Slashdot Mirror
IE Vulnerable to Cross-Browser Spyware Attack
An anonymous reader writes "The Register reports that Firefox can be used to infect IE on Windows. By visiting a malicious site with Firefox, a user can infect their install of Internet Explorer. Other alternative browers may expose the same vulnerability. The article quotes the CTO of ScanSafe as saying that '[j]ust switching away from IE does not give adequate projection. Now that Firefox and other alternative browsers have a toehold in the market the hacking community will get busy exploiting the vulnerabilities that exist in any complex browser.'" VitalSecurity's report points out that this vulnerability can (only) affect Windows users who use Sun's Java Runtime Environment.
IF you're running Java and you click 'Yes' to the security warning...
The spyware installs itself using Java. It's not browser-specific; you can infect IE using Mozilla, Opera, IE, etc.
There _is_ a dialog box, since the applet is unsigned. I tried signing it with my certificate; it installed itself without prompting. I believe it uses some sort of JRE exploit.
It's important to identify that if this is not a browser thing, but a Sun JRE thing, any Java-enabled program that can come in contact with the installer applet could potentially infect your system.
Green's Law of Debate: Anything is possible if you don't know what you're talking about.
By visiting a malicious site with Firefox, a user can infect their install of Internet Explorer.... VitalSecurity's report points out that this vulnerability can (only) affect Windows users who use Sun's Java Runtime Environment.
So, the attack happens through Sun's JVM, affects IE, and consequently has nothing to do with Firefox, which was inserted into the article for maximum troll capability.
As has been mentioned before on Slashdot, the new versions of Flash come with the Yahoo! toolbar also.
Game! - Where the stick is mightier than the sword!
Actually, it's possible. It's not particularly easy, but it can be done.
When I tried to open the page he shows as the source of infection, my TrendMicro Antivirus Software automaticaly detected it and trashed it.
What scares me most, is that FF didn't ask to download the file, it just downloaded the JAR into the cache folder.
mazevedo
It doesn't "escape" the sandbox... the user explicitly grants it permission to play outside of the sandbox.
Java is behaving in exactly the manner it's designed and advertised to act.
the installer escapes Java's sandbox
No. The user unlocks and opens the door, THEN the exploit escapes.
All the systems are working as designed. It is the user who opens the door.
- - - - - - - - - - -
I am a programmer. I am paid to produce syntax not grammar. Deal with it.
This has nothing to do with Firefox or the JRE, nor IE. The JRE's security manager properly issues are warning that the user is about to run arbitrary code. It's like an email worm. The user's interaction and ignorance is need to spread the thing.
There are two types of Java applets: signed and unsigned. Unsigned applets run in a sandbox inside your Web browser. A Java exploit would be an unsigned applet that could "get out" and do something malicious. This doesn't seem to be an unsigned applet.
Signed applets don't run inside a sandbox. A signed applet can do anything that any other executable program can do; including formatting your disk or installing spyware. They are not any safer than programs written in C or assembly language.
--Steve
I included in mine a link (off the VitalSecurity page, but still ...) to a discussion thread that indicates Opera was not vulnerable. I wasn't able to get the warning (nor the attempt to install) using either the release nor beta versions of Opera for Windows.
As well, I was able to prevent infection attempts in FireFox by blocking connections to *.ysbweb.com. [your search bar]. (The Proxomitron is your friend.)
The company that signed the applet is "Integrated Search Technologies", which is apparently targetted by several anti-spyware programs.
Its Java, nothing to do with FireFox.
You missed the part where IE opened on its own. Unless you have REMOVED IE from your system (good luck) or never had it in the first place (ya, ya, Mac and Linux and BSD are great) then you care about this.
No the prompt was from the JRE indicating that the applet that was being downloaded was asking for special privileges, beyond that of the sand box (see the picture in the middle of the Vital Security article). 3 excalimation marks, big and yellow, telling the user that it couldn't verify the authenticity of the applet, that the cert used to sign it had expired and then warned the user specifically to NOT say yes.
The idiot said yes anyway.
Now, if this happened without those warning, then there would be an issue. But that is not the case. The JRE functioned as it was designed to - to allow for extra privileges to be granted to an applet under certain circumstances and to vigorously warn the user and present them with information before hand. It was the user that ignored the warning, not the JRE.
Note to self: never get advice from "Vital Security" about security because anyone that would ignore that kind of warning from a site they did not know is definitely NOT a security professional
Never by hatred has hatred been appeased, only by kindness - the Buddha
Java applets can do all sorts of things.
It is not true that they can't 0wn your box.
In fact, whoever told you that should be shot.
Java is very powerful, and can do many, many interesting things.
If it works properly (i.e. no exploits), than a Java applet will not be able to silently 0wn your box.
It'll request permissions, and you'll have to approve it.
There are two possible circumventions.
1. Set system-wide permissions too low. By default, they come pretty restrictive. I would not suggest changing them.
2. Exploit in the JRE. Has happened before (rarely). This doesn't count.
Java is not a pure safe language. Java does not run its applets in an entirely isolated Virtual Machine.
Java, however, does not experience buffer overruns (which lead to exploits), and does not experience a variety of other security problems.
No exploits != No 0wnage.
No explots = No 0wnage without requesting securityt permissions.
WhiteWolf666 an exBush supporter. All you new-school,compassionate,save the children Republicans can rot in hell
Actually, the three magic fingers doesn't do what its supposed to anymore. You can now create a virtual desktop, and do whatever you like with that key combo. I read about it in DDJ. MS is happy to have made it, since it makes the kiosk software people happy.
and Re: the script: devilishly clever, sir.
The previous sig has been removed due to
In response to the other responses....
Sorry for the oversight - this has nothing to do with SSL. The browser is prompting the user, stating that the authenticity of the cert can not be validated and is asking the user whether the applet should be trusted anyway. The user is not being asked whether the applet should be trusted with elevated privilege to install software. In fact, in Firefox certificate trusts and software installation trusts are two seperate configuration spaces. Even if the user read the firefox documentation, they would expect to be prompted explicitly for software installs, independantly from certificate issues. There is no mention of privilege or software installation on that dialogue.
My expectation for an applet with a bad cert trying to install software is to:
1. Prompt for trust of certificate
2. AND prompt for permission to install software
My expectation was that trusting this certificate will:
1. if defined in Firefox's Software Install config, run under configured settings for that particular domain
2. OR prompt for further privilege (to install software)
Users are also so used to ignoring certificate problems for SSL sites that the user will always ignore certificate problems for sites that they do not trust. Users do not care if confidentiality and/or integrity of communications with an untrusted site are compromised as they don't really trust the communication to begin with. Users assume (as they should) that attempts by untrusted sites to do anything which may violate security will be prompted for or denied by default.
The notice that Firefox has stopped the installation of software will be disregarded by the user as the user will believe that the installation has been blocked and can only be unblocked by right clicking on that notice. The dialogue with which the user is interacting will not be assumed to be related to the notice that installation of software was prevented.
If it is the case that trusting the applet by providing a positive response to this dialogue results in the applet running outside of a sandbox, I would argue that the dialogue is misleading and extremely dangerous. In this case the dialogue must be changed to be more clear. The dialogues presented by Firefox (or the JVM?) are completely inadequate and must be fixed. Claming that everything is working fine is rediculous if the guy only accepted the dialogue as shown in the screenshot. The user is not at fault.
Further, assuming that there was no certificate problem (eg if the attacker had a Verisign certificate), would the user have been prompted with anything? I certainly would not expect that anyone with a Verisign certificate has an ability to run applets at elevated privilege without me being prompted by my browser. If browsers/JVM will run all signed applets at an elevated privilege I would consider that a major vulnerability and a completely bone headed design. I don't think that this is the case and expect that the user would have to define the host as being allowed to install software in the Firefox configuration.
W.R.T. the security professional comment... few except for those professionals who have in depth experience with applet security would know to have expectations other than those which I described in this message. One can not be an expert in everything. I would suggest that you meant that anyone who would ignore that kind of warning from a site they did not know, on a box they care much about, is definitely NOT a security professional.
Erm, it took about a week for a trojan which intercepted the ctrl-alt-del to come out.
I am trolling
There's actually a solution for that, too. One relatively painless Firefox extension install, and you no longer have any need to keep IE on your computer. Now, granted, you might say that you don't trust WindizUpdate; on the other hand, though, do you trust Microsoft?
When I visited http://www.lyricspy.com/ (this site listed as being the origin in the VitalSecurity story) I immediately receive a pop-up warning from McAfee 8.0 that the file "javainstaller.jar" is a Trojan, and an "exploit". The installer window never appears at all.
Additionally, Firefox automatically blocks the installation with its pop-up blocker, so it appears that, with my settings (which are not terribly restrictive), I have a double layer of security preventing me from even getting to the point of clicking "yes" to the installer.
Not too big a deal, this, but it is good to know that following basic security procedures like keeping virus definitions up to date and using the pop-up blocker correctly can make it a lot easier to avoid the kind of crap this story deals with. I do realize, however, that a great many people do not follow these guidelines, and that that is the point of the story.
But I would like to point out that it seems that I am not quite as vulnerable as this story makes it appear that I will be (when running Windows). And, of course, if I flip over to my Fedora Core 3 partition, this problem goes away entirely.
And yes, I am using the Sun Java Runtime.
B
"We must still have chaos within in order to be able to give birth to a dancing star." --Friedrich Nietzsche
If you actually take the time to read the details of the McD's suit you'll see that the franchise in question was serving coffee at a temperature way way above what any reasonable person would consider acceptable.
A) I routinely boil up some water in the kettle, pour it into a cup, put hot chocolate mix in it, and hand it to someone. I expect a sane, mentally competent adult to realize that hot drinks may be hot at first. Somehow, for thousands of years, adults have managed to deal with the concept of hot drinks. The McDonalds incident wasn't even boiling -- it was *colder* than what I'm talking about.
B) There are a ton of people that eat at McDonalds who *didn't* find the coffee "way above what any reasonable person would consider acceptable" -- including this woman, if she'd ever had a McDonald's coffee before.
C) They had received numerous complaints about it prior to the incident
They're McDonald's. They're enormous. They have complaints about coffee being too hot, meat not being kosher, coffee being too cold, a lack of Italian buns, and so forth. It would be unusual if they had *nobody* mentioning it.
They had received numerous complaints about it prior to the incident, and the woman who was burned by the coffee received severe 2nd and 3rd degree burns.
And if you were familiar with the case and were being honest, you would have mentioned that all the *other* coffees from the *other* fast-food places caused the same burns -- it's just that McDonald's, being the hottest of the temperature range by ten degrees, did so faster.
I provide this info for other readers who may not know the details of the case but love to point to it as an example of a justified lawsuit when in fact it is completely frivolous.