Slashdot Mirror

← Back to Stories (view on slashdot.org)

Mozilla UI Spoofing Vulnerability

Posted by CowboyNeal on from the shields-up dept.

Short Circuit writes "Secunia has issued a security advisory for Mozilla and Firefox. Apparently, remote web sites can spoof the user interface using XUL. (See the Firefox proof of concept.) Of course, that won't stop me from using Firefox."

105 of 583 comments (clear)

  1. This is nothing... by Anonymous Coward · · Score: 3, Funny

    You think your Mozilla or FireFox has neat features like that?

    Well my friend, my IE can beat your browser many times over!

    HA!

    1. Re:This is nothing... by ceejayoz · · Score: 5, Informative

      except it has been a known issue since 1999...

    2. Re:This is nothing... by auzy · · Score: 3, Insightful

      Its not really an issue though.. Even if this is fixed, theres 10000 different ways of doing the same kind of thing that will throw off even most security experts. Even if its changed, there will be other ways of pretending the bar exists.. They made it confidential because theres no way to fix it.. If they fix it this way, blackhats use javascript..

      Rat never thought this thru. I think his trying to gain attention over something which he never bothered contemplating that there was no possible solution anyway.

      Thanks to him now, his given just about every credit card frauder on the planet new ideas (and even implemented the paypal clone code for it too). They made it confidential to just stop ppl panicing about something which has always been possible and to try to stop frauders from adding this technique to their arsenal.. Now, Rat has done an incredibly smart move and gave spammers, credit card frauders, script kiddies some new ideas.. And for that, we have to thank him

    3. Re:This is nothing... by Jugalator · · Score: 2

      Its not really an issue though..

      Of course it is. It doesn't stop being an issue just because it can be done in other ways as well. It doesn't stop being an issue because it can't be fixed (more like the opposite in that case).

      If they fix it this way, blackhats use javascript..

      Maybe, but Javascript won't do a nearly as good job as XUL itself to make pretty much a 100% identical version of the interface that's interactive and all.

      --
      Beware: In C++, your friends can see your privates!
    4. Re:This is nothing... by dedazo · · Score: 5, Interesting
      That's nice, except that when "blackhats" do the same thing to people who use IE then it's Microsoft's fault.

      Oh, and there's no excuse for "security through obscurity", especially when you've spent the past five years ridiculing the evil empire for it and thumping your chest singing the praises of being open and honest about the same thing. I don't care if this particular issue is interpreted as a bug, a vuln, a feature or anything else. The Mozilla folks kept this jewel mum for five years as far as I can tell. You know what? That means that XUL is probably flawed in some fundamental way and they know it. And if that's not the case, the fact that they hid it sure makes it seem that way.

      I suspect we're going to start seeing many more of these as Mozilla gains a foothold. Perhaps all our retarded zealot fanboys will being the understand that actual vulnerabilities aside (which affect all code), plain user stupidity and the fundamental problems of the browser as an application platform make up for a large percentage of the perceived problems with IE. Heck, the other day I rain into a page that wanted me to install some XPI malware.

      Maybe we're not so superior after all when people actually use what we do. Reality intrudes on the best laid plans, I guess.

      --
      Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo
    5. Re:This is nothing... by auzy · · Score: 3, Interesting

      actually, you can make javascript almost as interactive.. The only advantage for this one is the theme is the same, and the bookmarks are there.. I'm actually thinking about whether its worth making a javascript clone which would fool 90% of people, and be actually a higher risk because it would work on IE too, and safari, and whatever else available.. Of course, I believe in reusable programming and the only people who would look at the code for such a thing, would be the last people you want to see it

    6. Re:This is nothing... by auzy · · Score: 2, Insightful

      In 99% of cases, he doesn't need to, he just needs to be close enough. For such a thing to work well, he'd probably have to/want to open up a new window anyway full screen, during which time, 99% of people will forget if theres a special bar there, and not notice that their theme is a light white instead of their normal light pink, and 99% of ppl dont touch the bookmarks bar, so the defaults would be fine.. And nevertheless, those who would fall for something like this would just assume that those small changes are a bug in mozilla. I dont think with this 'exploit' they can put your extension bars there anyway.. Maybe your bookmark bar, but you'll notice that if u look at the code of the spoof, that there might not actually be a way to do that.

      You have to think logically, to do something like this you have to give someone a link too, thats where most likely the best place to do a check.. Make sure that if a hyperlink on a page says its http://www.paypal.com, make sure it doesn't go to http://killme.com .. Because in most phishing cases, people actually fall for it because the link is false anyway and just looks the same..

      I still think that something like that something like this in javascript would affect just as many ppl as the XUML version.. But be more dangerous because it affects every browser

    7. Re:This is nothing... by smallfries · · Score: 2, Interesting

      Actually this is nothing for me. Does it work for anyone else? The screenshot looks quite well done but the actual spoof just bombs out on my copy of firefox with an xml parsing error and a *huge* 5000 pixel wide yellow window. That didn't exactly take me in...

      --
      Slashdot: where don knuth is an idiot because he cant grasp the awesome power of php
    8. Re:This is nothing... by GoldMace · · Score: 2, Insightful

      What people exactly need the status bar to be hidden?

      I don't want any website to ever be able to hide the status bar, for any reason.

      For that matter, I don't want any website to be able to hide my address bar, toolbar, or menu bar either.
      Period. Why is THIS not an option in Mozilla or Firefox. This is my computer why is that not an option?

    9. Re:This is nothing... by Michalson · · Score: 5, Interesting

      You should really read the Mozilla vuln. list. While they only allow things that have been reported, *already fixed*, and *gone for 2 versions already*, it does provide a pretty scare look at Mozilla's "security", or lack there of. While I will be the first to admit this model of secrecy has worked in the past, it doesn't look like it will in the future. First, a lot of people are moving to Mozilla and Firefox, making it a viable target (I've already seen several instances xpi spyware/trojans ["please install me to make your clock run accurately"] being used in place of traditional ActiveX), and second, security reporting has been changing. In the past Mozilla security bugs where reported directly to Mozilla, where they could be kept secret as long as it took Mozilla to fix them - I've only seen a few rare cases of someone actually taking their grievances about Mozilla's slow bug fixing public (like the 1 line Javascript exploit for taking down every Mozilla window and tab at once, which took a year to fix, finally being done when the vulnerability was reposted to a public board, which prompted it to be fixed silently shortly after 1.7 came out). With Mozilla and Firefox "mainstream" browsers now, real security experts are starting to look at them, and they don't play Mozilla's game. They want credit for their discovery, so they don't want to have it shuffled under the rug while Mozilla pretends it never existed. This means publicly announcing exploits, which not only forces Mozilla to radically change how quickly they respond to security bugs, but also forces them to publicly inform users that they should upgrade to the latest build (before of course they just kept fixes secret and let everyone who doesn't download a 12MB build everyday browse with arbitrary code execution vulnerabilities, since saving their own face was more important). The fact that Mozilla vulnerabilities are going to start getting announced within days or hours of them being patched means you're going to start getting exactly what you get in IE - hackers take the bug, make a working exploit, and deploy it a week or month later against the 90% of people who didn't download Mozilla's daily bugfix (perhaps a bigger problem then IE, since Mozilla demands you download the whole 12MB thing, instead of just a little 100KB patch file). Remember Blaster - easy, 56k friendly made available more then a month before it hit. Now try "easy, 12MB patch made available on a weekly basis" and see how few people are keeping ahead of the hackers.

    10. Re:This is nothing... by Atrax · · Score: 3, Insightful

      > Experts don't browse with javascript enabled, so
      > it's pretty obvious actually.

      So how do these experts have any idea what will affect the end user? From their non-javascript Ivory Tower, they survey the scene and see all is good. meanwhile, Joe Dickwad sends his credit card info to the Ukraine, thinking he's just bought his momma a bouquet for mothers' day.

      To secure the end user's experience, you need to experience things from an end-user perspective.

      [this comment is nitpicking the post, not the experts, by the way]

      --
      Screw you all! I'm off to the pub
  2. Not another one! by Nermal6693 · · Score: 5, Funny

    I've lost faith in Secunia, they seem to love pointing out security holes in open-source products. So I just ignore them now.

    1. Re:Not another one! by Zeal17 · · Score: 2, Interesting

      I've lost faith in Secunia, they seem to love pointing out security holes in open-source products. So I just ignore them now.

      Does this make the point less valid? The open-source community seems to react quickly to criticism like this, so my guess is there will be a fix quickly.

      --

      "If it sucks without butter, it still sucks with butter, only creamier." - AC
    2. Re:Not another one! by Pahalial · · Score: 3, Interesting

      You -do- realize they've known for 5 years, right? We're only hearing now because it's apparently starting to be used in the wild, not to mention someone published research about using chrome spoofing.

      --
      Stuff.
    3. Re:Not another one! by Nermal6693 · · Score: 3, Funny

      But at 21, I'm too young to be a grandparent! ;)

  3. I'm using Firefox... by Anonymous Coward · · Score: 5, Funny

    so am I really seeing slashdot, or is someone trying to spoof me, while at the same time ironically warning me about said Firefox spoofs?

    1. Re:I'm using Firefox... by HoneyBunchesOfGoats · · Score: 5, Funny

      You can tell that it's not the real slashdot because they got the colors all wrong.

    2. Re:I'm using Firefox... by King_of_Prussia · · Score: 2, Funny

      I think I'm being spoofed, only a colourblind script-kiddie from Norway could have chosen a background colour this vomit-inducing.

      --

      Making the moon less necessary since 1998.

    3. Re:I'm using Firefox... by Pharmboy · · Score: 2, Funny

      Depends, did you get a bunch of 500 and 503 errors? Then its the real Slashdot. Oh, and look for dupes on the front page, the spoof's don't do that.

      --
      Tequila: It's not just for breakfast anymore!
    4. Re:I'm using Firefox... by Anonymous Coward · · Score: 5, Funny

      man...oh man. this reminds me of the time our "cio" first heard about ip spoofing back in 97.

      for the next 3 months every problem was probably caused by "spoofing"...he drove us nuts with that bullshit.

      so to fuck with him, we created fake security/vulnerability reports about a new threat: "goof balling"

      we could barely keep from wetting our pants as he ran around for the next 3 months telling everyone "we are being goof balled"

    5. Re:I'm using Firefox... by dillee1 · · Score: 5, Funny

      Fuck, I thought that was the VGA cable getting loose again and tried to fix it.

    6. Re:I'm using Firefox... by Anonymous Coward · · Score: 2, Funny

      You can download a fix here

      After installing this, I am not vulnerable to this security threat.

  4. Vulnerability? by insecuritiez · · Score: 3, Interesting

    Excuse me but isn't this "vulnerability" the same thing as saying the pop-up ads that look just like IE on Windows XP are a IE/Windows XP vulnerability? This customizability (albeit automatic by the webpage) is closer to a feature than a vulnerability if you ask me.

    1. Re:Vulnerability? by kristofme · · Score: 3, Informative

      I had the same opinion initally, but if you check out the spoofed Mozilla window you have to admit this could prove to be dangerous..
      Having said that, I'll stick to Firefox nonetheless - let's just hope the Firefox team will find a way to fix it soon.

    2. Re:Vulnerability? by NetNifty · · Score: 3, Insightful

      It's probably possible to do with IE too, but the worrying part of this exploit is the fake security certificate it produces. Easy way to disable the exploit working is to disable allowing javascript to hide the status bar - the menus etc still comes up but you can tell it's fake because of the extra status bar.

      --
      Linux Wireless Hardware in the UK
    3. Re:Vulnerability? by pinny20 · · Score: 5, Insightful

      No, because it's using Chrome, so the fake window will have the same theme as the user is using, and if coded cleverly enough, even an experienced user wouldn't be able to easily tell the difference - e.g. Menus will operate in the same way etc.

    4. Re:Vulnerability? by MoogMan · · Score: 4, Insightful

      You are right in the sense that it is not a "standard" vunerability as such, but as is the case for IE "spoofing", it is still valid. It could still cause users to think a spoofed page is a real page, so in essence the browser is "vunerable".

      As a sidepoint, I think the actual vunerability is the fact that XUL can be effectively imported and utilised from a website, rather than a vunerability saying "you can spoof the xyz browser using http user-agent flags and jpeg images" as a bad example :)

    5. Re:Vulnerability? by FyRE666 · · Score: 4, Insightful

      Excuse me but isn't this "vulnerability" the same thing as saying the pop-up ads that look just like IE on Windows XP are a IE/Windows XP vulnerability? This customizability (albeit automatic by the webpage) is closer to a feature than a vulnerability if you ask me.
      Exactly - furthermore, you can easily do exactly the same with IE. You just create a new window, with the fullsize property set, then set the dimensions (so you then have a blank window with no chrome at all - not even a title bar) - after that it's simply a matter of adding your spoofed interface using DHTML... Game over.

      --
      Code, Hardware, stuff like that.
    6. Re:Vulnerability? by bcmm · · Score: 2, Funny

      And here is a perfect reversal of how /. usually works. Someone says "I can do X with FireFox, but not in IE", and someone else points out how to do the same with IE...

      --
      # cat /dev/mem | strings | grep -i llama
      Damn, my RAM is full of llamas.
    7. Re:Vulnerability? by RzUpAnmsCwrds · · Score: 4, Informative

      "Exactly - furthermore, you can easily do exactly the same with IE. You just create a new window, with the fullsize property set, then set the dimensions (so you then have a blank window with no chrome at all - not even a title bar) - after that it's simply a matter of adding your spoofed interface using DHTML... Game over."

      This hasn't worked since Internet Explorer 6.0SP1. You can no longer resize a fullscreen window.

      As of 6.0SP2 (due out soon, hopefully) you can no longer create a window without a statusbar.

      Moreover, it is difficult to "fake out" the UI using DHTML. You may be able to fool inexperienced users, but it is much harder than doing the same thing using Mozilla's XUL.

    8. Re:Vulnerability? by KernelHappy · · Score: 2, Insightful

      At first I thought maybe it's more difficult for an observant person to be fooled. So I opened up a spoofed window and compared it to a real window to see how many differences I could find. Now as a child I was pretty damn good at the spot the difference cartoons in highlights magazine, apparently use it or lose it is valid. Only after I specifically looked for them did I realize that my bookmarks toolbar was missing, and from my navigation toolbar several icons were missing and the search control was present again (I have it turned off). In other words if you're drilling through links on a site and suddenly a couple items disappear, I'm gonna guess it's really easy to not notice, regardless of experience levels (in fact maybe experience or more so familiarity make this even more effective an exploint).

      The point being that even though I do fancy myself a pretty observant person (honestly I usually am) I didn't notice right off the bat what was missing from my usual interface and I bet most users wouldn't unless they looked for them on EVERY page load.

      --
      -- Button up, your ignorance is showing
    9. Re:Vulnerability? by plj · · Score: 2, Interesting

      Interesting thing though, that on OS X nobody's fooled, as the fake menubar appears on the top of the window as an empty bar (without changing the actual menu bar), which will instantly reveal that everything is not as it should be.

      --
      “Wait for Hurd if you want something real” –Linus
  5. Marked confidential? by Kristoffer+Lunden · · Score: 5, Interesting

    According to the spoof demostration page, this has been known for five years(!) but the bug filed has been marked "confidential". You'd think that the Mozilla team could do better than security through obscurity - that is usually a reserved tactic for "the other team"....

    --
    Spine World
    1. Re:Marked confidential? by Neophytus · · Score: 2, Informative

      If a fix would be hard and/or time consuming to create then isn't it fairer for the majority of users that it isn't known outside the development group rather than having them rush out a kludge that may introduce more bugs.

      That said, five years is a long time.

    2. Re:Marked confidential? by archen · · Score: 3, Insightful

      I think the problem the Mozilla team has is the same problem that the IE team has, which is the same problem that the Opera team probably has - if you can make a blank window, you can redraw the interface pretty easy. But how do you fix it is the question? If you always draw the menu bar and the status bar you can still recreate the other elements. If you require that the browser always look like the parent window... well that would probably work, although many things on the web would look like crap.

      I'm not making excuses for the Mozilla team (I mean this sort of freaks me out) , but I have no idea how to fix it. You could make all the bars "collapsed" on a "blank" window which would allow the user to always click them and look at the mormal UI again, but then you sort of expect that the user would know what those collapseable bars are for. Well it's better than nothing so maybe that's not such a bad idea... Anyway it's a problem with the way web browsers work as much as anything.

    3. Re:Marked confidential? by GoofyBoy · · Score: 4, Interesting

      So its ok for Mozilla/Firebird to utilize security through obscurity, yet when a closed source application?

      And aren't a thousand eyes suppose to be looking at the code and fixing it? So shouldn't the fix come quickly? Isn't that the strength of OpenSource? If in theory it sounds good but in reality it doesn't work, what good is it to have a thousand eyes looking at the code for security purposes?

      --
      The surprise isn't how often we make bad choices; the surprise is how seldom they defeat us.
    4. Re:Marked confidential? by Creedo · · Score: 2, Interesting

      It is there to allow you to use Mozilla/Firefox as an actual application development platform. For more information, look here.

      --
      All that is necessary for the triumph of good is that evil men do nothing.
    5. Re:Marked confidential? by FuzzyBad-Mofo · · Score: 4, Insightful

      That's the thing, this code didn't have the proverbial thousand eyes looking at it, because the asshats marked it 'confidential' until just recently. If anything, this proves that security through obscurity is a losing proposition..

    6. Re:Marked confidential? by FuzzyBad-Mofo · · Score: 2, Interesting

      Good point, but chances are people aren't going to work their way full the source of a program on the off chance of finding a critical issue. With awareness of a problem, it's much more likely that J. random developer will take a look at it.

      Anyway, as another poster stated, this is a problem with the XUL design, not really a coding error. I like the solution of just alerting the user that a website is attempting to run a custom XUL interface, and leave the decision whether to trust the site or not up to the user.

  6. whoops by ceejayoz · · Score: 4, Interesting

    Bug 22183. This is the first mention of the problem that I am aware of. It was marked confidential for five years until 7-21-2004.

    Gotta love that security-by-obscurity...

  7. What the hell? by King_of_Prussia · · Score: 4, Insightful
    Of course, that won't stop me from using Firefox.

    What kind of blind OSS zealotry is this? If somebody said something similar of IE there would be a unanimous uproar of upbraids from the slashdot community against whoever said it.

    Is it somehow tolerable for OS software to have faults, even serious ones? Security through obscurity is no security at all, as I'm sure many Firefox users will learn one day. Personally, I believe statements like that, and the people that make them are what is holding OSS back from becoming a serious contender to the juggernauts of mocrosoft. If we continue to sit on laurels gained only through lucky ineptitude we will get precicely nowhere.

    PS seems like google has started another round of gmail invites, I just got six. Logged in users tell me your funniest joke involving tux the linux penguin and the six funniest will recieve an invite (use a throwaway account, I'm sure this post will be followed by cowardly un-obfuscating trolls).

    --

    Making the moon less necessary since 1998.

    1. Re:What the hell? by tirenours · · Score: 5, Funny

      And from the linked page, a gem that we shouldn't overlook:

      "if you don't have Firefox (you should get it!)"

    2. Re:What the hell? by 4lex · · Score: 2, Interesting

      Since it doesn't affect the Mac OS X version (just checked), it won't stop me using Mozilla Firefox, for sure ;)

      --
      My journal. Mainly about freedom.
    3. Re:What the hell? by Threni · · Score: 3, Insightful

      > What kind of blind OSS zealotry is this? If somebody said something similar of
      > IE there would be a unanimous uproar of upbraids from the slashdot community
      > against whoever said it.

      Who cares what the `slashdot community` says? There's a mixture of people here. You don't have to listen to everyone. I'm not a zealot and i'm going to be sticking with Firefox, as I don't believe i'm at risk of this particular exploit, as I have a local webpage on my hard drive which is just a list of URLs to sites I use regularly, so unless that gets hacked i'm going to end up where I expect.

      > Is it somehow tolerable for OS software to have faults, even serious ones?

      All software has faults. IE has loads, Firefox has a few. On balance, it would appear that users of non-microsoft software are less at risk than microsoft users, and the problems get fixed more quickly. Or do you think this most recent security issue tips the balance back in favour of IE being the safest browser to use?

    4. Re:What the hell? by Spellbinder · · Score: 5, Interesting

      i am not even sure if this shoud be called bug
      there is nothing it is not doing like it should
      it may be stupid to allow javascript to hide the toolbars etc.
      maybe it would be wise to disable those features in the next firefox version per default
      it is easy to change right now...
      and i don't see why this is worse than IE permitting execution of code on your machine

      --


      stop supporting microsoft with pirating their software!!!!!
    5. Re:What the hell? by FooBarWidget · · Score: 3, Insightful

      There are many, many people out there who continue to use IE, even after knowing there are alternatives and that IE has many security holes. So what? Why doesn't anybody label those people as "MS zealots"? But when someone says he still continues to use FireFox he gets flamed down for being a zealot?

    6. Re:What the hell? by pebs · · Score: 5, Insightful

      Of course, that won't stop me from using Firefox.
      What kind of blind OSS zealotry is this?

      You know, I never advocate using Mozilla/Firefox due to lack of vulnerabilities; because deep down inside, I know there are a ton of vulnerabilities just waiting to be found. This is a problem for any reasonably complex software. Two reasons to use Mozilla/Firefox:

      1. Feature-wise, it completely blows away IE
      2. Standards compliant, which will help make the web a better place for all browsers

      Also, it runs on many OS's, but that's not a good reason for everyone.

      Currently, most of the malware/viruses/etc are for IE. But I have seen sites that try to get you to install Mozilla extensions that could be potentially malicious. With Mozilla's new-found popularity, it's only a matter of time before Mozilla gets attention from the malware writers. Get ready for it.

      --
      #!/
    7. Re:What the hell? by fzammett · · Score: 2

      Then using myIE. Now you have a feature set that blows away Firefox, and everything else, while still having IE under the covers (if you want that... I happen to like IE, and myIE makes it tremendously powerful, and even a little bit more secure).

      --
      If a pion (n-) collides with a proton in the woods & noone is there to hear it, does lamdba decay into the source pa
    8. Re:What the hell? by Dwonis · · Score: 4, Informative
      That this bug was hidden away in the Bugzilla annals for over 4 years as Confidential is really intolerable. It reeks of trying to sweep an embarassing problem under the rug, which is the complete antithesis of Open Source development.

      ...

      If a person, or group, can't be mature enough to admit a big, "oops, I/we made a really big design mistake. We'll fix it because many people are depending on us," then that person or group has no business working on such a fundamentally important piece of software as a web browser.

      A workable solution to this kind of problem has been around for many years. Java applets, when run from appletviewer, display a very prominent notice telling the user that very thing.

      The sad this about all this is that it's not even a fundamental design problem. Firefox has configuration options to eliminate this problem:

      All you need to do is put something like this in your user.js file:

      // disable target="_blank" (open in same window):
      user_pref("browser.block.target_new_wind ow", true);

      // prevent Javascript from trapping the context menu
      user_pref("dom.event.contextmenu.enabled", false);

      // ---- Stuff from http://flii.us/myworks/phoenix/pages/user.html ----

      // don't allow popups to disable features

      // if you know what the blank commented parts do, plz let me know
      // so i can update my file here. :) THANKS!
      // + special thanks to devin pohly for looking some of these up

      // Prevent Javascript from changing window focus
      user_pref("dom.disable_window_flip", true);

      // Prevent JavaScript from resizing your browser +
      user_pref("dom.disable_window_move_resize", true);

      // Prevent the Close button from being disabled
      user_pref("dom.disable_window_open_featu re.close", true);

      // same as dom.disable_window_open_feature.locationbar ?? or nothing +
      user_pref("dom.disable_window_open_feature.dire ctories", true);

      // Prevent the URL bar from being disabled?
      user_pref("dom.disable_window_open_feat ure.location", true);

      // Prevent the Menu bar from being disabled
      user_pref("dom.disable_window_open_featu re.menubar", true);

      // Prevent the Minimize button from being disabled
      user_pref("dom.disable_window_open_featu re.minimizable", true);

      // Prevent the Bookmarks Toolbar from being disabled
      user_pref("dom.disable_window_open_featu re.personalbar", true);

      // Prevent window resizing from being disabled
      user_pref("dom.disable_window_open_featu re.resizable", true);

      // Prevent scrollbars from being disabled
      user_pref("dom.disable_window_open_featu re.scrollbars", true);

      // Prevent the Status bar from being disabled
      user_pref("dom.disable_window_open_featu re.status", true);

      // Prevent the Title bar from being disabled
      user_pref("dom.disable_window_open_featu re.titlebar", true);

      // Prevent Javascript from hiding toolbar in new windows? +
      user_pref("dom.disable_window_open_feature.tool bar", true);

      // Prevent Javascript from changing status bar text +
      //user_pref("dom.disable_window_status_change", true);
    9. Re:What the hell? by Trailer+Trash · · Score: 2, Funny

      There are many, many people out there who continue to use IE, even after knowing there are alternatives and that IE has many security holes. So what? Why doesn't anybody label those people as "MS zealots"?

      They do. You apparently missed the memo...

      --
      Do you have ESP?
  8. Firefox, huh ? by ElVirolo · · Score: 4, Funny

    Of course, that won't stop me from using Firefox But then how do you know you ARE using the 'proper' Firefox if the interface is spoofed ?

    1. Re:Firefox, huh ? by Spunk · · Score: 2, Funny

      I don't have to worry, I use Mozilla Superchicken.

  9. Doesnt do tabs by isorox · · Score: 2, Interesting

    I use middle-click tab a lot (practically every link), the proof of concept doesnt show the tabs (still opens them though)

    1. Re:Doesnt do tabs by Sancho · · Score: 2, Insightful

      Not with the Tabextensions module. You can make EVERYTHING go to tabs..

  10. Confidential bugs in open source projects by October_30th · · Score: 2, Insightful

    "Confidential" bugs in an open source project. Really?

    --
    The owls are not what they seem
  11. Double standards? by bamf · · Score: 4, Insightful

    Of course, that won't stop me from using Firefox.

    If this was an issue with IE and not Firefox, I hope you'd still be saying the same thing?

    However I suspect that you'd be denigrating IE as loudly as possible, while insisting that everyone should move immediately to Firefox.

    1. Re:Double standards? by soloport · · Score: 3, Insightful

      It works like this:
      a) If you use anything Microsoft, you're an idiot.
      b) If you use anything Linux, you're a maniac.

      Sort of like slow-driver/fast-driver syndrome.

  12. Bear in mind... by Aluminum+Tuesday · · Score: 5, Informative

    Bear in mind that this spoof only looks convincing if you haven't changed your Firefox toolbar at all, ie. you haven't switched to smaller icons or added/removed/moved buttons.

    It also fails to appear properly on the Macintosh.

    If someone wanted to make some kind of exploit with this, they'd want to target a specific platform and Firefox revision. (eg. 0.9 on Windows) Since Firefox is in constant development, it could well change between revisions and render these spoofs obsolete.

    I don't really see this as a Firefox vulnerability. Use any browser without a popup blocker, and you'll see a lot of popup ads pretending to be legitimate OS windows and dialogs. This is really just a variation of that.

    1. Re:Bear in mind... by JRIsidore · · Score: 3, Insightful

      Bear in mind that this spoof only looks convincing if you haven't changed your Firefox toolbar at all, ie. you haven't switched to smaller icons or added/removed/moved buttons.

      Sure, if a toolbar suddenly looks like the default config all users will suspect a faked UI and get alerted instantly... you expect too much. IMHO many will simply assume the browser messed up their config and keep on browsing. Even if the majority gets suspicious, the small percentage that is fooled is most likely to be profitable enough for the phishers.
      Any fresh Firefox installation asks about sending unencrypted form data, but not about executing arbitrary XUL stuff? This is a serious design flaw.

      --
      :w!q
  13. Not sure how they'll fix this... by AC-x · · Score: 2, Informative

    Without disabling XUL, I mean it's the equivilent of using images and text forms to spoof the IE menu bar, it just so happens that Firefox gives you tools that can be used to do a better job of it.

    At any rate this can be overcome quite easily by changing the javascript prefs so that sites can't hide things like the status bar and menus.

  14. Javascript window "features" by Ianoo · · Score: 5, Informative

    The real problem here is not so much XUL, but Javascript!

    Why does the browser even allow Javascript to create popup windows without toolbars, menu bars and status bars? This has to be one of the most annoying features of any web browser, I can't for the life of me understand why anyone would think up or need such a feature.

    Without this Javascript, you couldn't turn the real menubars and toolbars off, and the problem would be much less severe since although you'd have a second set of interface controls within the browser window, the real status bar would be at the bottom, and the real menubar would be at the top.

    Firefox already has a way to block JS from doing this and using several other of its most annoying features, and indeed I personally have these limits switched on already. Put about:config in the address bar, and change these entires to the following values (or look up how to make a user.js file on Google):

    dom.disable_window_move_resize = true
    dom.disable_window_open_feature.close = true
    dom.disable_window_open_feature.directories = true
    dom.disable_window_open_feature.location = true
    dom.disable_window_open_feature.menubar = true
    dom.disable_window_open_feature.minimizable = true
    dom.disable_window_open_feature.personalbar = true
    dom.disable_window_open_feature.resizable = true
    dom.disable_window_open_feature.scrollbars = true
    dom.disable_window_open_feature.status = true
    dom.disable_window_open_feature.titlebar = true
    dom.disable_window_open_feature.toolbar = true
    dom.disable_window_status_change = true


    Now try the example given in the summary again.

    1. Re:Javascript window "features" by Moridineas · · Score: 2, Informative

      I've used javascript to open windows without toolbar, status bar, etc. in an app where I think it is a quite useful feature.

      Situation is web interface to a database. Popup windows are used to search database and fill in parts of the main form (product search, customer search, etc).

      It saves a lot of screen real estate turning off those unnecessary things--and it's helpful for the user to have both the main form as well as any search windows open at the same time.

    2. Re:Javascript window "features" by Selanit · · Score: 2, Insightful
      Why does the browser even allow Javascript to create popup windows without toolbars, menu bars and status bars? This has to be one of the most annoying features of any web browser, I can't for the life of me understand why anyone would think up or need such a feature.
      This feature is useful:

      1) Whenever you have to show the user some information that is not directly related to the task at hand. Example: you have a multi-page "wizard" style form allowing a user to enter information into a database. It is a fairly complex process, in which the options offered on later pages will depend on which options were selected on earlier pages. Scattered across each page, you have links that open a glossary to define a particular term. Opening the glossary information in a new window (one without toolbars, etc), allows you to provide that information to the user without interrupting their workflow. Toolbars are extraneous to the window, since it never shows anything but the glossary page. Showing them would be pointless, and would detract from the look-and-feel of the application.

      2) When you want to offer a user the ability to view an arbitrary item from a list without reloading the page. Example: you have a bunch of images, and you want to let a user preview each one. You list each filename and other file details, then you have a link entitle "Preview", which opens up a new window (with no toolbar, etc) showing that image. Subsequent previews will resize the existing preview window and change its url rather than opening an entirely new one. If the preview button left the index page to preview each picture, it would increase the amount of traffic on your web server, with each new request for the index page. This may seem trivial, but if the index page is generated using information from a database, that can mount up fast, especially if you have multiple concurrent users. Again, toolbars are extraneous to the function of the window in this situation.

      3) In any situation where you want to make two windows easily distinguishable from one another. If you have ever watched inexperienced or non-proficient web users, you will note that they frequently become confused when dealing with multiple browser windows, and this is especially true when the page author adds a target="_blank" attribute to a link. The new window opens, taking up all the available screen real estate, and looking exactly like the previous window, so the user naturally tries to use the "Back" button to return to what they were just looking at. But it doesn't work, and so they have to stop and study their open programs to figure out what happened. If, on the other hand, that content were opened in a smaller window with no toolbars overlaid on the parent window, it is instantly obvious that it's a new window, and the user is much less likely to get confused, leading to a better experience with the web site.

      The first and second examples come from real life uses of window.open() -- both in my own pages. The third is applicable to virtually any proper use of JavaScript window control. I hate pop-up ads as much as anyone, and I'm profoundly grateful that FireFox blocks unsolicited calls to window.open(). Two other things make me glad: firstly, that you have the option of turning all that stuff off because you hate it; and secondly, I am glad that you're not in charge of FireFox development, because I suspect that a lot of "annoying" pages might not function properly in FireFox if you were.
    3. Re:Javascript window "features" by ibbey · · Score: 2, Informative

      The real problem is that browsers were never meant to be front ends to databases.

      Bullshit. As far as I know, Mosaic 1.0 had basic forms. Coupled with a cgi script, Mosaic was a DB front-end from the beginning. On top of that, Mozilla is, of course, the direct descendent of Netscape, which was designed by Marc Andressen, the original developer of Mosaic. Andressen stated repeatedly that he wanted to make Netscape a platform rather then just a browser, so your point is quite thouroughly shot to hell.

      But even if your statement was remotely correct, it would still be irrelevent. Just because the original designers didn't foresee an application, doesn't mean that the application is somehow verboten. Innovation happens. Deal with it. The browser makes the IDEAL front end to a database. Properly implemented, it provides near write-one, run-anywhere capabilities to application developers. If you are developing an kind of database application, and you want to be able to support all users, regardless of OS, one of the easiest possible solutions is to create a browser based app. Sure you could do it in Java, but not everyone has Java installed or turned on (I don't). And sure you could write a frontend in Python (or whatever), but most users won't have the necessary software installed. By making it web based, and coding carefully, with a liittle effort you can support probably 98% of all users, without requiring anything of your users except that they be running a recent browser.

      This spoofing exploit is a serious issue, but it's not one that suggests that we should throw away the "browser as platform" concept. The problem needs to be addressed, but there are several ways to do that without crippliing the browser.

  15. There's something rotten in Firefox. by cyclop · · Score: 5, Insightful

    And not just for the bug itself (that probably will be fixed quite rapidly). There are two issues behind this.

    (1).The problem was known 4 years ago, but it was marked confidential. I'm not familiar with BugZilla,so I didn't even know there could be a "confidential" bug. This is the antithesis of Open Source philosophy. This is pure security-through-obscurity, in pure M$ style. If the bug wasn't "confidential",I'm sure we should have seen this fixed years ago.
    I just hope most of the other open source/free software projects I rely on every day (Linux,KDE,Mplayer,Kile,Thunderbird,Nicotine and so on...) don't follow such a moron habit.

    (2)How can the browser load XUL code and use it without warning? This is not a bug: this looks more like IE-like flawed design. Correct design shouldn't even *read* any data of this kind, let alone running it and let it deface the browser itself!

    The Mozilla family of browsers/mail clients is still a crew of wonderful programs,and I'm proud of using them. But they will rapidly become IE-like crap, if they continue this way.

    --
    -- Patent no.123456: A way to personalize /. comments with a sig attached to the end.
    1. Re:There's something rotten in Firefox. by AC-x · · Score: 3, Interesting

      I certainly think having confidential bugs was a very bad idea (who gets to see them I wonder?) but running XUL code is hard not to without making it quite useless, at work we plan to look at it with the view to using it in our web applications instead of HTML (which I think is one of the things it was originally for).

      I mean, it's basically the same as using images to spoof the IE toolbars, Firefox just gives you the tools to do a better job of it.

      The only thing I can think of that wouldn't make using XUL a total pita is to warn the users first time a site trys to use it, something like

      "Do you want this site to create an interface in XUL (phishing warning blah blah blah).
      [Yes] [No] [x] remember this for xyz.com

    2. Re:There's something rotten in Firefox. by Jugalator · · Score: 3, Insightful

      The problem was known 4 years ago, but it was marked confidential. I'm not familiar with BugZilla,so I didn't even know there could be a "confidential" bug. This is the antithesis of Open Source philosophy.

      I fully agree this is a very bad idea. All it takes is someone to get hacked, or in another way disclosing information about these secret bugs, and then they might start circulating among "underground" hackers without us knowing it, and voila we have an exploit for an issue a very large group of the developers didn't even know exist.

      If they did know, they could of course have offered help in resolving the bug much earlier.

      They need to start thinking about these things now as the browser might start to gain momentum. Even if it's not huge problems revealed, merely the fact that secret bugs exists and are revealed now and then (I have no doubt we'll see more in the future since this is probably not the only one), is severe negative publicity for the Mozilla products. It wouldn't be nearly as bad if the bugs weren't secret.

      --
      Beware: In C++, your friends can see your privates!
    3. Re:There's something rotten in Firefox. by Anonymous Coward · · Score: 2, Interesting

      The problem was known 4 years ago, but it was marked confidential. I'm not familiar with BugZilla,so I didn't even know there could be a "confidential" bug. This is the antithesis of Open Source philosophy. This is pure security-through-obscurity, in pure M$ style.

      The problem isn't that it was confidential - very few people advocate *immediate* full disclosure without warning the vendor first. The problem is that the confidential bug report wasn't addressed.

      I would like to see confidential bugs viewable within BugZilla, but with the actual report itself hidden (just the metadata like title, reporter, date reported, etc visible). I would also like to see confidential bugs have a time limit of a month before they become publically viewable (with email reminders to the proper parties of course).

      I agree that there should be a warning before rendering a XUL interface without normal toolbars, etc.

    4. Re:There's something rotten in Firefox. by mcsmurf · · Score: 2, Informative

      Either a reporter can mark his own bug confidential or a member from the security group can mark it confidential (or remove that flag). The members can be found here. Those are either members of the Mozilla Foundation, people who have done coding for Mozilla for many years now or were in any other way involved for a long time in the security of Mozilla. Or earlier (like one year ago) it were also people from Netscape, but i don't know how many people from Netscape actually had access to those bugs.

    5. Re:There's something rotten in Firefox. by AlXtreme · · Score: 3, Insightful
      The only thing I can think of that wouldn't make using XUL a total pita is to warn the users first time a site trys to use it, something like
      How about just disabling the execution of remotely-retrieved XUL files from within Firefox by default? I'm surprised Firefox didn't warn before loading the spoof from the remote site, it clearly should as a minimum. However as more and more new users with the click-before-you-read syndrome try out Firefox having it disabled by default seems the only sane thing to do.

      If you want to view your web applications internally using XUL, having a whitelist akin to the popup blocker seems the best way (don't bother user unless he figures out something is missing and he clicks on the disabled-window icon). For all us people just wanting to browse some HTML, automatically (or even after prompting) running XUL from a remote server is a flaw and potentially dangerous, and should be considered as such. I'm amazed this hasn't received more attention.

      --
      This sig is intentionally left blank
  16. Re:Javascript should be enabled. by adam+mcmaster · · Score: 4, Insightful

    what sort of moron would let a webpage run code on his machine anyway?

    The average user.

  17. Too much zealotry by brainnolo · · Score: 4, Interesting

    Well, this IS a bug, and a very nasty one, as the author of that page said, everything in that page can be made to work. With some Javascripts you could even identify which version of browser is running and adapt to it. I've been impressed by clicking on the pad lock. I don't think web pages should ever need to load XUL, this is bad design for me. I don't get how can you say that this is not a bug, that this can be done also in IE. Is not true! Those for IE are almost all just gifs and are very easy to notice. But wait, Mozilla loading XULs via HTTP:// without even popping-up an alert is a feature, IE loading ActiveX is..bad design! Why? At least ActiveX's CAN be useful! Please stay with your feet on the floor.

    1. Re:Too much zealotry by AC-x · · Score: 2, Insightful

      Using XUL through HTTP can be _very_ useful, we're looking at it to replace using HTML in our web applications and it looks like it would be do a very good job at it (I think that's one of the things it was built for).

      As for ActiveX, that's actually running code on your computer, XUL is just an interface language. You can't run XUL that'll install spyware on your machine for example.

  18. That's it... by canavan · · Score: 2, Interesting

    now I'll go back to browsing with telnet and openssl s_client.

  19. This is pretty bad... but... by ravydavygravy · · Score: 2, Interesting

    Well, I have to say that this exploit is particularly serious - but not the end of the world. I've every faith we'll see a fix fairly soon...

    It's pretty bad because it has the end results of several techniques rolled into one handy package - URL spoofing, fake certs, browser highjacking...

    Several workarounds being mentioned - using a non-standard toolbar (add at least one extra button/menu-item so you can identify a fake version...), and possibly a non-standard theme would work (though I'm not so sure about this one...)

    Anyway, net result - firefox has a pretty bad security problem, with a fairly easy workaround, and no doubt a fix in the works... - how about not allowing remote sites to run XUL without first warning the user (with the option to turn this warning feature off of course - it's all about choice, right?)

    Dave

  20. I'm protected in three ways... by Mr.+Smoove · · Score: 2, Interesting

    1. I use a custom theme (Qute as it happens) with small icons

    2. I've cutomised my toolbars to reduce them into one (plus bookmarks)

    3. I have Tab Browser Extensions installed and I run in Single Window mode so all pop-up windows get opened inside my one browser window.

    This is the power of Firefox!

    --
    Mr. Smoove
  21. too bad, Mozilla suite suckers! by frankie · · Score: 5, Informative
    We fans of the "bloated" original Mozilla are once again left in the dust by Firefox. Loading the test page results in:
    XML Parsing Error: undefined entity
    Location: http://www.nd.edu/~jsmith30/xul/test/browser.xul
    Line Number 20, Column 1:
    <window id="main-window"
    ^
    In seriousness, that's probably just an artifact of Firefox-specific XUL in the example, and could be fixed by a dedicated black hat. I agree with Lanoo, all versions of Moz should disable javascript toolbar-hiding by default.
  22. don't allow pop-ups without menu/location/etc by orabidoo · · Score: 5, Insightful
    in about:config, or in user.js:

    user_pref("dom.disable_window_open_feature.locatio n", true);
    user_pref("dom.disable_window_open_feature.menubar ", true);
    user_pref("dom.disable_window_open_feature.minimiz able", true);
    user_pref("dom.disable_window_open_feature.resizab le", true);
    user_pref("dom.disable_window_open_feature.scrollb ars", true);
    user_pref("dom.disable_window_open_feature.status" , true);

    This makes all pop-ups have a full navigation bar, location bar, status bar, and forces them to be resizable and scrollable.

    It may look uglier than plain-window pop-ups, but it does keep you in full control of your browser.

    With these options set, the spoof pages look obviously like what they are: a fake browser within a real browser.

    1. Re:don't allow pop-ups without menu/location/etc by argent · · Score: 2, Informative

      You can put this right next to the section where you disable blinking text and other stupidities.

      Really, there should be a single preferences option that turns all this off though. Of course when Netscape does their re-release of Mozilla *their* version won't have that option. :)

  23. remote content should only control "client area" by nothings · · Score: 4, Informative
    Although there are other strategic fixes discussed in the bugzilla discussion, it seems to me the first point of order is to NOT allow disabling/hiding of the toolbars and status line. These are tools for the user; there's no reason for "untrusted" sites to be able to do this. There seems to be a strange mentality of trusting the remote site's opinion over that of the user, rather than "sandboxing" the remote site's control into a limited part of the browser (the "client area" aka the "content area").

    Some site authors may say "but I really want to author a popup that doesn't have all that crap etc," but I don't see how it can be that important, especially given all the consequent badness. The only case I can see for this is that sometimes you do trust the content author--that there is a notion of Mozilla as a platform for application development. And, hey, ok, code reuse is good, but using Mozilla as a platform for a company-internal application is a totally different scenario; can't we recognize that as a different scenario and give it different rules instead of using one browser to rule them all?

    Now, without being able to disable the location bar, you can't spoof the location bar trivially. You could put up a second one and hope people don't notice, and yeah, some people won't. Unfortunately, as pointed out on bugzilla, there's a case that this won't stop: you create an entire faux window, one that appears to be in front of the main one, but is actually just a part of it. So in the middle of your page you have a seeming popup window with a seeming location bar with a faux address. It wouldn't be draggable outside of the client area of the main window, but some people wouldn't notice it.

    It's hard to see how to defend against that, although I am a wacky retro guy who thinks all of this DHTML stuff has given content creators way more power than they really need, and there would be nothing wrong with just pushing back on the standards until things weren't spoofable. (Remember when standards meant you wrote an RFC about something you had already implemented and figured out really worked; it didn't become a standard until people had exercised it in the field? Whatever happened to that?) Or maybe Ian Hickson is right and we're all just raving paranoic nutjobs. But it seems like exactly the sort of 'power before security' attitude that's gotten MS in a lot of trouble.

    An entirely different way of looking at the problem of spoofing is that we transmit our secrets "in the clear" to the remote site. (Obviously encrypted by https or whatever.) If the remote site is spoofing, they get our password (and can maybe even open a connection to paypal or whatever and pass through everything so we don't know it's been spoofed). There's no need for us to give the secret to the remote site, though; just prove that we know it. For example, the server can give us some random data, and we use a non-reversible encryption algorithm to combine the random data and the password, and return the result of that. The server can verify that it's the right result without anyone transmitting the actual password (though the server must store the actual password, and not a hash of it). If this were the technology we were using, a spoofer wouldn't be able to use the password, unless the spoofer DID open a connection to the real site first, and get the challenge; then it could pass it through, but then the spoofer would have only this one chance to make use of the spoofed data, since the next time the real site challenged, the spoofer is stuck; whereas currently a spoofer just captures the user/password combo and keeps it around for later processing. This would raise the complexity bar for making effective use of spoofing (including email phishing!), although I don't know if it's high enough. But good luck getting it into browsers AND making it impossible for spoofers to create what looks like a login prompt of this kind but actually is just a plain old plaintext submit.

  24. Use shit.slashdot.org :) by Anonymous Coward · · Score: 5, Informative

    Use link to get the pretty green colors back.

    1. Re:Use shit.slashdot.org :) by ColMustard · · Score: 3, Informative

      Because it is the subdomain which determines the theme. There is no 'shit' section, so it reverts to the default theme. Try it with a real section: replace the 'it' subdomain with 'apple' and you'll see the Apple section theme.

      --
      Moof.
  25. Expect this to get more prevalent by gedhrel · · Score: 4, Insightful

    It's a serious problem. XAML, XUL and even SVG are positioning themselves as web-delivered application delivery platforms. The idea is to provide a mechanism for web-delivered apps to NOT look like they're running in a browser; instead, permitting more integration with the desktop.

    This kind of spoofing is going to become more problematic, not less.

  26. It's not just a bug, it's a bad user interface! by argent · · Score: 4, Insightful

    The ability for web pages to override *any* part of the standard user interface, even if they can't then replace the UI with their own imitation, is something that I've been pissed off about for years. If you want to build an application development platfrom that can do anything, make it a separate program... leave me in control of the user interface of my own software.

    There shouldn't be a mechanism in the HTML/script/etc to do things like pop-ups, pop-behinds, moving windows, windows without toolbars and status bars... there should be an unbreakable firewall at the edge of the document portion of the browser.

  27. Re:Uselss Spoof by argent · · Score: 2, Informative

    I do support for about 150 users, most of whom are programmers. I'm starting to have to clean spyware out of three or four computers a week, and a couple of times I've seen "spoofs" that looked like they were trying to trick people into allowing the bogus code to run, and none of them look like exactly like "real" IE or other application windows to my eye.

    Yet, based on their track record, they do the job.

    So an exploit that does a better job than that, well, it's a problem. The problem should be blocked at the source... starting with removing the ability to change the browser window decorations even if you DO still allow popups.

  28. Signed Xul or trusted XUL sites by tweek · · Score: 2, Insightful

    I'm wondering why the moz team doesn't just implement signed XUL. We love using XUL for our internal applications at our company but somehow having to sign it wouldn't be a problem.

    I realize we now have dialogs that warn us about everything AND that most people just click through but having trusted XUL sites or signing it somehow would be just fine by me.

    What really annoys me is that:
    A) The bug was marked confidential for 5 freaking years!
    B) The people saying that it isn't a big deal.

    It IS a big deal or else the damn thing wouldn't have been marked confidential for 5 years. Sure it doesn't allow you to overwrite system files but I can recover from a virus. It's harder to recover from having a bank account wiped out because you used and unprotected debit card on a spoofed website ( forgetting that anyone who uses a debit card instead of a real credit card online is just asking to be screwed ).

    Really the best route for this is to disallow remote XUL execution by default with an option to enable it in the prefs with a list of trusted XUL sites.

    --
    "Fighting the underpants gnomes since 1998!" "Bruce Schneier knows the state of schroedinger's cat"
  29. what? by Ender+Ryan · · Score: 4, Insightful
    Seriously, people have been doing this sort of thing for years, with every browser. This one happens to be a bit more ambitious than most, but I've seen the same thing done with IE in the past.

    I've never heard anyone say it was MS's fault that people can make a convincing fake browser interface to fool people. Hell, all of slashdot has discussed this type of thing before, with the old ads some companies made to look like popup dialog boxes. Those fooled a lot of people, but I've never heard anyone say it was MS's fault.

    But there's a very simple solution, and I can explain it in one sentence.

    Never let anything, popup windows, javascript, etc., hide any part of the browser interface.

    That's it. 100% solution to the "fake browser interface" problem. In fact, Firefox already has that partly covered, "Allow scripts to: [*] Hide the status bar" => "Allow scripts to: [ ] Hide the status bar". That setting should default to unchecked, and it shouldn't be user-modifiable. On my system, I immediately saw a double status-bar. But that's not enough, the menu bar and browser controls shouldn't be hidable either.

    --
    Sticking feathers up your butt does not make you a chicken - Tyler Durden
    1. Re:what? by irokitt · · Score: 2, Informative

      In Firefos, that would be Tools->Options->Web Features, and under the Javascript box use the Advanced tab.

      --
      If my answers frighten you, stop asking scary questions.
    2. Re:what? by bob65 · · Score: 2, Insightful
      Never let anything, popup windows, javascript, etc., hide any part of the browser interface.

      Exactly...I don't know why javascript even allows popup windows, or altering the browser interface. The browser should contain a save, self-contained viewport on the world wide web. Anything that a webpage does should *only* occur within the viewport.

    3. Re:what? by TheLink · · Score: 2, Interesting

      Heck, my excolleague has done similar things years ago too.

      He played a prank on another colleague that involved making the desktop background a centered image of a windows error message - one of those serious looking "illegal exception" things if I recall correctly.

      Naturally when the victim clicks on the OK or Cancel it doesn't work. Then the victim actually got rather worried...

      My colleague got pretty worried when I installed the bluescreen screen saver on his PC as an april fool's joke.

      I dunno about you but I sometimes find myself clicking the OK/Cancel buttons on example images on some websites. This even tho I set my personal colour scheme different from the normal windows standard (to intentionally help combat this problem).

      --
  30. XP SP2 does this by spideyct · · Score: 3, Interesting

    Good suggestion.

    Also, Internet Explorer with Windows XP SP2 will prevent websites from creating pop-up windows without a status bar, or with the status bar positioned off screen. Microsoft has recognized that the status bar should always be visible, I think the Mozilla/Firefox team should follow suit.

    http://www.microsoft.com/technet/prodtechnol/win xp pro/maintain/sp2brows.mspx#XSLTsection137121120120

  31. Why is this article specific to Mozilla? by jdkane · · Score: 3, Insightful
    I don't understand why this cannot be done without XUL/Mozilla. E.g. Why can this spoof not happen through Mozilla & plain DHTML (no XUL), or in IE too? Without XUL I can also pop up a new window without any chrome and then create my own fake chrome elements through DHTML (including drop-down menus, status bar acorss bottometc etc)

    What am I missing when I don't understand why this problem is specific to XUL in Mozilla?

  32. YOU CANNOT DO THE SAME THING WITH IE!! by skidoo2 · · Score: 4, Interesting

    At the risk of losing MASSIVE Karma points, I can't, in good conscience, fail to note that all of these claims that IE is vulnerable to this same type of spoofing are FALSE. You cannot create a fake browser window of ANY size or shape in IE with the same theme the user is employing for his or her desktop. This information is simply NOT available to IE's DHTML implementation. You can fool a retard with a borderless fake window, but you'll never guess my lime green ugly-ass color scheme is in place, and I **will** notice the rogue window.

    This is why the Mozilla vulnerability is so serious. You could fool even very experienced users. Like sysadmins who log in as root. :-)

    1. Re:YOU CANNOT DO THE SAME THING WITH IE!! by BabyDriver · · Score: 2, Informative
      I don't know about buttons (specifically sizes and graphics) but you can certainly adopt a users colour scheme by using colour definitions such as:
      ButtonFace - surface of 3d widgets
      GrayText - disabled text colour
      InfoBackground - tooltip background colour
      I belive you can use these either with HTML or CSS. http://www.blooberry.com/indexdot/color/uiname.htm lists 28 different "names", I havn't checked them all but I don't see any obvious ommisions.
  33. It's not that big a deal really by carlmenezes · · Score: 4, Informative

    What it does is mimic the interface of an UNMODIFIED Firefox. Install ANY exension that changes the menubar or toolbar and you'll notice all that gone in the new window.

    Heck, you don't even need to install any extensions...just customize your toolbar a little...place ANY icon after the help menu and try the proof of concept...it doesn't work - the difference is too obvious.

    Neat trick, definitely, but I don't see it as much more.

    --
    Find a job you like and you will never work a day in your life.
  34. XUL is bloated and slow by ngunton · · Score: 3, Interesting

    XUL makes these browsers unusably slow on older machines. I have to use Netscape 4.8 (which has its own issues, but speed certainly isn't one of them - it doesn't take 5-10 seconds to open a new window) in order to get acceptable response on my old 450 MHz desktop (which is, I might add, perfectly fine using ANY other application, including Windows 2000, IE, Apache, MySQL, Word and so on).

    I really think (as others have also mentioned) there is a lot of blinkered thinking when it comes to Open Source software, to the extent that people are starting to blindly ignore the flaws - these same flaws in Microsoft apps would be pilloried mercilessly, but here you see all kinds of "yeah, but" comments. I am not putting down OSS, but the XUL thing was a classic example of developers going away to make a browser, and coming back with a bloated, swiss-army-knife, can-customize-up-the-wazoo Internet Platform. I don't particularly care about changing the "skin" on my browser - all I want is a small, fast application that adheres to standards and is preferably cross platform. They could have gotten the cross-platform part by using something like wxWidgets. I thought Firefox was supposed to be smaller and faster, but unfortunately XUL still seems to be at its core. And for those who say "Well, why don't you go away and make your own browser" - I have other projects I am working on and don't have the time.

    And to all those people who say that I should just get a new computer - well, tell that to all the schools out there who have old computers donated for teaching the kids. Anyway, Why should I have to upgrade because of one application - a BROWSER of all things? Just a classic case of developers going over the top to prove to everybody just how smart they are and how generalized their code is. And what do you know, now we find out that there seems to be a darker side to all this customizable GUI code. Oh well...

    BTW, I don't hate Mozilla. This is a criticism of one aspect of the project that I think just went severely off-track with featuritis. The project is very worthy effort and I applaud the people who are making it, but these are just my honest thoughts on the matter.

  35. I wasn't vulnerable! by Dwonis · · Score: 5, Informative
    I couldn't figure out why I wasn't vulnerable, until I looked in my user.js file:
    // More DOM/JavaScript options

    // Make sure all pop-up windows are resizable:
    user_pref("dom.disable_window_open_fea ture.resizable", true);

    // Make sure all pop-up windows are minimizable:
    user_pref("dom.disable_window_open_f eature.minimizable", true);

    // Always display the menu in pop-up windows:
    user_pref("dom.disable_window_open_featu re.menubar", true);

    // Always display the Navigation Toolbar in pop-up windows:
    user_pref("dom.disable_window_open_featu re.location", true);

    That didn't prevent the statusbar hack, but it made everything else *really* obvious.

    Have a look at about:config. There's a lot of useful stuff in there.

  36. I use Opera by rd_syringe · · Score: 2, Insightful

    I've always known Mozilla to be less than the perfection that Slashdotters have paraded it around as. Now that all these security vulnerabilities are being discovered...well, nothing's changed for me because I use Opera.

    No pointless XUL, no reimplemented widgets, no cute little XPI spoofs. Just a native web browser that is the fastest and leanest out there.

    It's interesting to watch the conflicts of posters today. On one hand, they want to keep using Firefox and supporting it. On the other hand, they know that if this was an IE vulnerability, they'd be all over it and crying out about "why would anybody still be using IE, especially if this was known for five years!!"

    Just an amusing illustration of double-standards on some people's parts. Not everyone...just the hardcore zealots who like to post here. This trend of Mozilla holes is a nice way for them to gain a little perspective on the matter.

    Now, imagine if Mozilla had IE's marketshare right now! These holes would be blown apart by hackers, and I imagine dozens more would be discovered. Already, the trend is rising.

    1. Re:I use Opera by jesser · · Score: 2, Informative

      I just tested this attack in Opera. You're right, Opera does two things that make this kind of spoofing attack a little harder:

      * "Window handling" defaults to "Prefer pages inside windows", so when a site tries to open a new window, it gets an MDI child window. This isn't nice for web applications or users who don't like tabbed browsing, but it is more secure against spoofing.

      * At least in the default theme, if I do javascript:window.open("", "", "scrollbars=no"); void 0, the content area is indented by two pixels to create a 3D effect. This wastes a little screen space, makes it measurably harder to scroll using the scrollbar, and sites with black backgrounds like Slashdot ugly, but it makes it harder for a malicious site to spoof the menu bar.

      However, Opera is still vulnerable to a more serious hole that was fixed almost two months ago in Mozilla and reported to Opera in March.

      --
      The shareholder is always right.
  37. Uh-huh by Rie+Beam · · Score: 2, Insightful

    I'm running Firefox 9.2, and nothing happens. Guess I was smart in limiting what permissions Javascript has. Why exactly would you let Javascript do all the things it can do, when you have the option to disable the most pesky ones in Firefox? All I'm saying is, people are making a bigger deal out of this than it really is. Just make all releases have minimal Javascript settings by default, and then make the user activate the more spoofable settings (alter window size, hide status bar).

  38. Bad, but not as bad by jhylkema · · Score: 2, Informative

    Okay, so somebody essentially builds a Javascript replica of the Firefox browser which activates as a popup when somebody clicks on a link. For this, the Mozilla folks are being raked over the coals. This is like saying a bank vault is insecure because it can be breached with explosives. Any browser could be spoofed this way and this has been going on with IE for a long time ("Your computer is infected with spyware, click OK to install more spyware^W^Wour software.")

    Granted, I'd like to see it more secure by default , e.g., it doesn't install software by default, Javascript disabled, etc. This also isn't uniquely a Mozilla problem as the first versions of Red Hat shipped with telnet and rlogin ports open by default. It all goes back to the age old debate about security versus functionality.

  39. Javascript issue by HermanAB · · Score: 2, Informative
    This is a Javascript configuration issue.

    As others have mentioned, you can change the Javascript behaviour to ensure that all new windows will always retain their title and control bars. Consequently it is amtter of configuring your browser properly.

    The FF team made an admirable effort to come up with a default configuration in prefs.js that mostly works and adding a few lines to it is a matter of concientious system administration.

    My son told me he did a screen capture on the computer of his comp sci teacher, then installed it as a background and had the poor guy futz around for a long time trying to figure out why all his icons and taskbar is dead - we cannot honestly say that such an exploit is a bug in Windows now can we?

    --
    Oh well, what the hell...
  40. Thing is........ by CrazyTiger · · Score: 2, Insightful

    No matter how much we beef up Firefox's impressive security,we can't do a thing to protect it from idiotic users who click first and ask questions later.Nothing can protect idiots from themselves. As for Mozilla ignoring the bug,they might've though it could've been something mebmasterse could do to enchance their pages.Now that people are taking aadvantage of it,they announced it as a bug. For example,if you made a browser,you might want to allow Javascript to change the background of the UI.Except that nobody decent does it,and those who do cover the UI in pornography and/or ads.So you plug the hole.

  41. Re:XUL is a bad idea by mcsmurf · · Score: 2, Interesting

    The idea was/is: If you focus on web browsing only, you always have to see what other browsers (esspecially IE) do and always jump after them if they create some cool new thing or introduce a new successful tag (also it's not in the specs). So the idea is to create a surplus value like XUL in combination with other things, like access to Mozilla internal interfaces or RDF,XUL,SOAP,XML support, which makes it easy to create some web-apps (a application development platform). So here you are the challenger then and don't have to follow the other browsers all the time.

  42. Re:Holy Shit by HermanAB · · Score: 3, Informative

    Try this, it mostly works:
    ./.mozilla/firefox/default.flc/prefs.js
    user_pref("dom.disable_window_open_feature.locat ion", true);
    user_pref("dom.disable_window_open_feature.menub ar", true);
    user_pref("dom.disable_window_open_feature.minim izable", true);
    user_pref("dom.disable_window_open_feature.resiz able", true);
    user_pref("dom.disable_window_open_feature.scrol lbars", true);
    user_pref("dom.disable_window_open_feature.statu s", true);

    It is only the last line that seems to be buggy, since the status bar still gets overloaded.

    --
    Oh well, what the hell...