you'll end up with better, more bug-free code than if you just crank it out and then try to fix everything later.

--
The higher the technology, the sharper that two-edged sword.
Re:Why is this article specific to Mozilla? by Anonymous Coward · 2004-07-31 04:52 · Score: 1, Insightful

It's just a lot harder to create a DHTML page that looks and acts like a native application. Every attempt i've seen at spoofing IE this way was unconvincing.

With XUL, you can use the EXACT SAME UI controls as the real application (no artistic talent required!).
Re:Why is this article specific to Mozilla? by HermanAB · 2004-07-31 07:16 · Score: 1

Exactly - this is Javascript issue. You can do something similar on any browser with Javascript windowing features wide open.

--
Oh well, what the hell...
Re:Why is this article specific to Mozilla? by jesser · 2004-07-31 07:58 · Score: 1

It doesn't matter whether you can create an effectively spoofed IE user interface. It's been done and it's been posted on the Web. All you have to do to use is change what's displayed in the "content area" of the spoofed interface.

--
The shareholder is always right.

Personally... by Azureflare · 2004-07-31 02:35 · Score: 1

I don't think the editors should have kept that bit in the submission. It's just a silly statement; do we really care what someone's preference for their browser is?

For me, I look at the track record of a browser. Mozilla has a pretty good track record. They're probably going to have a lot more vulnerabilities down the road, but I trust that their devs will do a good job in fixing the major ones. Note that I do not believe this bug to be "major" in any sense of the word; and BTW, it is not specific to mozilla.

Also, their browser is sweet. And it's (IMO) the best available on linux. So I use it.

I mean, I could use IE under wine... but what's the point?

should not be a big deal... by whitekolovrat · 2004-07-31 02:35 · Score: 0

...reload the page before filling any confidential data just for the hell of it... the spoofed one won't refresh

WM theme by paul-h-squared · 2004-07-31 02:41 · Score: 1

This is pretty off-topic, but does anybody here know the name of the window manager theme this guy Jeff uses in his screenshot? I really like the look of it.

Cool! by Fantastic+Lad · 2004-07-31 02:44 · Score: 1

This is a pretty obvious ploy, and it didn't even cross my mind until I saw it in action. Which, like any good magician's trick, makes it quite clever, (either that or merely demonstrates just how naive I can be.)

--Though, it can only really work if you're seriously snoozing while browsing; too many weird little quirks being off-kilter. (Pays to keep alert for those 'second cats' walking by!) --For instance. . . The first thing of several which went out the window immediately upon configuring my browser was that annoying, 'Google bar'. --My open source browser will not pay homage to a corporation which is selling IPO shares for over $100 each, and which has the power to destroy the world upon reaching step '2'. (That's what those question marks obscure in most cases, btw. --When everybody is dead, you get to keep all the money. Think about it! "Collect ten thousand computers and all the web addresses in existence," is hardly any less animated than, "Collect all the underpants.")

Funny thing is I just switched from Firebird, like two days ago, so as to play with the new toys. (Ted Mielczarek, who wrote, "Nuke Anything," emailed me about his latest update. Now you can wipe whole selections. Excel-lent!)

Anyway. . . I expect that when Firefox 1.0 finally arrives, this sort of silliness will be null and void. But until then, spoofed browser fronts are the sort of thing which makes being a computer geek fun and interesting!

--Until, that is, the five-hundredth attempt sneaks past your radar and makes your life hell; "Can I change all my passwords before the evil-hacker destroys me? Damn! He's almost certainly written a script which does it automatically! Argh! Shoot me now! Note to self; YOU ARE AN IDIOT. STOP. YOU ARE TOO STUPID TO LIVE. STOP. YOUR LEFT MOUSE BUTTON PRIVILAGES HAVE BEEN REVOKED FOREVER. FULL STOP."

-FL

Security starts at home. by Anonymous Coward · 2004-07-31 02:44 · Score: 0

You realize, if your family has keystroke loggers on their system and they ever email you or communicate about you online, someone will be collecting information about you. At one point enough information can be gathered to "socially engineer" you into giving some more information.
Viola. To quote all the kiddies out there, "pWn3d"

Just make it a white list like the pop-up block. by khasim · 2004-07-31 02:44 · Score: 1

It seems to work fine for blocking pop-ups.

YOU CANNOT DO THE SAME THING WITH IE!! by skidoo2 · 2004-07-31 02:47 · Score: 4, Interesting

At the risk of losing MASSIVE Karma points, I can't, in good conscience, fail to note that all of these claims that IE is vulnerable to this same type of spoofing are FALSE. You cannot create a fake browser window of ANY size or shape in IE with the same theme the user is employing for his or her desktop. This information is simply NOT available to IE's DHTML implementation. You can fool a retard with a borderless fake window, but you'll never guess my lime green ugly-ass color scheme is in place, and I **will** notice the rogue window.

This is why the Mozilla vulnerability is so serious. You could fool even very experienced users. Like sysadmins who log in as root. :-)

Re:YOU CANNOT DO THE SAME THING WITH IE!! by BabyDriver · 2004-07-31 05:27 · Score: 2, Informative

I don't know about buttons (specifically sizes and graphics) but you can certainly adopt a users colour scheme by using colour definitions such as:
ButtonFace - surface of 3d widgets GrayText - disabled text colour InfoBackground - tooltip background colour
I belive you can use these either with HTML or CSS. http://www.blooberry.com/indexdot/color/uiname.htm lists 28 different "names", I havn't checked them all but I don't see any obvious ommisions.
Re:YOU CANNOT DO THE SAME THING WITH IE!! by AnyoneEB · 2004-07-31 07:08 · Score: 1

How is this different from the FireFox vulnerability? You can target uncustomized versions of either much easier than customized versions. On my computer, the fake browser window looks awful because I've customized the tool bar (moved bookmarks next to menu bar and small icons) and I have the disable Javascript hiding stuff enabled (mentioned in multiple other messages). A toolbar picture in IE would look equally awful on any customized IE interface.

This is not the point. We are talking about normal users with default settings. This type of exploit will work on either browser for them. I agree with the other posters that (1) remote pages should not have XUL access (which may make this easier on FireFox, but not any less convincing), and (2) the disable javascript hide preferences should default to enabled so doing a similar attack with images would not work on FireFox.

--
Centralization breaks the internet.
Re:YOU CANNOT DO THE SAME THING WITH IE!! by angulion · 2004-07-31 09:18 · Score: 1

No offense, but you seem to miss a little bit of the point as well.. I agree that perhaps XUL should have to be accepted on a site-basis, *but* XUL was made so that you could make web-applications (that follow theme) and therefore a remote web-site needs to be able to execute XUL on the client machine, even without menubars.

MS is supposably bringing something much similar to XUL in Longhorn, XAML I think it was called (out of memory).
Re:YOU CANNOT DO THE SAME THING WITH IE!! by AnyoneEB · 2004-07-31 14:12 · Score: 1

Oh, ok, I didn't know remote sites were supposed to be able to access XUL.

Yes, I remember hearing about XAML.

--
Centralization breaks the internet.
Re:YOU CANNOT DO THE SAME THING WITH IE!! by Tzarius · 2004-07-31 19:10 · Score: 1

The Moz vulnerability is the same as IE - the page can present a fake render / picture, but can't tell what the actual browser is set to look like. So you're lime-green scheme would be quite effective.

The fix should be simply disabling Javascript's window-modifying permission defaults, and preventing XUL from being loaded from outside the local machine (without permission).
Re:YOU CANNOT DO THE SAME THING WITH IE!! by evilviper · 2004-08-01 15:14 · Score: 1

Yes the theme-matching is an issue... In fact, it's the only issue.

With IE... What percentage of people do you think are even using a different-than-default theme/color scheme? That's right, very few, so a great many would be vulnerable.

Now, IE doesn't give you the option to disallow javascript to change the status bar, etc., so it's more vulnerable in that regard.

Since I have mine configured with many things disabled, I would have liked to see how well it fool me, but since I'm a version behind, I'll never know.

--
Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant

Re:remote content should only control "client area by Beryllium+Sphere(tm) · 2004-07-31 02:50 · Score: 1

>using Mozilla as a platform for a company-internal application is a totally different scenario; can't we recognize that as a different scenario and give it different rules instead of using one browser to rule them all?

Good insight, but thinking that way flies you close to the gravitational pull of the idea of "security zones". Maybe it's possible to do that right but the record isn't encouraging.

>There's no need for us to give the secret to the remote site, though; just prove that we know it.

Amen! You're also right about the limitations:

>making it impossible for spoofers to create what looks like a login prompt of this kind but actually is just a plain old plaintext submit.

The security world calls this the "trusted path" problem. Microsoft's much-ridiculed Ctrl-Alt-Del to log in is an attempt at solving this issue.

Not on OS X by xero314 · 2004-07-31 02:50 · Score: 1

Thanks to the shody implementation of XUL in the most recent release of Mozilla/Firefox, us OS X user have nothing to fear. Try it on a mac and you will notice that the menu bar does not appear, at all, let alone correctly.

This is not entirely a Mozilla only problem. With enough knowledge of DHTML one can easily do the same thing in IE, and potential other browsers on windows. As a matter of fact IE may be even easier to spoof because the would be no need to know what theme a user is using (atleast on pre XP os). Also, unlike mozilla IE will allow you to execute harmful code with out any notification to the user.

In anycase this could probably be easily solved by having mozzila give some sort of notification when XUL is loaded.

Fundamental problem by mabhatter654 · 2004-07-31 02:56 · Score: 1

The fundamental problem is people trying to use the wrong tool for the job...or at least trying to hide the tool you're using. If your going to use a web browser for an app then you've simply gotta have the menu/icon/status bars that using a browser entails! That it was ever a "great" idea to have "chrome-less" browser windows with the scripting controlling the Application formatting (i.e. menubar, status bar, window title) in the first place was the fundamental flaw. I would suppose that chrome-less windows that were permenantly bound to the parent window...(like old school Win3.1 MDI apps) would be OK, but there still needs to be a better way.

First they should put some sort of permanent "chrome" warning on the window...perhaps use a colored boarder...green for the base window, and yellow, orange, red, blue...to denote wether you are at the same page, domain, local site, or redirected to somewhere else entirely. Also, there should be the full-qualified ACTUAL unclipped URL at the top or bottom of the window of ALL chromless windows...that would also help prevent spoofing.

Camino and Safari on Mac OS X by kybred · 2004-07-31 03:00 · Score: 1

Camino (v0.8) gives the same as Mozilla. Expected since it's based on Mozilla.

Safari just gives a blank window and downloads the .xul file.

I'll make it easy for you. by killjoe · 2004-07-31 03:02 · Score: 1

Take a piece of paper and put two columns on it.

On one column list all the IE exploits in the other list all the mozilla exploits.

Choose whichever one has the least.

--
evil is as evil does

Re:I'll make it easy for you. by Dark+Coder · 2004-07-31 04:37 · Score: 1

Actually, that approach would disqualify you from any Quality Assurance position in any industry. (It does make for a perfect job interview question).

The real answer is:

"The quality, severity and frequency of reported bugs is no indication of a product's buggy future, UNLESS you are willing to go through the code yourself and deemed it bug-less."
Re:I'll make it easy for you. by killjoe · 2004-07-31 05:33 · Score: 1

"The quality, severity and frequency of reported bugs is no indication of a product's buggy future"

really? None? Not even a tiny little bit? So you are telling me that tinydns which has never been hacked is just as likely to have an exploit in it as IE or bind? That you are just as lilkely to be hacked using IIS as you are using apache?

Do you apply the same line of reasoning to other aspects of your life. For example if person A has never raped a child and person B has raped and killed 20 children they are both just as likely to rape a child in the future right? After all preveious performance has zero bearing on future performance right?

--
evil is as evil does
Re:I'll make it easy for you. by ibbey · 2004-07-31 12:11 · Score: 1

"The quality, severity and frequency of reported bugs is no indication of a product's buggy future, UNLESS you are willing to go through the code yourself and deemed it bug-less."

Sorry, but I can't see how you can possibly rationalize this as correct. Had you said "The quality, severity and frequency of reported bugs is -LITTLE- indication of a product's buggy future", I'd have said that you're probably correct. For example, take two programs of a similar age & popularity (for example, program A & program B). Program A has 1000 reported bugs, program B has 100. Which program is more likely to have future bugs? From just that much information, it's hard to answer conclusively. Maybe program A has much more proactive developers who have actually sought out bugs.

But you didn't say "little indication", you said "NO indication". Based on simply the bug list, you may be correct. But in the real world, you can factor in other issues, such as the developers history, availability of source, etc. Using this extra info, you can reasonably guage the overall security of a product. Granted, this isn't a guarantee of security, but it certainly is -an indication-.

stop allowing chrome URLs by roesti · 2004-07-31 03:07 · Score: 1

Obviously, the spoof page is using chrome-type URLs to load your current theme. Contrary to some posts above, you can use a non-default theme and verify this; alternatively, you can still view the source.

Is the solution really any harder than restricting the use of chrome URLs? If not, why are people suggesting convoluted JavaScript restrictions that still only allow a trained eye to spot the difference?

I do have mod points to burn, but I'd rather ask a question that seems worth asking but that has not been addressed in the discussion. Besides, the intent of the question is to establish why we're all proposing to fix the symptoms of the problem, rather than its cause.

--
Attack its weak point for massive damage!

Re:stop allowing chrome URLs by mcsmurf · 2004-07-31 05:05 · Score: 1

The problem is Mozilla (or FF) should also be a application development platform (aka webapps). These are already used in some internal company LANs, they use it because XUL has many elements that are useful for webapps (and can't be built that easily in HTML), look native in the browser, aren't to difficult to program, run on many platforms and look the same on every one, Mozilla and FF support many things like SOAP,XML,etc. So if you don't allow access to chrome URLs, at least some of these advantages will go away.
Re:stop allowing chrome URLs by roesti · 2004-07-31 16:12 · Score: 1

So sandbox chrome URLs - only allow them from local pages. OSS advocates wouldn't want to deride insecure software platforms, such as Microsoft Office and Internet Explorer, and create another platform with the same problems.

--
Attack its weak point for massive damage!

Secure Interaction Design by bendeguz · 2004-07-31 03:09 · Score: 1

Ka-Ping Yee from Berkeley write some papers about Secure Interaction Design. Worth reading, especially for UI/Security developers.

From the page:
"Criticizing bad user interfaces is easy. Designing good ones is tough. The paper tries to give some new ideas on how to think about secure interaction design and some positive design suggestions, not just criticism."

http://www.sims.berkeley.edu/~ping/sid/

That's why by roman_mir · 2004-07-31 03:15 · Score: 1

I am still using good old Firebird tech. It's proven with time :) (since 1999)

--
You can't handle the truth.

punchline! by nsmcovox · 2004-07-31 03:16 · Score: 1

Tux the Linux penguin is driving through Arizona (on vacation from the South Pole) when he notices that the oil-pressure light is on. He gets out to look and sees oil dripping out of the motor. He drives to the nearest town and stops at the first gas station. After dropping the car off, Tux goes for a walk around town. He sees an ice-cream shop and, being a penguin in Arizona, decides that something cold would really hit the spot. He gets a big bowl of vanilla ice cream and sits down to eat. Having no hands, he makes a real mess trying to eat with his little flippers. After finishing his ice cream, he goes back to the gas station and asks the mechanic if he's found the problem. The mechanic looks up and says, "It looks like you just blew a seal." "No, no," the penguin replies, "It's just ice cream." pleasebanme at q3arena dotcom please :)

Of course, that won't stop me from using Firefox by Anonymous Coward · 2004-07-31 03:19 · Score: 0

Blind fanboyism at its worse

Re:OSS has no user interface problems (for me) by Fortun+L'Escrot · 2004-07-31 03:21 · Score: 1

we are superior because we respond to these kinds of issues a lot faster than MS does. if IE and firefox were two species of squirrel, firefox would be the one to develop the fire spear first and use it to defend itself against evil hax0r monkeys.

no such thing as complex applications without room for errors.

Re:remote content should only control "client area by TRACK-YOUR-POSITION · 2004-07-31 03:22 · Score: 1

The menu bar is fairly intrusive--but wouldn't it be a fair compromise to mandate the status bar's appearance? Or maybe even just a single icon that signifies hidden statusbar/menubar?

Vulnerability?-Rich Territory. by Anonymous Coward · 2004-07-31 03:28 · Score: 0

"As a sidepoint, I think the actual vunerability is the fact that XUL can be effectively imported and utilised from a website, rather than a vunerability saying "you can spoof the xyz browser using http user-agent flags and jpeg images" as a bad example :)"

It's a catch-22. Everyone here has heard of Rich Browser Clients i.e. Flex. Well to make them possible, you have to be able to retrieve the interface and behaviour remotely. Now how do you keep the bad guys out of a good idea?

no, I don't blame the user by twitter · 2004-07-31 03:28 · Score: 1

Perhaps all our retarded zealot fanboys will being the understand that actual vulnerabilities aside (which affect all code), plain user stupidity and the fundamental problems of the browser as an application platform make up for a large percentage of the perceived problems with IE.

While most normal people would ignore something as insulting as that, I see that you have moderated your flambait up, so I'll bite your troll.

As someone who's seen an auto-root jump out of Outlook and completely co-op a well kept fortune 100 company machine, I can say that neither the user nor administrators are to blame for rampant M$ exploits. The problems poor OS design and idiotic application design and the problems still exist. Programs can hide from M$'s kernel. The file system does not have execute and user permissions built in and enforced by the kernel. The programs, such as IE and Outlook will execute local code on remote demand as root. Email that plays wav files is just one example. The result is the perpetual root of the week being forever fought by anti-virus companies and others.

The design of Linux itself goes a long way toward fighting malware of the type you complain about. This exploit, while serious, won't allow a non root user to install software and malware hits a dead end right there. As the author of the article points out, the spoofer does not know what UI you have and Firefox gives you different preferences even in the M$ monoculture. Such an attack is obvious to someone who runs KDE in a different window manager. A far more dangerous exploit is to forge the "this application requires root password" dialog. In a corporate environment, this is a non issue because the user won't know that password and users in a well configured environment won't have to enter their passwords more than once a day. They will recognize the dialog as bogus.

Nice try at a defense of an obviously defenseless browser. A few clueless market droids will shake their heads and congratulate themselves on their continued use of IE and all the effort and money spent after it. "IE, the worst your money can buy."

--

Friends don't help friends install M$ junk.

Re:no, I don't blame the user by dedazo · 2004-07-31 09:02 · Score: 1

Fuck you, your silly jihad arguments and your sad habit of calling anyone who doesn't conform to the party line "troll". I wasn't "defending" IE; I don't even use it. I have however contributed a few bug reports to Mozilla and I run the nightly builds now and then to help them out in testing. It's my prerogative to complain about this stupid policy of having "confidential" bugs. I expected more from them.
I'm not about to discuss anything with someone who posts ridiculous claptrap like this.
Now go back to your cave and don't come out until you've managed to get a grip on reality.

--
Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo
Re:no, I don't blame the user by twitter · 2004-07-31 11:36 · Score: 1

I wasn't "defending" IE; I don't even use it.
Of course you did. You said that most of the bugs were the caused by user stupidity,
"plain user stupidity and the fundamental problems of the browser as an application platform make up for a large percentage of the perceived problems with IE."
You also defended M$ themselves:
That's nice, except that when "blackhats" do the same thing to people who use IE then it's Microsoft's fault.
As if M$'s bland and changeless interface were anyone but M$'s fault. That is, after all, one of the keys to the exploit that the cracker can make a one size fit's all spoof for M$ platforms.
I doubt anyone so offensive as yourself ever did anything for anyone else. "Party Line", piff. It would be nice if you did contribute something but your insulting comments here indicate something else.

--
Friends don't help friends install M$ junk.
Re:no, I don't blame the user by dedazo · 2004-07-31 19:38 · Score: 1

What part of "go back to your cave" did you not understand.

--
Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo

It's not that big a deal really by carlmenezes · 2004-07-31 03:38 · Score: 4, Informative

What it does is mimic the interface of an UNMODIFIED Firefox. Install ANY exension that changes the menubar or toolbar and you'll notice all that gone in the new window.

Heck, you don't even need to install any extensions...just customize your toolbar a little...place ANY icon after the help menu and try the proof of concept...it doesn't work - the difference is too obvious.

Neat trick, definitely, but I don't see it as much more.

--
Find a job you like and you will never work a day in your life.

Re:It's not that big a deal really by Anonymous Coward · 2004-07-31 09:07 · Score: 0

So as long as you're leet enough to be aware that you can customize your browser (and hence probably aware of phising), you're not vulnerable. Good then. Now how about the regular joe user who has mozilla installed for them by a geek friend? The ones who are most vulnerable to this kind of scam and are unaware of ways to fix it?
Re:It's not that big a deal really by Anonymous Coward · 2004-07-31 09:10 · Score: 0

So the way to not be vulnerable is to fix deficiencies in the stock distribution, just like with IE and OE?

Have you seen the 'Neat tricks' that are possible with those?
Re:It's not that big a deal really by jelle · 2004-07-31 09:51 · Score: 0

Even until they fix this, I won't be fooled, especially after knowing about it.

First of all, the real window has the name 'Page Info' in the title bar and the spoofed window "Mozilla Firefox <2>"

And second, as a habit against irritating web sites, I already clicked on edit->preferences and configured firefox to not allow javascript to do many things, such as changing the status bar, and that gives me another very noticable difference between the real window and the 'spoof' in the status bar at the bottom. The other spoofed window also has two visible status bars because of that simple setting, where the real one at the bottom obviously shows me that the page is _not_ encrypted at all.

Oh, and right-click 'view page info' in the spoof shows where the page is really coming from, including the real Security tab...

Oh, and the spoofed window has the large icons in the toolbar, which is the first thing that I change: I use the small icons.

Oh, and my bookmarks are not there, and the google Icon doesn't show the normal full list of search engines that I have there.

Oh, and why isn't there a tab, I set it to never hide the tabs, even if there is only one page.

--
--- Hindsight is 20/20, but walking backwards is not the answer.

didn't work for me by kardar · 2004-07-31 03:42 · Score: 1

I just had to kill X - it took over all my system resources - it was trying to do something but it didn't work. It tried to open up a full-screen window, but it was obvious that something unusual was going on.

I call that a "wierd" website or webpage or something. Going to have to do a little better to try to convince me that nothing unusual is going on.

WTF?

WOW! by Anonymous Coward · 2004-07-31 03:42 · Score: 0

That is the most impressive browser hack I have ever seen!

Now, you can't believe anything you see!

IE, can you ever forgive me and take me back, please?

Interesting by Starji · 2004-07-31 03:45 · Score: 1

This is kinda interesting, but I clicked on one of the links and it's missing two things. First is the tab bar, which for some reason I like having all the time. Second is the quick links. I don't know if this XUL page can actually bring up my quick launch. It also had that little activity icon in it, which I removed. I think all I'm saying is that it isn't a perfect exploit, it can be seen through with a discerning eye. It would be a danger though to people who either a: don't change the settings or b: don't look at their browser controls very much. I imagine the solution is just gonna be some popup box, "are you sure you want to run this xul content?" I don't know, but this is kinda interesting.

Too bad it doesn't work. by Gadzinka · 2004-07-31 03:51 · Score: 1

Too bad it doesn't work with my Firefox. I've got popups forced to tabs and it looks kinda funny: whole browser window, inside tab's render area. I don't know anyone who would fall for this.

Robert

--
Bastard Operator From 193.219.28.162

Re:Too bad it doesn't work. by HermanAB · 2004-07-31 07:12 · Score: 1

Mind telling us how you do that?
There are other configs on Sloshdat that force the windows to keep their title bars, which sorta works. Forcing popup to tabs would be better.

--
Oh well, what the hell...
Re:Too bad it doesn't work. by HermanAB · 2004-07-31 07:29 · Score: 1

Hmm, if I Middel Click on the exploit, then it flashes some Javascript message and then I get a new tab, that ends up blank.
If I Left Click on the exploit, then I get a new set of menu bars that look real funny.
I suppose the solution is to always make it very clear to the user that some Script is executing, by putting a warning in the status bar, but this stupid thing overloads the status bar and the normal JavaScript controls in my FF are all unchecked, including the one that says "allow script to hide status bar", but it still hides it!
I have seen that before on other sites, that the Javascript controls in FF don't always work.

--
Oh well, what the hell...
Re:Too bad it doesn't work. by Gadzinka · 2004-07-31 07:56 · Score: 1

As far as I remember, I only installed mozilla-tabextensions from debian/unstable via apt-get and configured it to force popups to tabs. I don't know, if this is one extension, or several packed into one .deb

Robert

--
Bastard Operator From 193.219.28.162

Voilà by Minwee · 2004-07-31 03:52 · Score: 1

"Viola"?

At least that's a step above "Wallah". I'll give you credit for at least getting the first letter right.

Re:Voilà by Anonymous Coward · 2004-07-31 19:38 · Score: 0

He aslo got thw lady tqo rigjt

And the developer should be canned by Animats · 2004-07-31 03:58 · Score: 1

Agreed. The browser has no business running nonstandard external file formats. Whomever put in this backdoor should be found from the CVS comments and should lose the ability to put code into Mozilla. They're a security risk.

Re:And the developer should be canned by mcsmurf · 2004-07-31 04:56 · Score: 1

which backdoor are you talking about? Spoofing is just a general problem, which can also be done with DHTML easily. Just takes some more work, but still many people would believe they're looking at a normal browser window.

The same 'solution' that isn't by Ed+Avis · 2004-07-31 04:06 · Score: 1

Annoying to see in this advisory the same stupid remark seen in some of Microsoft's advisories for IE:

Solution: Do not follow links from untrusted sites.

Wouldn't it be more honest to say 'Solution: None'?

--
-- Ed Avis ed@membled.com

Re:The same 'solution' that isn't by jesser · 2004-07-31 08:19 · Score: 1

How about something starting with "If you follow a link from an untrusted site to what appears to be a trusted site..."?

--
The shareholder is always right.

Holy Shit by sahonen · 2004-07-31 04:13 · Score: 0

There'd better be a patch for this soon.

--
Make me a friend and I'll mod you up

Re:Holy Shit by HermanAB · 2004-07-31 07:39 · Score: 3, Informative

Try this, it mostly works:
./.mozilla/firefox/default.flc/prefs.js
user_pref("dom.disable_window_open_feature.locat ion", true);
user_pref("dom.disable_window_open_feature.menub ar", true);
user_pref("dom.disable_window_open_feature.minim izable", true);
user_pref("dom.disable_window_open_feature.resiz able", true);
user_pref("dom.disable_window_open_feature.scrol lbars", true);
user_pref("dom.disable_window_open_feature.statu s", true);
It is only the last line that seems to be buggy, since the status bar still gets overloaded.

--
Oh well, what the hell...

XUL is bloated and slow by ngunton · 2004-07-31 04:14 · Score: 3, Interesting

XUL makes these browsers unusably slow on older machines. I have to use Netscape 4.8 (which has its own issues, but speed certainly isn't one of them - it doesn't take 5-10 seconds to open a new window) in order to get acceptable response on my old 450 MHz desktop (which is, I might add, perfectly fine using ANY other application, including Windows 2000, IE, Apache, MySQL, Word and so on).

I really think (as others have also mentioned) there is a lot of blinkered thinking when it comes to Open Source software, to the extent that people are starting to blindly ignore the flaws - these same flaws in Microsoft apps would be pilloried mercilessly, but here you see all kinds of "yeah, but" comments. I am not putting down OSS, but the XUL thing was a classic example of developers going away to make a browser, and coming back with a bloated, swiss-army-knife, can-customize-up-the-wazoo Internet Platform. I don't particularly care about changing the "skin" on my browser - all I want is a small, fast application that adheres to standards and is preferably cross platform. They could have gotten the cross-platform part by using something like wxWidgets. I thought Firefox was supposed to be smaller and faster, but unfortunately XUL still seems to be at its core. And for those who say "Well, why don't you go away and make your own browser" - I have other projects I am working on and don't have the time.

And to all those people who say that I should just get a new computer - well, tell that to all the schools out there who have old computers donated for teaching the kids. Anyway, Why should I have to upgrade because of one application - a BROWSER of all things? Just a classic case of developers going over the top to prove to everybody just how smart they are and how generalized their code is. And what do you know, now we find out that there seems to be a darker side to all this customizable GUI code. Oh well...

BTW, I don't hate Mozilla. This is a criticism of one aspect of the project that I think just went severely off-track with featuritis. The project is very worthy effort and I applaud the people who are making it, but these are just my honest thoughts on the matter.

Re:XUL is bloated and slow by argent · 2004-07-31 12:44 · Score: 1

Me Too

That's really what the Camino project on Mac OS X is about: a Gecko-based browser with a Cocoa user interface, no?
Re:XUL is bloated and slow by jswalter9 · 2004-07-31 23:42 · Score: 1

Try konqueror. Apple is lending support to it (they use the engine for their Safari browser), so it's coming up fast in the world. And it's much lighter (even with Qt) and faster (...even with Qt). It's certainly better than Netscape4.x

--
Retired from software... maybe. Sort of.

The nav bar should NEVER go away by gad_zuki! · 2004-07-31 04:14 · Score: 1

I can't stress this enough. I dont care how much it hurts the "aesthetics" of the site. Refresh, stop, etc should be on all windows. I do a lot of right-click context web searches with FF and if its a JS produced 'pop-up window' I can't see the results. Yes, I know the work-around, but thats not the point. The point is the web depends on a nav bar and a URL box telling you where you are.

I would be all for FF making the nav bar permenant on all windows for the sake of usability and to stop spoofing. There are other ways to spoof like this, so in the end this is a JS implementation problem (like the parent claims) and not really an FF/XUL issue. I mean, the FF people can fix the XUL loading, but that just leaves me with 5 other ways to fool you into giving me your paypal password.

Why Rich Web Apps will Never Succeed by Anonymous Coward · 2004-07-31 04:14 · Score: 0

JavaScript must be disabled to avoid such exploits. Because of browser incompatibility and issues such as this, JavaScript is a dead-end (and rightly should be).

JavaScripts? JavaScripts? We don't need no stinkin' JavaScripts!

I wasn't vulnerable! by Dwonis · 2004-07-31 04:23 · Score: 5, Informative

I couldn't figure out why I wasn't vulnerable, until I looked in my user.js file:

// More DOM/JavaScript options // Make sure all pop-up windows are resizable: user_pref("dom.disable_window_open_fea ture.resizable", true); // Make sure all pop-up windows are minimizable: user_pref("dom.disable_window_open_f eature.minimizable", true); // Always display the menu in pop-up windows: user_pref("dom.disable_window_open_featu re.menubar", true); // Always display the Navigation Toolbar in pop-up windows: user_pref("dom.disable_window_open_featu re.location", true);

That didn't prevent the statusbar hack, but it made everything else *really* obvious.

Have a look at about:config. There's a lot of useful stuff in there.

Furthermore by einhverfr · 2004-07-31 04:40 · Score: 1

What is to prevent me from using PNG's to spoof an interface?

After all how many people change the theme when they install it?

I think that there are times when you want to remove parts of the UI via scripting, but I think that there should always be certain parts which should move.

For example, if you install prefbar, it is not hidden by javascript, and so it will suddenly appear *above* anything in the content window. The status bar is another example of something that if it is not modifyable would be hard to spoof. Of course, with the main browser suite this is hard because the attacker would not necessarily know which components were installed, making a purely graphical attack unreliable.

Calling chrome components does allow this to be more easily exploited and it should be avoided.

The simple fix would also involve in my opinion, preventing content from calling Chrome documents.

--

LedgerSMB: Open source Accounting/ERP

Re:Furthermore by Anonymous Coward · 2004-08-04 03:01 · Score: 0

What is to prevent me from using PNG's to spoof an interface?
Which part of "Never let anything, popup windows, javascript, etc., hide any part of the browser interface" do you not understand?

XML error by Annirak · 2004-07-31 04:53 · Score: 1

When I attempt to view the spoof, I get: XML Parsing Error: undefined entity Location: http://www.nd.edu/~jsmith30/xul/test/browser.xul Line Number 233, Column 35:<key id="key_newMessage" key="&sendMessage.commandkey;" command="Browser:NewMessage" modifiers="accel"/> I'm running firefox 0.9.2, and it *does* remove the UI elements, but the spoofed UI fails to load. Oh, that's good. The slashdot code thinks my post is lame because of "junk characters" when I leave the error position indicator in.

Re:-1 Flamebait, now +6 INFORMATIVE by Anonymous Coward · 2004-07-31 04:54 · Score: 0

Exactly, now shut up and make one for crist sake!

I use Opera by rd_syringe · 2004-07-31 05:24 · Score: 2, Insightful

I've always known Mozilla to be less than the perfection that Slashdotters have paraded it around as. Now that all these security vulnerabilities are being discovered...well, nothing's changed for me because I use Opera.

No pointless XUL, no reimplemented widgets, no cute little XPI spoofs. Just a native web browser that is the fastest and leanest out there.

It's interesting to watch the conflicts of posters today. On one hand, they want to keep using Firefox and supporting it. On the other hand, they know that if this was an IE vulnerability, they'd be all over it and crying out about "why would anybody still be using IE, especially if this was known for five years!!"

Just an amusing illustration of double-standards on some people's parts. Not everyone...just the hardcore zealots who like to post here. This trend of Mozilla holes is a nice way for them to gain a little perspective on the matter.

Now, imagine if Mozilla had IE's marketshare right now! These holes would be blown apart by hackers, and I imagine dozens more would be discovered. Already, the trend is rising.

Re:I use Opera by NutscrapeSucks · 2004-07-31 06:44 · Score: 1

This really goes back to Andreessen 's comment about "Turning Windows into a buggy collection of Device Drivers" -- Netscape/Mozilla has always been about a platform strategy.

And Mozilla never gave up on the idea of Winning the API War, even after attracting the wrath of Microsoft and being crushed, even after missing their "next gen" ship date by several years, even after producing terrible performance on lowend systems, and even after being unceremoniously dumped by AOL. They are married to XUL/XPI/Skins/Extentions/etc, no matter how many yet-to-be-discovered hacks there might be.

Furthermore, it runs at cross-purposes to most Mozilla advocates, who want "Just a Browser" that robustly handles all kinds of sandboxed HTML/CSS/JavaScript, and really don't want any possibility of IE-like Platform Exploits. Unfortunately, Mozilla is not really that product.

Anyway, I suspect the logic behind burying this "bug" was "Developers Developers Developers!" -- they didn't want to make it difficult for people to start using XUL. (Similar to how MS shipped IIS5 with every extention enabled and on by default.)

--
Whenever I hear the word 'Innovation', I reach for my pistol.
Re:I use Opera by blackula · 2004-07-31 07:33 · Score: 0

opera is for fags, fag.
Re:I use Opera by jesser · 2004-07-31 07:45 · Score: 2, Informative

I just tested this attack in Opera. You're right, Opera does two things that make this kind of spoofing attack a little harder:

* "Window handling" defaults to "Prefer pages inside windows", so when a site tries to open a new window, it gets an MDI child window. This isn't nice for web applications or users who don't like tabbed browsing, but it is more secure against spoofing.

* At least in the default theme, if I do javascript:window.open("", "", "scrollbars=no"); void 0, the content area is indented by two pixels to create a 3D effect. This wastes a little screen space, makes it measurably harder to scroll using the scrollbar, and sites with black backgrounds like Slashdot ugly, but it makes it harder for a malicious site to spoof the menu bar.

However, Opera is still vulnerable to a more serious hole that was fixed almost two months ago in Mozilla and reported to Opera in March.

--
The shareholder is always right.
Re:I use Opera by rd_syringe · 2004-07-31 13:26 · Score: 1

Zzzzz.
Re:I use Opera by Phong · 2004-07-31 20:04 · Score: 1

On the other hand, they know that if this was an IE vulnerability, they'd be all over it and crying out about "why would anybody still be using IE, especially if this was known for five years!!"

This is a vulnerability in IE, and in Opera, and in every other web browser on the planet that has any kind of image+scripting support (DHTML support is needed for a really convincing spoof, but less convincing spoofs can still be effective).
For a good example of a spoof that affects IE, go to this web page and scroll down to the links in the "Spoofing" section (not the links in the "Misleading URLs" section).
So, the only thing that is Firefox-specific about this bug is that the originally cited implementation used XUL (instead of more generic DHTML) and mimicked the look of Firefox (instead of IE's or Opera's look).

--
..wayne..

Re:Of course, that won't stop me from using Firefo by ZB+Mowrey · 2004-07-31 05:25 · Score: 1

It could be. But it could also be someone who is comfortable with all of the 'extras' Firefox offers in comparison to other browsers. I know many people who refuse to use Firefox because IE hasn't let them down yet. ;)

To wit, those 'extras': built-in popup blocking; built-in google search; being free and Free; Extensions; Tabbed Browsing; about:config.

And how about not having to deal with bloat if you want to avoid it? You can keep FF very trim, and still take maximum advantage of its best features. Try that with IE.-

--

Self-referential sigs are rarely entertaining.

Double-standards on Slashdot by rd_syringe · 2004-07-31 05:29 · Score: 1

Look at the justifications. "This isn't really a Firefox vulnerability."

IE allowing random ActiveX to execute is considered a vulnerability, but Firefox executing random XUL isn't?

I think this recognition that Mozilla/Firefox is far from perfect is LONG overdue. Too bad it required a security exploit to do it. But so many people lack perspective around here, it's amazing.

Confidential by jefu · 2004-07-31 05:40 · Score: 1

I think the "marked confidential" thing bothers me most. Sure, I understand why it is done and why it is considered a Good Thing, but I suspect that part of the reason the problem was ignored for years is that it was so marked. It the bug had not been confidential, I think it would have been fixed long ago.

Security by obscurity is almost always a bad idea for lots of reasons. This is just one more bit of evidence to that effect - that bugs kept in the shadows may be less likely to be fixed.

Uh-huh by Rie+Beam · 2004-07-31 05:45 · Score: 2, Insightful

I'm running Firefox 9.2, and nothing happens. Guess I was smart in limiting what permissions Javascript has. Why exactly would you let Javascript do all the things it can do, when you have the option to disable the most pesky ones in Firefox? All I'm saying is, people are making a bigger deal out of this than it really is. Just make all releases have minimal Javascript settings by default, and then make the user activate the more spoofable settings (alter window size, hide status bar).

Re:Uh-huh by HermanAB · 2004-07-31 07:43 · Score: 1

Well now, I had all those pesky Javascript features disabled in the FF config menu and it still did it.
I had to go and manually edit prefs.js adding some lines as suggested in other posts and even then the status bar still gets overloaded.
Do you have any idea why?
OK, I am running FF 9.1, but is this fixed in 9.2?

--
Oh well, what the hell...

I almost completely disagree by kiddailey · 2004-07-31 05:53 · Score: 1

While I agree that some of these elements have been wildly abused, there are instances in web-based app design where pop-ups facilitate a useful interface design, get around browser limitations with CSS/DHTML and can even limit the amount of requests to the server.

Suggesting that it be made a separate program is great when you're working in a closed environment.

Saying that scripting should not be able to do a pop-up or create windows without toolbars and/or status bars is silly and single-minded.

Re:I almost completely disagree by argent · 2004-07-31 06:12 · Score: 1

there are instances in web-based app design where pop-ups facilitate a useful interface design, get around browser limitations with CSS/DHTML and can even limit the amount of requests to the server

So far I have yet to see anything that you can do with the kind of pop-ups that we're talking about you can't do with user-interface elements that don't require these capabilities, such as frames or floating layers.

There are times where it's convenient to open a window in a new context by default, so I wouldn't disable "target=" in a hyperlink... but notice that in this case the newer browsers like Mozilla and Safari allow the user to override this option, and that capability is one of the features that people like about them.

But scripted popups that strip out parts of the GUI, whether they're brought up by user request or not? Not only don't I see why they're necessary, I can't think off the top of my head of a case where they're even desirable.

If they're useful, then surely you will have no problem finding some examples. I'll be waiting.

Regular user : XUL? Whaaat? by Augusto · 2004-07-31 06:06 · Score: 1

This is just bad design, this shouldn't even be a question, most regular users won't have any idea what in the world you are talking about if you popup a warning dialog explaining what this is doing. It just makes no sense to allow a remote site to spoof a window like this, that's why early java applets waaaaaay before had a "warning" color coded message at the bottom (and still do).

After we've had that for so long, it's amazing that it wasn't considered for XUL.

--

- sigs are for wimps.

XUL is a bad idea by Anonymous Coward · 2004-07-31 06:18 · Score: 0

This is why I think XUL is a bad idea. It's adding too much power to an inherently insecure environment. If it's not done right, you get problems like this. Please, stop trying to make web browser anything more than a web browser. If you screw up, and being human you will screw up, it causes damage. It's better to leave the web browser as a web browser and something that's better to not put any trust in.

Re:XUL is a bad idea by mcsmurf · 2004-07-31 07:35 · Score: 2, Interesting

The idea was/is: If you focus on web browsing only, you always have to see what other browsers (esspecially IE) do and always jump after them if they create some cool new thing or introduce a new successful tag (also it's not in the specs). So the idea is to create a surplus value like XUL in combination with other things, like access to Mozilla internal interfaces or RDF,XUL,SOAP,XML support, which makes it easy to create some web-apps (a application development platform). So here you are the challenger then and don't have to follow the other browsers all the time.
Re:XUL is a bad idea by Anonymous Coward · 2004-07-31 11:48 · Score: 0

Considering the state of web browsers these days (and always. There has never been a truly good browser), it seems security and good standards support are considered surplus value. It's sad. They should be core value.

Is there a gecko-based browser that doesn't have XUL and runs on Windows? I need to replace Firefox.

That's a different problem. by argent · 2004-07-31 06:19 · Score: 1

The problem where applications that use the Microsoft HTML control or Apple's Webkit and LaunchServices to handle protocols and file types that aren't known to them... that's a whole different problem.

We're talking about allowing scripts top open webpages with minimal decoration so they can be made to look like application windows.

Bad, but not as bad by jhylkema · 2004-07-31 06:57 · Score: 2, Informative

Okay, so somebody essentially builds a Javascript replica of the Firefox browser which activates as a popup when somebody clicks on a link. For this, the Mozilla folks are being raked over the coals. This is like saying a bank vault is insecure because it can be breached with explosives. Any browser could be spoofed this way and this has been going on with IE for a long time ("Your computer is infected with spyware, click OK to install more spyware^W^Wour software.")

Granted, I'd like to see it more secure by default , e.g., it doesn't install software by default, Javascript disabled, etc. This also isn't uniquely a Mozilla problem as the first versions of Red Hat shipped with telnet and rlogin ports open by default. It all goes back to the age old debate about security versus functionality.

Javascript issue by HermanAB · 2004-07-31 07:07 · Score: 2, Informative

This is a Javascript configuration issue.

As others have mentioned, you can change the Javascript behaviour to ensure that all new windows will always retain their title and control bars. Consequently it is amtter of configuring your browser properly.

The FF team made an admirable effort to come up with a default configuration in prefs.js that mostly works and adding a few lines to it is a matter of concientious system administration.

My son told me he did a screen capture on the computer of his comp sci teacher, then installed it as a background and had the poor guy futz around for a long time trying to figure out why all his icons and taskbar is dead - we cannot honestly say that such an exploit is a bug in Windows now can we?

--
Oh well, what the hell...

Time to switch to Opera 'til the FAT LADY sings by Anonymous Coward · 2004-07-31 07:19 · Score: 0

Time to switch to Opera 'til the FAT LADY sings.

Thing is........ by CrazyTiger · 2004-07-31 07:33 · Score: 2, Insightful

No matter how much we beef up Firefox's impressive security,we can't do a thing to protect it from idiotic users who click first and ask questions later.Nothing can protect idiots from themselves. As for Mozilla ignoring the bug,they might've though it could've been something mebmasterse could do to enchance their pages.Now that people are taking aadvantage of it,they announced it as a bug. For example,if you made a browser,you might want to allow Javascript to change the background of the UI.Except that nobody decent does it,and those who do cover the UI in pornography and/or ads.So you plug the hole.

Re:Thing is........ by mikefoley · 2004-07-31 09:49 · Score: 1

Around 1986 I was sitting in on a meeting where an application that was in development was being discussed.

One of the product managers (it was DEC, there was always more than one product manager) said "We really want to idiot-proof the interface!"

I raised my hand and said "That's great, but there's a better idiot born every minute. I know, I work in system management"

--
What's my Karma Mr. Burns? "Excellent"

IE Name Change by earthstar · 2004-07-31 07:41 · Score: 1

i think wit hthe current state of affairs, even if IE does some miracle by fixing all bugs-past,present and future --even then it might not get over its tarnished image with customers.
what do u think?
They have to change the name of iE to somethin new,to grasp their lost respect.
with the name IE , i think it s all over!
BTW,wasnt Firefox a name change?

--

Why does yahoo do this

Where are all the IE haters now?? by Anonymous Coward · 2004-07-31 07:58 · Score: 0

No bugs for Mozilla / Firefox? MY ASS!!!

PoC didn't work for me by Anonymous Coward · 2004-07-31 08:06 · Score: 0

I got an XML parsing error when I tried to see the proof of concept (both of them). I'm using Firefox 0.8 on Mac OS 10.3.4. Has anyone seen this vulnerability exploited on 0.9 versions of Firefox?

I for One by Anonymous Coward · 2004-07-31 08:09 · Score: 0

Don't see what the big deal about it is. Its just a link to paypal. Yeah, I checked the ssl cert. This reminds me I need to login in to check on a purchase. ;)

LIne of reasoning is flawed by Dark+Coder · 2004-07-31 08:14 · Score: 1

The line of reasoning is an software-attribute specific application and has little or no known real-life (or human social) aspect that mirrors my statement, except for maybe Monte Carlo (gambling).

The grid axis are: Past (X) and Future (Y). I'll demonstrate that X is independent of Y, hence my original posting.

One can have a perfectly good piece of usable software with no know past or future bug. Quite an achievement that OSS hopes to demostrate (and I truly do hope so). DJS-DNS is a potential contender for this category.

Other can have a perfectly good piece of software with lots of hidden/undiscovered (future) bug. I'd say Wordperfect and Lotus-1-2-3 is one of them. (don't ask how I know this).

3rd combination: Software that has an intensive buggy history but performs admirably would be BIND and DHCPD. I'd like to say sendmail, but GOSH, those M4 rule syntax processing looks error-prone.

Worst combination: Lots of reported bugs, and lots of future bugs. Netscape! Surprised? Don't be. It hasn't reach critical mass level yet (and probably won't).

Re:LIne of reasoning is flawed by killjoe · 2004-07-31 15:56 · Score: 1

First of all netscape the original browser has nothing to do with mozilla which is a complete rewrite.

Secondly software is written by humans. If a set of human beings wrote a software with a 1000 bugs in it that means they were inept and sloppy. If a software has two bugs in it then it means the programmers were smarter and more careful.

A piece of software with a atrocious history like IE was obviously coded by sloppy stupid programmers and is likely to have lots of bugs in it. DJBDNS was written by a very smart and careful person and that means it's not likely to have many bugs in it.

--
evil is as evil does

Javascript did it, thanks, now about the 1.7.x? by Anonymous Coward · 2004-07-31 08:16 · Score: 0

Yeah, turning on javascript worked. It should be listed on the page, to help others out, after all, the advisories say to turn javascript off (I always keep it off anyway, and it's easier with konqueror, with Mozilla, I have to go into the options, find the right menu, then turn it on (and every tab is activated with javascript), while with mozilla, it's much simpler, it's not in front of me right now, but I think it is tools, plus one sub menu, click, and javascript is on or off, and only for the one tab.

ok, to move from 1.7, to 1.7.1, I haven't checked the site yet, and just in case it doesn't clearly say, what should I do (if you know, otherwise don't waste time looking for me, I'll find it later) should I download the full version and replace the whole thing with 1.7.1, like I did when I went from 1.5 to 1.7? Or is there a simpler and smaller patch to go from 1.7 to 1.7.1 on Windows?

Thanks again for the javascript tip.

Public Apology from Mozilla Organization by Anonymous Coward · 2004-07-31 08:50 · Score: 0

I think we all deserve a public apology from the Mozilla Organization for their betrayal of open source principles in the "confidental" bug classification. Whoever thought that this would be acceptable needs to get a clue.

Doesn't work by DMUTPeregrine · 2004-07-31 09:15 · Score: 1

This doesn't work for me. I see the new buttons and all, but they are below the normal ones. Who would be fooled by this? And that's ignoring the whole, all extensions disappear thingy.

--
Not a sentence!

Another spoof? by loconet · 2004-07-31 09:28 · Score: 1

This release along with the ssl certificate spoof reported here proof of concept here, does not make my favorite brower look good :(

--
[alk]

Affects very few users! by Commander+Trollco · 2004-07-31 10:26 · Score: 1

From the article:

For this spoof to have maximal effect, you must have the following settings at their default, out-of-the-box state:

* Web Features | Advanced | Allow Javascript to hide the status bar
* Default selection of toolbars and toolbar buttons
* No particularly bizarre browser extensions installed
* Javascript should be enabled.

As you can see, you have to be browsing with very open settings to be affected. What Firefox users browse with javascript enabled? At the very least, the Slashdot crowd has been lastmeasured enough to know better. "No particularly bizarre browser extensions"... again, not likely with Firefox users, extensions of all sort are the norm. And on top of all that, it only works on versions 0.9 and up, the bugged releases that sent me, if not many others, back to 0.8.

--
http://persianews.on.nimp.org/?u=Tar_Baby

Security through obscurity is cool! by Anonymous Coward · 2004-07-31 11:23 · Score: 1

Thanks to him now, his given just about every credit card frauder on the planet new ideas (and even implemented the paypal clone code for it too). They made it confidential to just stop ppl panicing about something which has always been possible and to try to stop frauders from adding this technique to their arsenal..

Yeah, security through obscurity is cool.
Also, let's not alarm the public by warning them of security holes.
So what if some people get ripped off when they otherwise might have stopped using online transactions had the problem been exposed to the general public?
We don't want them panicing, so it's better not to tell them.
It's too bad that Rat has publicized the issue, because no con-artist would have been able to come up with this exploit on his/her own.

Need a RegExp extension for FireFox by Anonymous Coward · 2004-07-31 12:12 · Score: 0

So we can do neat things like chop the stupid slashdot theme prefix, or attempt to googlify links to news sites to avoid registration :)

Microsoft apologists? by gwoodrow · 2004-07-31 12:21 · Score: 1

Where are all the Microsoft apologists? I've noticed a few, but I thought there'd be more with such a HUGE story as this.

I still have lots of faith in Firefox. It hasn't let me down yet, and even when there are errors/security issues I actually feel like the Mozilla team is fixing them for your and my sake instead of to maintain an image.

There's something to be said for intentions.

Re:Your sig... by Anonymous Coward · 2004-07-31 12:37 · Score: 0

Gmail supports Safari now.
Are you always so demanding of software before it's released to the general public?

not trolling by Anonymous Coward · 2004-07-31 13:31 · Score: 0

This is what happens when more people start using software. It becomes popular, and thus becomes more of a target.

This is why I've personally not been a strong proponent for Linux adoption amongst the commoners. They'll just fuck it up for everyone else.

mozilla advocates by moojin · 2004-07-31 14:00 · Score: 1

What does this mean for mozilla advocates? I've been trying to convince the head of information security to use mozilla instead of internet explorer, but then this and the previous mozilla exploit were released. It is disappointing, but then I hear that this vulnerability has been around for five years and the previous vulnerability was known for about two years. Features for mozilla are great, but shouldn't the developers be spending sometime solving these potential vulnerabilities? It would be easier for mozilla advocates if we could say that "mozilla is rock solid and secure" and have faith when we say it. Mozilla is way ahead of internet explorer on following W3C web standards and features that make surfing easier. It is time to look at all of those bugs in bugzilla and check them for potenial vulnerabilities.

BTW, as an after thought...

Dear Mozilla developers,

You did a great job on the browser and I love using it. I enjoy advocating its usage to others.

Andrew

--
Why did I lurk so long before registering for a Slashdot account? I could have had a Slashdot ID of less than 100000.

Re:This is nothing... possible fix by fprog · 2004-07-31 15:56 · Score: 0

Make XUL/XBL web pages ask for
"security prompt alert",
when visiting such pages.

Such that at least people could know.
Now if someone click "ignore all",
that's another problem.

RTFC by moof1138 · 2004-07-31 16:01 · Score: 1

If you bothered to read the f*ing comments, you would have noticed that in fact there is no single Slashdot-hive-mind collective viewpoint. In the comments there has been an active discussion of whether this really is a vuln. and a large percent are actualy agreeing with your position.

I wish there was a 'Making Dumb Generalizations About Slashdot' downmod. You so deserve it.

--

Hyperbole is the worst thing ever.

Improvements for XPI by teko_teko · 2004-07-31 20:48 · Score: 1

Actually improvements have been made to the XPI system in Firefox 0.9+ nightly builds.

Some of them that I can remember on top of my head are:
- Whitelisting, by default update.mozilla.org is added
- Disabled XPI install on page load

Sorry, links to Bugzilla from Slashdot are disable by AndreyF · 2004-08-01 04:02 · Score: 1

pwned!

Shoot from the hip... by Dark+Coder · 2004-08-01 13:29 · Score: 1

Shooting from the hip has costly implication. So, shame on me...

Thank you... "insignificant indication" might be what I was shooting for.

Re:Sorry, links to Bugzilla from Slashdot are disa by ceejayoz · 2004-08-01 13:33 · Score: 1

Well known fact, which is why most people are intelligent enough to copy and paste the URL and go from there.

Need step-by-step instructions?

So, it boils down to that one crack programmer! by Dark+Coder · 2004-08-01 13:54 · Score: 1

1. I do mean Netscape... as I contribute to Mozilla network protocol coding used by Firefox, Galeon, and a few other Gecko-using browsers. Netscape recent and upcoming releases are a disaster waiting to happen.

2. Ok, that is obvious that past vector has been established. Poor programmer, buggy code...vice versa. Same point for demonstrating that vector X is independent of vector Y. No direct correlation of past bugginess to future bugginess. Just a trending data showing that is likely probable.

3. You say DJB-DNS is "not likely" to have many bugs. You're still using past trending data as a form of future projection. Still like the stock market, it is not a foolproof method. Arguably, DJB-DNS is probably the most perfect code I have inspected in a while. Since I have made this inspection, I can state with high certainity that his code will have extremely low probability of being buggy.

Again, we cannot predict the future bugginess unless QA examines the code. And you are right, it all boils down to "crack programmer."

Now, if we can get a team of "crack programmers" not only writing good codes but working as a team, we'd have a killer apps!

Re:Sorry, links to Bugzilla from Slashdot are disa by AndreyF · 2004-08-01 14:52 · Score: 1

Xept he didn't provide a URL, but liked using a href...

Re:Sorry, links to Bugzilla from Slashdot are disa by ceejayoz · 2004-08-01 23:56 · Score: 1

Right Click > Copy Link Location
(or Copy Shortcut, in IE)

To quoth the smartass, "pwned!"

Re:Sorry, links to Bugzilla from Slashdot are disa by AndreyF · 2004-08-02 08:49 · Score: 1

That obviously entales copying the link location, which is not necessarily a URL, which is what you said first.

Now you're just a flip-flopping waffler.

Slashdot Mirror

Mozilla UI Spoofing Vulnerability

583 comments