Spoofing Flaw Resurfaces in Mozilla Browsers

GregThePaladin writes "A 7-year-old flaw that could let an attacker place malicious content on trusted Web sites has resurfaced in the most recent Firefox browser, Secunia has warned. The flaw, which also affects some other Mozilla Foundation programs, lies in the way the software handles frames. The applications don't check whether the frames displayed in a single window all originate from the same Web site." Commentary on this at whitedust as well.

Comments

So secure

[Anonymous Coward]

Oh, damn IE for being so insecure. Wait, this is about an Open Source browser---damn IE for being so insecure!

Re:So secure

[ZephyrXero]

" Oh, damn IE for being so insecure. Wait, this is about an Open Source browser---damn IE for being so insecure!"

There will never be such a thing as a 100% secure browser. It's all about which one is "more" secure... Even with the holes found in Firefox it's still many times safer than IE. Not only that, but these holes are usually patched in a matter of days, while with MS your lucky if it gets fixed in a few months.

Re:So secure

[camcorder]

You can dump FireFox if you want not to use it because of security problems. But what's your chance with IE?

Re:So secure

[beuges]

I wonder if the comments in this article will be of the same tone as the comments posted in this article.

*waits for the flamebait mod

Re:So secure

[Anonymous Coward]

IE has the same flaw also, so parent should not be moderated as funny, but as informative.

http://secunia.com/advisories/11966/

Re:So secure

[rbochan]

Indeed it does. I just found that to be the case on fully updated/patched Win2k and 9x systems when I just tested them.

Re:So secure

[Mant]

IE has this issue, want to bet which browser will fix it first? (hint, Mozilla fixed it before)

Re:So secure

[NekkidBob]

"Not only that, but these holes are usually patched in a matter of days, ..."

Except this one which has been around for 7 years. Come on, this is a well known, 7 YEAR OLD vulnerability, why the hell did it make it's way back into Firefox/Mozilla? Don't get me wrong, I use Firefox all the time (using it now to post), but this is pretty bad when they code a known, 7 year old vulnerability back in.

Re:So secure

[VitaminB52]

You can dump FireFox if you want not to use it because of security problems. But what's your chance with IE?

That's funny. I, and millions of others, use Firefox on Windows. So, what exactly are you talking about?

What camcorder is talking about is the inability to deinstall IE - you can deinstall FireFox without any problem, but you can't deinstall IE.
That is, you can not remove IE without breaking some Windows functionality that shouldn't depend upon IE to start with.

Re:So secure

[CoolVibe]

Use konqueror instead then. It's not affected by this :) (oh, and it's open source too)

Re:So secure

[Fareq]

Indeed, you've hit the primary security reason that I exclusively use FireFox.

If FireFox gets destroyed somehow through a collection of malware, I've lost a browser, which I could uninstall and reinstall -- and if that doesn't fix it, I could use another browser like Opera or something until I had time for a system rebuild.

But if I lost IE severely enough, the entirety of the OS could blow up on me...
I mean, practically every recent OS feature was built on top of IE. If you lose IE, you can't:

Use System Restore. Use Remote Assistance. Use Windows [not-so-helpful] help. Use Windows Update.

If you lose it really badly you also can't:

Use Windows Explorer or open any directory windows or visually access your desktop.

Re:So secure

[Punkrokkr]

The spoof affects IE as well. I'd be interested to see who fixes it first, Mozilla or Microsoft. From the article, it seems that this spoof was orginally found in 1998.

Re:So secure

[geekee]

"There will never be such a thing as a 100% secure browser. It's all about which one is "more" secure..."

How do you define "more secure"? How do you even know how many holes are in IE vs Firefox. You don't. The best you can say is neither is secure. Saying one is more secure than the other is irrational.

Re:So secure

[jrockway]

> Saying one is more secure than the other is irrational.

No it's not. Saying one is more secure than the other is simply making a comparison. What does more secure mean? It means less security holes, and less severe security holes. Let's say we have two browsers, exactly the same, except one, when it sees a <command> tag, will execute a shell command. Which is more secure!? (Answer: the one that doesn't execute commands from the unauthenticated network!)

And in reply to the GP. You can have perfectly secure software. Just because people are too lazy to write it doesn't mean it can't happen. Mozilla is just garbage code on top of the garbage Netscape code on top of the garbage Mosaic code. Not the way to go for security. (It works, though, and that's what most people care about.)

If someone had the time, money, and willpower to redesign a modern browser from the ground up, employed the absolute best coders and did regular thorough security audits, then we could have a perfectly secure browser. But I guess we don't need one badly enough. (I think I could do it, but I don't have the time or energy to do it. But I'm sure someone else does.)

Re:So secure

[corpsiclex]

its the holes that are not found in firefox that worry me.

Re:So secure

[ZephyrXero]

I'm not being irrational. Let me give you an example. I am the sys admin for a small network at a university. I have made all the faculty in my dept. switch over to firefox, and some to thunderbird as well, and I don't have to go around once a week getting rid of viruses, spyware, and adware like I did when they were all using IE. They don't have installation privaleges on their accounts, yet somehow these things kept getting installed till I made them start using Firefox. That's what I call a "more secure" browser...

Re:So secure

[plover]

You said, And in reply to the GP. You can have perfectly secure software.

I have to theoretically disagree with you.

From a logic perspective, this statement is the equivalent of trying to prove a negative. The best you can say about a piece of software as complex as a browser is that "nobody has published a break yet in this exact version running in this environment on this operating system."

You can have "pretty good" software, you can have "excellent" software, you can even have "never, ever been broken" software, but you can't have "provably perfect" software in all but the most trivial of cases, (and even then things are suspect because of other potential issues: BIOS reliance, hardware manufacturing defects, etc.)

Streetlight software is a great example. It's about as close to a "perfect software" case as you can get. It's small enough that you can examine the entire state engine from end-to-end, and have peers examine it as well. Even so, they still have a separate set of monitoring hardware and software with the authority to shut the system down, because if that software breaks people could die.

Nothing's perfect.

Re:So secure

[pthisis]

You can have "pretty good" software, you can have "excellent" software, you can even have "never, ever been broken" software, but you can't have "provably perfect" software in all but the most trivial of cases, (and even then things are suspect because of other potential issues: BIOS reliance, hardware manufacturing defects, etc.)

I agree with you on the hardware.

But provable software can exist beyond the trivial. See, e.g., the FOX project at Carnegie Mellon University which has implemented an HTTP server, packet filters, etc in ML, all (mathematically) proven correct.

Proving results about larger software is made much easier by doing strictly functional programming in strong statically typed languages, hence their use of ML.

They've even done research on proof-carrying code, where foreign programs come distributed along with proofs of their behavior that are verified before running them.

Now, there are some caveats:
1. You can prove that certain conditions aren't violated, or that others are always met; whether that spec meets your definition of security is up to you.
2. The FOX verification relies on the correctness of the underlying OS. There's no reason in principle that you can't write a verified OS, but it's not yet been done. (verifying a special-purpose OS may suffice for some purposes).

But the situation is nowhere near as dire as you make it out to be.

Exploits?

[/ASCII]

The number of Firefox vulnerabilities that have been exposed is frightening. But I wonder when the first actual exploit will be found...

Re:Exploits?

[strider44]

It is very unlikely that this would really be worth exploiting. It relies on the person opening this up in a new window (not a tab), leaving it open then coming back and clicking on another link. The links have to be clicked first one then the other.

Before anyone could think of a way to exploit this this'd be fixed I think.

Re:Exploits?

[/ASCII]

Got any links to sites describing real, live firefox exploits and the problems they've caused?

Re:Exploits?

[ZephyrXero]

frightening??? I'm a big fan of open source, and i'm actually pretty amazed the number has been so small. It's just about the first open source program to really become popular and I think Mozilla's doing a damn find job of keeping up with the hax0rz...

Re:Exploits?

[unformed]

Did you even read the article?


NOTE: Exploitation can easily be made "automatic". However, since this example only serves as a test to give users an understanding of how it works, we have chosen not to do so.

Regardless, I don't consider this to be too big of deal. Th exploit can be used for a phishing attack, when a trusted site is using frames. A nontrusted site then replaces one of the inner pages with a fake lookalike, but the user can't tell, becasuse the address isn't shown in the address bar.

Banks using frames for the trusted portion of their sites is extremely bad design, and I don't know of any that does that anyways.

Re:Exploits?

[rubycodez]

really? I'd say the number is very tiny given the size of the code. On the other hand, given the age and size of a certain other browser, the number of vulnerabilities and the number of known exploits is HUGE, as is the estimated cost of damage done to business.

Re:Exploits?

[dfjghsk]

first open source program to become popular? uhh... Apache?

Re:Exploits?

[bubkus_jones]

How about popular to the general public? That should be a more accurate description.

Re:Exploits?

[someone1234]

Reopening a 7 years old bug isn't quite keeping up with them. Unless you meant they provide target for the next generation.

Re:Exploits?

[4of12]

Got any links to sites describing real, live firefox exploits and the problems they've caused?

No, but I've heard innuendo describing potential exploits based on fairly contrived vulnerabilities in Firefox that have helped to slow the rate of adoption of Mozilla/Firefox as an alternative browser at MyCorp.

I've never experienced an exploit on Mozilla/Firefox or known anyone else to have experienced an exploit on Mozilla/Firefox.

That Mozilla/Firefox was even considered as an alternative browser by corporate IT was only because of some inescapable platform diversity, the discontinuation of IE for Macintosh, and the mind-numbing volume of exploits for IE on Windows.

No, I'm not in charge.

Re:Exploits?

[Ajmuller]

actually, the bank of new york, http://www.bnyonline.com/ does.

Yes, they suck.
No, i'm not a customer of theirs anymore.

Re:Exploits?

[Imagix]

"It's just about the first open source program to really become popular..." Never heard of Apache?

Re:Exploits?

[ZephyrXero]

You and I may have, but the other 99% of computer users probably haven't...

Re:Exploits?

[ASkGNet]

Didn't work for me, Firefox 1.0.4
Possibly because I have Tab Mix, and redirect all new window openings into new tabs - both windows opened in different new tabs.

what about tabs?

[farker haiku]

from TFA:
For a spoofing attempt to work, a surfer would need to have both the attacker's Web site and a trusted Web site open in different windows.

So, uh, what about tabs? 'Cause I never have 2 windows open at the same time.

Re:what about tabs?

[Punkrokkr]

I tried it in tabs, spoof does not work across tabs; just seperate windows.

Re:what about tabs?

[dan dan the dna man]

The Secunia test does not work if you open the sites as tabs as opposed to new browser 'windows'. Mind you this is the first time I've seen one of the Secunia advisories actually work on a machine. The potential for badness is quite high with this one methinks..

Re:what about tabs?

[MankyD]

'Cause I never have 2 windows open at the same time.

Unless they use JS to pop one up (and yes, there do exist scripts which will circumvent the built in popup blocker.) I suppose if you have JS and Flash disabled you all set in that case.

Re:what about tabs?

[farker haiku]

I use the tabbed browsing extension that disables all of that bullcrap. Find it. Love it. /too lazy to google it for you.

Re:what about tabs?

[AKAImBatman]

Tabs are a separate instance of the browser widget, and thus are treated as if communication was happening between separate windows. There's quite a bit of security in place that restricts when you can talk to another window. Frames are *supposed* to operate in the same fashion, but obviously have not been implemented as such.

Re:what about tabs?

[justforaday]

so if you're a user of tabs and not windows, you're safe

Just about says it all right there... : p

j/k obviously...or am i?

Re:what about tabs?

[maxwell demon]

It seems not even to work if the MSDN side is in another window, but that window currently shows another tab.

Re:what about tabs?

[digidave]

In that case this becomes nearly useless as an exploit. It's only good if the attacker can trick you into thinking you're at a site you want to input sensitive information on. If you're willing to type your bank login info in a popup window, you're going to get phished anyway.

Re:what about tabs?

[xenotrout]

I believe the issue was that a malicious site can pop up a window to control a frame in an already opened window. This will probably work with default browser settings. Fortunately for those in the know, there is a workaround--redirect ALL new window requests to tabs. Unfortunately this is a workaround and requires action on the part of the user.

Re:what about tabs?

[FrankHaynes]

Frames are evil! Tabs are kewl.

So, uh, what about "open software has bugs squashed quickly because so many eyes are looking at it all the time, everywhere"?

Whose eyes? And where are they looking?

Re:what about tabs?

[TheRealJFM]

I tried that, the parent poster is correct.

This means a simple work around is to install TabBrowserPreferences or any of the other extensions which capture new window commands and make them open in tabs.

I was already using this anyway, but if you're running in a corporate environment or something this could be a quick fix.

Re:what about tabs?

[whoever57]

I tried it in tabs, spoof does not work across tabs; just seperate windows.

In Galeon, it does work across tabs.

As I understand it...

[VxJasonxV]

If I understand correctly, this is like a cross site scripting (XSS) attack? But a malicious web designer can put a master frame with his code, and just put something inside like paypal?

Interesting. I have a dedicated profile set up specifically for private accessing (yes, I'm paranoid :P). I wonder how Firefox handles multi profiles, and multiple windows...

Re:As I understand it...

[cahiha]

But a malicious web designer can put a master frame with his code, and just put something inside like paypal?

Since he created the master frame, his URL, not Paypal will appear in the address bar.

The problem with this is that you go to, say, Paypal (assuming they use frames), and the malicious code can change what Paypal displays without changing the Paypal URL.

The exploit

[k4_pacific]

Type: Spoofing
Exploit: Local
Effects: All browsers

Description:
A 7 year old vulnerability has been discovered in multiple browsers, allowing malicious people to spoof the content of websites.

The problem is that the browsers don't check if a piece of black electrical tape is on the screen covering the address bar, which prevents the user from identifying the source of content in the browser window.

Successful exploitation allows a malicious website to load arbitrary content with its source masked by the black tape. The user cannot know if this is a trusted site.

Solution:
Remove the piece of electrical tape from the screen. Windex may be necessary to clean up afterwards.

Re:The exploit

[/ASCII]

Avoid using Windex on flat screens. It may damage the anti-glare coating. If possible, use only a damp cloth to wipe away any tape residue.

Re:The exploit

[Smidge204]

See, that would be funny, except the address bar shows the URL of the "trusted" site. Even looking at the source of an exploited web page does not reveal that anything is wrong.

If you have a "trusted" site open in one window, clicking on a malicious link in another window, can cause any frame in the "trusted" website to be replaced with a spoofed page. There are no clues in the address bar and it's not in the HTML source. The best I could do is, in FireFox, look at the page info box (Tools -> Page info) and inspect the information there... which worked for the example but may not be effective for a genuine and earnest spoofing attempt.

So yeah, hahaha.
=Smidge=

Re:The exploit

[whovian]

Avoid using Windex on flat screens. It may damage the anti-glare coating. If possible, use only a damp cloth to wipe away any tape residue.

Another way is to use eyeglass cleaning solution with a nonabasive microfiber eyeglass cloth. Great for coated glasses, great for LCD screens.

Re:The exploit

[Ninwa]

This isn't true for normal CRT screens though right? I've used Windex on mine for quite awhile and I havn't noticed anything except a clean screen. :]

Re:The exploit

[jp10558]

Ok, can someone tell me how to get this to work in Opera 8? Or does it not work? I use traditional MDI mode... I did try opening the MS site in another browser window - do I also have to have the secuna site in it's own window?

All that happened is the secuna site loaded new text in the secuna site window... nothing changed in the MS window.

Re:The exploit

[Kewjoe]

You can also use windex without ammonia

Re:The exploit

[StikyPad]

I realize this is way OT, but that's one of my biggest gripes about flatscreens. Would it really be that expensive to put a piece of glass in front of the display? No more worrying about damaging the display when cleaning smudges from friends touching the screen, or wiping off dust would be worth an extra $25 for me, and I doubt it would even cost half that for manufacturers.

Good the flaws are being found so quickly but...

[It doesn't come easy]

Recycling old bugs...I have to say that the Mozilla code base is losing some credibility with mistakes like this. Seems like a code audit is called for guys...

Crap. Most recent version of Moz suite is affected

[idontgno]

Am I remembering right when I recall that MoFo is pretty much end-of-lifing the Suite? I use Suite 1.7.8, and have no desire or intention of switching to Firefox and Thunderbird.

Is the Moz community going to release a fix for Suite?

Why - Oh why

[Anonymous Coward]

is it impossible to test new releases against old bugs?

Re:Why - Oh why

[/ASCII]

It is not impossible, Testing new releases against old bugs is called regression testing, and everybody pretends to do it. But the problem is that it is so boring and hard that very few people write working regression tests against the more complex bugs.

Automated Testing

[drewfuss]

Does the firefox community have any regression testing? They need fully automated test like the linux kernel has now.

Re:Automated Testing

[Spoing]

Does the firefox community have any regression testing? They need fully automated test like the linux kernel has now.

Automated testing is helpful, though mainly for known errors or conditions. It can be used to find some unknown problems, but it is not entirely effective at this class of problems.

Re:Automated Testing

[phlurg]

I wonder if open source contributers are willing to give testing the attention it warrants? After all, I often find it quite boring, and I do it for a living! ;) Most good developers seem to appreciate the value of unit tests, but tend to balk when it comes to actually pushing buttons manually.

I'm curious about the test process for open source projects, generally. For something as important as Firefox, I agree that some set of automated regression tests (where possible) to cover past exploits should be in place. Preferably system tests as well as unit tests.

That would be facilitated by some way to drive the browser via means other than actually moving the mouse (as is typically the approach of tools from big test vendors like Mercury, Rational, etc...) (I have little knowledge of Firefox internals, so I dunno whether that's possible.) If it doesn't exist, some sort of scripting engine to drive the browser would make an excellent test tool.

Re:Automated Testing

[ClosedSource]

"Automated testing is helpful, though mainly for known errors or conditions."

But in this case it was a known error. If the nature of the bug allowed it to be generated and verified using an automated test, you could add it to your regression test. Then if the bug showed up again, the regression test would catch it. This assumes that the automated test isn't dependent on the exact code snippet that caused the orginal problem but rather on the behavior.

Re:Automated Testing

[Spoing]

"Automated testing is helpful, though mainly for known errors or conditions."

But in this case it was a known error. If the nature of the bug allowed it to be generated and verified using an automated test, you could add it to your regression test. Then if the bug showed up again, the regression test would catch it. This assumes that the automated test isn't dependent on the exact code snippet that caused the orginal problem but rather on the behavior.

Yep. If this specific variation was a known problem, then automated testing would do the trick; there would be no release of the defect in a shipping product since the bug would be caught before it was released as a minor revision to normal users.

It all depends, though...as you likely agree; The test would have to handle all variations on frame types and presentation -- including seperate windows vs. tabs and a simulated 'real' network environment with both 'good' and 'bad' sites. Map it out for yourself, and I'm sure that you can see the list combinations for this one case start to be substantial.

Automated testing is great when your target doesn't move much. If it is dynamic or requires close integration with the test suite to cover special features, it becomes difficult to implement. In the worst case, your test suite becomes as large as the system being tested if not substantially larger.

Re:Automated Testing

[ClosedSource]

As you say, it depends on the nature of the problem. Not all bugs are specific to a particular variation so having one test case may still provide value.

Tough Issue

[Fade_to_Blah]

This is somewhat of a tough issue...because obviousely you can open up a spoofed page inside of a frame that looks like a legit page. However, there are legit reasons to open up other offsite content in a frame (take a look at ask.com...I believe they leave a frame up top to their site then open another site from there searches).

The best idea would to just get rid of frames completely, they suck.

Re:Tough Issue

[Fade_to_Blah]

Just had more coffee, ignore that post:)

Re:Tough Issue

[Anonymous Coward]

The best idea would to just get rid of frames completely, they suck.

That can't be done. It's like saying nuclear bombs should be gotten rid of cause they suck. Seems like a good idea, but as soon as one browser disables frames support, the other will use that advantage to steal market share. Just like if one country disarms, they leave themselves vulnerable to nuclear attack from the others! It's MAD. (Mutually Assured Dumbness)

Re:Tough Issue

[tomhudson]

Not everyone is comfortable running javascript on their local machines, so for them, no drop-down menus, no other fancy dhtml. To provide work-somewhat-alike functionality for those users, you either use framesets of you go back to the server for a LOT more stuff every click.

Its a compromise, and a safe one, because if they have javascript disabled, you can't inject the malicious frame.

Re:Tough Issue

[Mant]

Like much on the web frames are often used badly, but they can be useful for navigation.

Re:Old news.

[MankyD]

Frames suck, and you deserve to cause problems if you use them.

It's not about bad design inadvertently causing problems - it's about malicious code intentionally causing problems.

Not all Firefox users will be affected

[chesapeake]

The Debian package of Firefox 1.0.4, with the extension tabbrowser preferences installed isn't, for example. As a result of this extension, the frame isn't injected into the frameset that is being targetted, and is opened in a new tab instead.

It is surprising, though, that a security vulnerability like this goes unnoticed for so long. On the other hand, I very much doubt that anybody has actually used this to exploit users.

Re:Not all Firefox users will be affected

[Kiaser Zohsay]

Ditto for Windows, Firefox 1.0.4 + Tabbrowser Prefs 1.2.5. The injected content opens in a new tab rather than one of the MSDN frames. Since the behavior of this bug can be influenced by an extension, and it is a regression to start with, expect a patch very shortly.

The Tabbrowser Prefs extension r00lz. Don't leave your homepage without it.

Re:Not all Firefox users will be affected

[UfoZ]

Doesn't work for me either, with 1.0.2 and Tab Mix. (yes I should be running a newer version by now)

Ehmm.

[Psionicist]

Just one problem - the example "exploit" doesn't work. I press the MSDN link, it opens up in a new tab, press the demonstration link... And nothing happens.

So what do I do wrong?

Re:Ehmm.

[VxJasonxV]

It does work, just not for you.
It HAS to be in a new Window, period.

If you never have a second window, fret not, and don't be concerned about the vulnerability. It doesn't apply to multiple tabs, only windows.

*goes to reinstall TBE*

Re:Ehmm.

[gid]

You need to open up the msdn link in a new window, tabs aren't affected. Either way, this is a pretty useless exploit. I can't think of a single secure site that I visit that uses frames.

Re:Ehmm.

[cyberknutt]

But it does work in Internet Explorer!!!!

Re:Good the flaws are being found so quickly but..

[/ASCII]

Saying the bug resurfaced is not completely true. This bug was removed from the old Netscape rendering engine, and reintroduced when replacing it with the new and fancy Gecko rendering engine. Apache also reintroduced a number of bugs when switching from 1.3 to 2.0, I belive. That is one of the many prices you pay when rewriting old code from scratch.

It's bad

[hoka]

It's bad when a vulnerability listed in a few year old Hacking Exposed book scares me. I'd say that it would be a good start to use telnet for web browsing but even the telnet client I was using had a buffer overflow exploit. Le sigh!

Bunk commentary on Whitedust

[ttfkam]

The exposure of this older bug in new software is perhaps a good jumping off point for an argument about constructing new browser technologies from scratch, rather than simply developing existing (by the laws of probability, flawed) software to incorporate extended functionality; which is by far the industry norm as it stands. Is this a viable alternative?

Anyone that knows the history of the Mozilla project has to see the idiocy in this statement.

Or are they supposed to scrap it all and rewrite from scratch every few years? I sure hope not. Anyone else out remember M13, M14, M15, etc.? *shudder*

Re:Bunk commentary on Whitedust

[/ASCII]

When I read the article, I thought they meant the opposite. Since I belive the bug was reintroduced because large parts of the old Netscape codebase was ripped out and replaced with shiny, new and unsecure code, this arguments seems to fall flat on it's face.

Re:Bunk commentary on Whitedust

[KD5YPT]

I think its more of a trade-off argument. In one hand, rewriting the software from scratch pretty much guarantees that there will be bugs (maybe not a small ones). However, large software tend to be ridiculously hard to maintain and fix when there's a bug. I think what he meant was to recycle the codes and reorganize them once in a while (or I think that's a better idea).

Re:Bunk commentary on Whitedust

[kelnos]

Joel Spolsky wrote a pretty informative article about the dangers of software rewrites. He makes some excellent points (and uses Netscape/Mozilla as his example), though I do disagree that rewrites are *always* a bad thing. It's probably true that there's a strong tendency to pronounce old code dead prematurely in the OSS world, however.

Tabbrowser Preferences

[mogrify]

It appears that if you have the Tabbrowser Preferences extension installed, then this exploit doesn't work.

Re:Tabbrowser Preferences

[hey]

Does the code in your sig work?
I would think you'd need main() { exit(1); }

Re:Tabbrowser Preferences

[mogrify]

works for me... it'd be exit(0) for true, exit(1) for false, but it looks like it returns true by default.

Re:Tabbrowser Preferences

[Fenris Ulf]

That's implementation dependant, it'll be a random number on other systems.

Use { return 0; } instead, it'll avoid a possible function call of exit().

Re:Tabbrowser Preferences

[ajs318]

Re your sig: on my system the binary occupied 13784 bytes, 4296 after stripping, as compared to 16136 for the existing /bin/true. What's wrong with
echo -en '\x23\x21/bin/sh\nexit' > /bin/true
at 14 bytes? All modern sh implementations have true as a builtin anyway, /bin/true is only good to use as a default shell for users you want to give ftp access but not shell accounts to {you'll need to echo /bin/true >> /etc/shells and send SIGHUP to your FTP daemon}.

Re:Tabbrowser Preferences

[mogrify]

echo "main(){return 0;}" > true.c && gcc true.c -o true

Now it's perfect, unless you count these entries. I like the nostdlib one, but it seems like the sig should be comprehensible.

I don't think /bin/true has seen this much development for a long time.

Re:Tabbrowser Preferences

[arkanes]

Of course, depending your filesystem, it's pretty likely that you won't actually save any space going from 16136 bytes to 14 bytes. And while you (might) save some disk space, /bin/true now requires a shell invocation, which is an enormous performance penalty.

Re:Tabbrowser Preferences

[booyabazooka]

Same goes for Tab Mix. Secunia's link opens a new tab instead of a new window...

+1 confidence in Firefox

+1 free advertising for Secunia

Re:Tabbrowser Preferences

[Stauf]

It appears that if you have the Tabbrowser Preferences extension installed, then this exploit doesn't work.

I got it to work, as long as you make sure you open the exploitable page in a new window and not a new tab. I don't think the extension has anything to do with it.

Re:Old news.

[ZephyrXero]

it's actually nothing to do with malicious code...it's just that someone could make an easy fake site with frames... I'm sure there are some sites that legitimately use this feature with differnt parts of their site hosted on different servers...What's next? Ban sites that use offsite graphics?

Automated testing?

[Gary W. Longsine]

Does the Firefox team use any automated testing on the project? Seems like these sort of errors could stay dead, if so.

Software testing automation tools

Re:Automated testing?

[VitaminB52]

Does the Firefox team use any automated testing on the project?

Either they don't have automated testing, or they do have, but it didn't look for this bug.
Finding bugs (and squashing them) is a good thing, but I'm curious about how this bug got reintroduced in FireFox. I hope they analyse this problem, and improve their operational procedures to prevent other reintroductions of old bugs.

Re:Automated testing?

[Gary W. Longsine]

"What you don't know about testing, would float a battleship."

That might be true. I'm not sure the density of unthunk thoughts, though. Are they even liquid at room temperature?

Automated testing cannot prevent defects from recurring in subsequent builds as a pedantic interpretation of my passing observation might imply to a novice. I was sloppy with my terminology, yes.

However, automated testing can and does allow development teams to identify and correct defects which are accidentally re-introduced before they ship a new version with, say, seven year old security defects.

In the Java world automated unit tests are quite common, thanks to the ease with which they can be constructed with JUnit, and similarly with Python, Objective C and probably other Object Oriented languages and their respective unit testing frameworks. It seems to be less commonly practiced in the C/C++ world (although other types of automated testing are fairly well established in the commercial software industry and are largely language independent with respect to the product being tested).

With a feedback loop in the development/testing process one often sees Automated Unit Tests performing double-duty as a subset of what's normally called automated regression testing. Other types of defects might be caught with an external testing harness (e.g. WinRunner or MaxQ) typically employed in support of regression testing.

Some folks claim that application design can influence the ease and robustness of automated testing, and suggest design patterns to "Pattern your way to automated regression testing."

Heck, automated regression testing is even practiced by at least some folk in the visual basic world these days. (This commercial site has a nice summary of the practice.)

The point is, there are many types of automated testing, and many tools and techniques which support the concept. It seems from the perspective of a casually interested outside observer such as myself that some basic automated testing practices could be employed to help the Firefox team in their quest to create a secure, feature rich, standards compliant, and well performing web browser. I think most software developers, testers, and even development team managers would agree.

You'll be happy to learn that terminology in the testing world isn't as well established as it might seem at first blush. There are literally hundreds of different "types of testing" and you can find dozens of different and even conflicting definitions for many common types if you look a bit. So, if you seek to pick apart this post line by line I've given you enough material to do so. Just Google around a bit until you find a definition that doesn't fit those I've used and go to town.

Consider the Acid2 test. This is a functional test, perhaps. It might also be a regression test. It worked on the last build, and we didn't try to break it. Does it still work? Hooray! Acid2

Re:Crap. Most recent version of Moz suite is affec

[NoMoreNicksLeft]

This isn't Microsoft and Windows 2000. Of course they'll release a fix. In the year 2045, they might just tell you to upgrade though, even Open Source has its limits for supporting old software....

Re:Crap. Most recent version of Moz suite is affec

[VxJasonxV]

Suite will be EOL'ed, but security patches are still being applied.

IIRC 1.x is feature frozen, but still 'active'.

Disappointed in QA for browsers

[null etc.]

I must say that there should be a clean, concise list of security flaws that should never appear within a web browser, and each browser should be forced to undergo testing against that list before being released.

To have such fundamental flaws appear, whether by accident or negligence, is unacceptable.

Furthermore, the browser "industry" and the commercial sector NEED to come up with some guidelines as to how to promote and ensure online security for financial transactions and personal data.

For example, it's almost impossible for the casual or sophisticated user to easily determine whether a frame that appears within a website actually belongs to that website, or another. For example, if you have an online account with MBNA credit card, and make an online purchase, some vendors will display an MBNA authentication page which asks you to login to your online account to verify the purchase.

The problem is that this authentication page appears as a frame within the online vendor. How can you tell whether that frame is a legitimate MBNA page, or just a clever phishing attack? The browser gives no indication as to whether the frame belongs to MBNA or the vendor.

PayPal suffers from the same thing. I hate clicking on the "Make a Donation" button of some sites, and then seeing the PayPal login appear within a frame of the original site. That prevents me from making a donation - with today's complicated scripting invocations and what not, I don't feel trusting enough to type my account info and password into some frame which happens to appear in the middle of some other organization's website.

I can't BELIEVE that MBNA and PayPal would promote such idiotic practices, much less allow them to happen.

Re:Disappointed in QA for browsers

[fbartho]

I think the way that paypal expects sites to use their automated pages is to redirect the whole window, because at the end of the process paypal usually sends you back to a page on the original site, usually a thankyou/confirmation page. When people use the frames, they are probably doing it against paypal's directions, because otherwise, why would paypal redirect back to the original site?...

Re:Disappointed in QA for browsers

[supra]

To find the origin of a frame in Mozilla or Firefox:

• Access context menu for the frame (right click inside the frame
• select "This Frame"
• select "View Frame Info"

It gives you all the details.

Re:Disappointed in QA for browsers

[Joe Jarvis]

I must say that there should be a clean, concise list of security flaws that should never appear within a web browser, and each browser should be forced to undergo testing against that list before being released.

To have such fundamental flaws appear, whether by accident or negligence, is unacceptable.

Brilliant! We should dispatch this solution post-haste. And please, won't someone think of the children?

Re:Disappointed in QA for browsers

[kwoff]

I must say that there should be a clean, concise list of security flaws that should never appear within a web browser, and each browser should be forced to undergo testing against that list before being released.

To have such fundamental flaws appear, whether by accident or negligence, is unacceptable.

It's an open source project. Where are your patches?

Does it work?

[DuckofDeath87]

I tryed to test this spoof with the instructions from TFA, and I cannot seem to get it to work.
I tryed to open the links in tabs. 1st the MS one, then the Secunia, then the MS one again. Nothing out of the ordinary happened. The MS page showed up like it should, unlike the article said.
I also tryed it with tabs, but still nothing.
This is nothing more than BS spreading FUD.

(I am using Firefox 1.04)

Re:Does it work?

[ISayWeOnlyToBePolite]

Using mozilla (1.7.8-1 from debian sid) the spoof works when I open in a new window , but not when open in tabs.

Re:Does it work?

[AndrewR81]

Here's how I got it to work. From http://secunia.com/multiple_browsers_frame_injecti on_vulnerability_test/

0. First, close any MSDN windows you might have left open.

1. Right click on the msdn link, choose "Open Link in New Window"

2. Leave the new window open, and click back to the secunia example page.

3. Click the "Inject Secunia.com into Microsoft.com" link.

4. Look at the new window that opened in #1.

Not good. Using FF 1.04.

Re:Does it work?

[AndrewR81]

>Got three windows, two with secunia content, one with MS content.

I'm not sure why you have three windows. If this vulnerability works, you should have only two: the secunia test page, and the MSDN page with secunia content injected into the main frame.

Maybe you're opening the "Inject Secunia.com into Microsoft.com" link in a new window? Just left click it. Or maybe 1.02 isn't vulnerable.

Re:Does it work?

[kidgenius]

I'm using FF1.0 and not witnessing this vulnerability either. I am getting one extra Secunia page and one MSDN page.

Re:Does it work?

[AndrewR81]

Very strange! Maybe only some versions are vulnerable? According to secunia, Firefox 1.x is vulnerable (http://secunia.com/advisories/15601/). Maybe it's OS? I'm running on Windows XP SP 2. Maybe it's a FF setting? I can't recall having modified the default settings.

Here's a screenshot of how it looks for me.

Re:layout based on frames is bad

[ShieldW0lf]

Generally true. But a little clever scripting with IFRAMEs and you can make your AJAX work in older browsers, so they're not totally useless.

This isn't going to be a major issue for most...

[cianduffy]

Even -if- this gets exploited, it doesn't work cross tabs and it doesn't work if you more than one tab open in the window containing the 'trusted' site; at least not on FF 1.04 here on BeOS.

Now, how many FF users still browse with multiple windows and NO tabs? Anyone who found out about it the geeky ways uses tabs, and I should hope that the first thing you show any Joe Idiot how to do when you install FF on the machine you've just (been paid to) de-spyware is use the tabs...

Opera is looking...

[Anonymous Coward]

really good about now. Opera is the only browser I am aware of that has all *known* vulnerabilities fixed. Per http://secunia.com/product/4932/

YMMV, but methinks even though I use Ubuntu, I may make the switch to Opera for added security.

+5 Troll

[3770]

I wish I had mod points.

I'd help you on the way to be a +5 Troll (I'd just vote underrated).

While the language is harsh, you are right. Frames do cause problems.

They sound good, but they bring problems with them.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:Old news.

[Mr Guy]

You mean like "for the originating site only"

IE has this vulnerability

[interJ]

See here.

The bug in IE was reported almost a year ago, and it is still unpatched.

The bug was reported in all major browsers (Mozilla and Firefox, Opera, Safari, Konqueror, IE), and was patched in all of them except IE. It has now reappeared in Mozilla.

Re:IE has this vulnerability

[Sheepdot]

It's not the same kind of thing, though, as this can be done with just one Mozilla/Firefox frame. It is somewhat similar.

Re:IE has this vulnerability

[Sheepdot]

Nevermind, I should have RTFA. Wish I could retract that comment now.

The reason why this hasn't been patched in IE and might never get patched in IE is because a user would have to be extremely stupid to not noticed the website INSIDE their other website. We've all seen this before, and occasionally deal with it from time to time. The only security risk here is having something like the "Help and Support Center" open in Windows XP and having IE or Firefox control the frames to try to load an application to your computer. If it's a trusted site, then it'll install without asking.

But then again, who here puts sites in "trusted zone" that have frames? I don't even put Microsoft websites in my trusted zones.

Re:IE has this vulnerability

[draed]

If you read the page on secunia that you linked, you would see that this *has* been patched more than 2 years ago.

http://www.microsoft.com/technet/security/bulletin /ms98-020.mspx

Also since IE5, there has been protection against this type of attack.

1. Click Start, point to Settings, click Control Panel, and then double-click Internet.
2. Click the Security tab.
3. Under Select a Web content zone to specify its security settings, click Internet.
4. Click Custom Level.
5. Under Navigate sub-frames across different domains, click Disable.
6. Click OK.

Re:Old news.

[unformed]

No, it's malicious code targetting spoofing trusted websites that use frames. No website should be using frames for the trusted portion of their site, IMO. That's bad design, and prone to phishing attacks on their customers.

Re:Old news.

[tomhudson]

Not only is it "old news", but it's also inaccurate. There's a big difference between spoofing a site, and actually "placing malicious content on trusted web sites". One is a browser attack, the other a server attack.

So why can't we get a plug-in to spoof primidi org (Roland Piquepaille's whore "technology site"), for those who can't edit their host file. Not all spoofing is necessarily bad, you know.

Trusted and untrusted sites?

[Gary W. Longsine]

From TFA:

"For a spoofing attempt to work, a surfer would need to have both the attacker's Web site and a trusted Web site open in different windows. A click on a link on the malicious site would then display the attacker's content in a frame on the trusted Web site, Secunia said. The company advised people not to visit trusted and untrusted Web sites at the same time."

The whole notion of a trusted web site is bogus. Many large and popular web sites are not maintained well enough to prevent them from getting defaced now and then.

The whole terminology used for web sites belies the myth of a trusted web site.

Web sites are placed on "sacrificial hosts" in a "DMZ". Web sites are not trusted by the people who build them and never have been. If the owner of a web site doesn't trust it, why should you?

A victim would never need to visit an "untrusted" web site, because this defect could be coupled with others (exploit chaining). It's even been done before with other defects, notably Download.ject.

Before (and after) you start yelling at Firefox..

[ilyanep]

Now...take how many bugs have been exposed in Firfox and how many have been exploited.

How many bugs have been exposed in IE and exploited? (Especially because for IE it's almost a 1:1 ratio)

tabbrowser extension

[fbartho]

ever since the article appeared out of the near future, (5-10mins) I've been trying to get it to work, turns out that the tabbrowser extension prevents the exploit from occurring because it rewrites the target attribute

Is it a bug?

[burnin1965]

Is this truely a bug?

I tried the exploit with a W2k box that has IE Version 6.0.2800.1106CO with SP1 and several Q### patches installed and it produces the same result.

I see how this could be used as an exploit but is it really a bug? I have written code for a game website which used multiple windows with frames and the information in the frames came from two different web servers. Yeah, I know, it sounds like a web surfing nightmare, but fret not, it was an experiment. But my point is that this may not actually be a bug, and may be an issue to consider when creating a secure website. In other words, as others here have stated, don't use frames! ;)

burnin

problem not described quite correctly

[cahiha]

The applications don't check whether the frames displayed in a single window all originate from the same Web site.

And they shouldn't check that because often frames do not originate on the same web site (e.g., Google, Hotmail). The problem is if you try to frame something low security inside something high security; the other direction is OK.

What they should check (according to Secunia) is something different: when code attempts to put content into a target, the browser should check whether that code actually created that frame and otherwise refuse.

A simple way of fixing this problem might be to prefix the name of any frame with the host that created it, so that "target=foobar" actually means "target=www.host-of-this-page.com::foobar"; that also helps avoid confusing name conflicts between web sites. But that suffers from the same problem as anything else that relies on host names: you can't tell which ones are supposed to "belong together".

Alternatively, you might require that if any frame in a window uses https, then all of them must, and they all must use the same certificate.

The best solution is probably just to abolish frames altogether; they cause many other problems as well.

A slightly less drastic solution would be to prohibit the display of any https content in a frame.

Re:Old news.

[MankyD]

The problem is not offsite graphics. The problem is controlling one webpage with an offsite webpage. This should never ever ever ever be allowed for obvious reasons. From TFA: "As a result, an attacker could insert content into a frame on a trusted Web site." (read that: "a website can modify the contents of a trusted website".)

There is absolutley no reason anyone should ever use this exploit for legitimate reasons. Yes, I can think of a few times it would be great if one website could help someone fill out another websites forms - but its not neccessary. If someone really wants to do that, they should attain permission and do it via GET or POST vars, or some serverside communication.

A website should still have control over what page is being shown in its frames, but not over the content of those pages directly.

you misunderstand the problem

[cahiha]

The problem is not that different frames can come from different sites. The problem is that one site can change the existing content of a frame that is already being displayed.

So, if you do banking in one window and you then open up a malicious site in another, the malicious site can change the content of a frame in your banking window. That's not "faking", it's something worse.

I can't think of a legitimate use for that "feature" in a real application, and the fact that it didn't use to work suggests that sites aren't relying on it.

Re:you misunderstand the problem

[shadow_slicer]

I was under the impression this only worked for frames in the same window..

Re:Who is behind these exploits?

[Datamonstar]

Let's hope so. I love it when the competition does most of the field research for me.

Re:Old news.

[Heisenbug]

Sorry if I'm misunderstanding you, but I think you have it backward. They're not saying that hack.ru could have a frameset that pointed to a frame with a real ebay page. They're saying that if ebay had a frameset, hack.ru could use javascript to insert itself as one of the frames. That is indeed a security hole -- unless you want to claim that it's one of those extra features that differentiates Firefox from Safari and IE ...

Affects IE, Firefox, Opera

[UnConeD]

If you had bothered to read the linked demo page you would know that the bug is present in IE and Opera as well.

I just tried it in IE6 (Win2K) and it works just the same as Firefox.

The only problem is that this feature (affecting the frames of one window from another) is actually used a lot, for example when pop-ups are involved. I know of at least one banking application which will break if they flat out disallow changing one frame from within another.

A better solution would be to only allow it for frames sharing the same domain, I suppose.

Re:Affects IE, Firefox, Opera

[Jondaley]

Yes, I was going to say the same thing - IE is affected also, so for those saying switch to IE is the solution, they should think about it some more...
(not that just because it works in IE means it shouldn't be fixed)

Re:Affects IE, Firefox, Opera

[chorltonian]

You can legitimately control the content of a window A, or a frame inside it, from another window B that was opened by window A via e.g. target="_new". In this situation, window B can use target="_parent" on a link, or target="", to affect window A's content. This vulnerability however describes a situation where a frame's content can be substituted from *any* other browser window that happens to be open. So a malicious site that happens to be open in one window can inject e.g. a spoof logon form, using a bit of javascript, into the content pane of a banking website that uses frames for layout and happens to be open in another window.

Re:Affects IE, Firefox, Opera

[fa2k]

I tried every combination of tabs and windows, and even opened the MS page twice (the text could be read that way) and the exploit didn't work in Opera 8.0 (Win2k) :)

Re:Affects IE, Firefox, Opera

[fa2k]

The MS page detects Opera, and serves the page with less "features", even when Opera identifies itself as IE, and that is probably why Opera seems to be unaffected by the bug.

Re:Affects IE, Firefox, Opera

[whitehatlurker]

I tried every combination ... the exploit didn't work in Opera 8.0.

Well, that could be because the flaw was fixed in Opera 7.52.

This might be a better indication of how Opera handles security. Other browsers also have a good record.

As opposed to say, this or that old browser.

And

[Safety Cap]

It is very easy for any page to "get out of a frame," so there is no excuse for web page designers to allow their pages to be framed.

Re:And

[Michalson]

So now every single page on every single website has to have a reload script to cover for a security flaw in one browser? Isn't that like saying every road should have big bouncy rubber guard rails because one retarded guy can't drive straight? The Firefox fanboys are really scrapping the bottom of the barrel to find a reason why it's anyones fault but their favorite browser.

Re:And

[Master of Transhuman]

"So now every single page on every single website has to have a reload script to cover for a security flaw in one browser?"

So now every single page on every single website has to have a script to cover for the myriad security flaws and lack of standards support in one browser?

IE.

Yes, Microsoft fanboy.

Alas, Frames aren't going anywhere.

[PHP Addict]

"...perhaps Mozilla should just take the lead on this and remove frame support entirely."

As much as I hate frames (oh GOD do I hate frames!), this would be a step back for FireFox and its proponents. One of the largest arguments for using non-IE browsers is compatibility with standards. Frames are in the HTML 4.01 standard, and therefore, removing support would be incredibly hypocritical.

Re:Alas, Frames aren't going anywhere.

[Frank T. Lofaro Jr.]

Don't allow frames to encapsulate a secure web site and unsecure web sites, and don't allow 2 secure pages with different certificates to share a frameset, ever.

Would this be enough? (I'm not sure)

Re:Old news.

[k-sound]

As usual there are some people who have to keep repeating the same stupid idea's.
Frames CAN be useful e.g. I made a management module a while ago with a javascript tree. If frames didn't exist that would mean the tree would have to be regenerated every time you click on an item. Without frames the app would have been slower and would have used a lot more resources.
Frames (iframes especially) are a great way to create a very dynamic web application without having to reload the whole page and waste bandwidth, processor time, ...
Or how did you think Gmail checked for new messages every $blah seconds. Other great examples of the use of frames are w3chools' tryit-editor or realtime previews of html used in CMSystems such as mambo

Like most people I greatly dislike websites that use frames form navigation menu etc. However just because something is often misused that doesn't mean we should ditch it altogether (no matter what Jacob fucking Nielsen says).

Open sores is bad

[tsa]

You see? Another security fault in an open sores program. This is what you get if you don't pay your developers. Opening the source so that everyone can see the flaws is just asking for trouble. I'm going back to IE.

Re:Open sores is bad

[sheepoo]

Please do! Open source does not need people who are not willing to put up some effort in fixing bugs for open source software (or at least be patient and wait for the fix) Go back to your beloved IE which still has multiple outstanding issues for well over last 4 years Happy Browsing :-)

The differance

[a_greer2005]

I see a differance between IE and Firefox in that most firefox flaws are discovered with theory and unharmfull proof of concept and quickly patched whereas MS doesnt patch any IE hole untill criminals have been activly using it for months, that is why I use Firefox (except when I use my Mac.)

Re:Old news.

[alexhs]

The problem lies in Mozilla naming frames globally and not one name set per tab.

If a site in one window has a frameset with "banner" "sidebar" and "main", another window can access that frameset.
A link in that other window with attribute target="main" will replace the content of a frame in another window.
That has nothing to do with being able to create a frameset with contents from heterogeneous locations.

Look at secunia test !

Interesting (somewhat edited) parts are :

from secunia :
<a href="(msdn)" target="_blank"> (opens a new window with msdn frameset in it)

from msdn frameset :
[...]
<FRAME name="fraRightFrame" src="(enter_your_credit_card_number)">
[...]

from secunia :
<a href="(thanks_for_your_card_number)" target="fraRightFrame">

Re:Old news.

[SubTexel]

lol.. Funny how when IE has something similar people point fingers at it saying how evil it is.. But when it happens to Mozilla or FireFox it's either a feature, or it's the users fault.. Oh the hypocracy... It tastes like burning!

Re:Crap. Most recent version of Moz suite is affec

[ajs318]

They will tell you to upgrade, and you will then have the choice: download and compile the full latest version, or cherry-pick and patch only the bits you really want to patch. Either way, you still need to recompile the app. This will not affect the copy of the application you are already running from memory: only newly-started browser instances will be "secure". I don't think a 10-year uptime is at all unrealistic, especially if you're running FreeBSD.

Open frame in new tab

[lanroth]

The problem is that this authentication page appears as a frame within the online vendor. How can you tell whether that frame is a legitimate MBNA page, or just a clever phishing attack?

I click RMB->This Frame->Open Frame In New Tab

As you'd expect this opens the frame in a new tab where you can easily see the URL.

You can also find information about an embedded frame by clicking RBS->This Frame->Frame Info

Re:Open frame in new tab

[null etc.]

I click RMB->This Frame->Open Frame In New Tab

As you'd expect this opens the frame in a new tab where you can easily see the URL.

I've tried this for a few sites, and most of them redirect the browser to a page where the whole frameset loads again. I'm guessing the referer changes when you use this option.

I do like the Frame Info option, though. I didn't know it existed, and it's quite useful.

Re:Old news.

[MankyD]

Fine, but its not bs. If a phisher opens up a frame and starts reading data you type into it, it's a problem. Yeah, an obervant/intelligent/aware individual might notice the address bar doesn't match, but lets not give your average use too much credit.

Re:This isn't going to be a major issue for most..

[Flinx_ca]

For this to work, 1) http://msdn.microsoft.com/library/default.asp must be open in another window 2) http://msdn.microsoft.com/library/default.asp must be the active tab in that other window i.e. top or visible It will not work if: 1) http://msdn.microsoft.com/library/default.asp is open in another tab in the same window i.e. non-active or hidden 2) any other site with frames is open in the active tab in another window (e.g. http://www.turtle-express.com/) For a successful phishing attack you must: 1) open your bank (or some other imprtant) web page in a new window 2) that web page must use frames 3) you must then switch to another window and surf to the attackers web page 4) the attacker must know which web site is open in the other window in order to spoof a part of it 5) the log-in page is the only non-unique page so even if the attacker gets past 1-4 you must have left the login page in the other window, otherwise yiou would know something has happened because the content would be different!

Re:Good the flaws are being found so quickly but..

[plumby]

That is one of the many prices you pay when rewriting old code from scratch

and not having an automated regression test suite.

Thank God!

[__aagmrb7289]

Thank God that we don't get as many security bugs as I.E., dontcha think?

Frame Information Box

[kassemi]

What about placing a small colored box in the corner of each frame... If a frame's box differs in color from the surrounding frames, this would indicate the frame was on a different domain. That way the developers wouldn't have to worry about breaking the legitimate use of this technique.

Re:Old news.

[Frank T. Lofaro Jr.]

Their test didn't work on my Firefox, it just opened in a whole new tab so it seems Firefox is safe, at least when configured as I have it.

I have new windows open up in tabs instead.

Perhaps my setup could be exploited a different way, I am not sure I am 100% safe, but at least the flaw can be sidestepped in some instances.

Re:Old news.

[VitaminB52]

WHO CARES, no one uses frames on their websites anymore, frames are obsolete

Gimme 1.00 $ for each website using frames, and 'll never have to work again ...

Re:Old news.

[BrokenHalo]

Are they talking about Google ads? E.g. if you go to this article, for the sake of example, you'll see a small Google text ad frame in the middle, for which there's no location showing in the status bar when you mouseover it in Firefox.

I try to block as many advertisers as possible, and I wasn't happy to see that slip through...

TabBrowser Preferences Prevents This

[ChadL]

If you are using the TabBrowser Preference extension for Firefox, the exploit site will just open in a new tab, and the MSDN site will remain unaffected. https://addons.mozilla.org/extensions/moreinfo.php ?id=158&application=firefox

Re:Old news.

[araemo]

Not only is it "old news", but it's also inaccurate. There's a big difference between spoofing a site, and actually "placing malicious content on trusted web sites". One is a browser attack, the other a server attack.

How about google image search? You have a frameset and one frame belonging to google.com, which most people allow to set cookies, and gmail users allow it a bit more in the way of scripts and such.. and you have a frame showing the page the image you just clicked on in its original context. If that original context had malicious code, and was running with google's security.. perhaps it could do some damage?

Re:What is the name of the developer...

[meringuoid]

Corporate types will want to know which developer it was who reintroduced this seven-year-old bug, and what the Mozilla Project plans to do to prevent a similar incident from ever occurring again.

Yes, we hear that all the time with the Microsoft products. Here, whenever a disastrous Windows bug allows worms to run riot, or drive-by spyware installs to devastate hundreds of desktops, we always ring Redmond and demand to know the name of the developer who introduced the bug, and what Microsoft plan to do to prevent a similar incident from occurring in the future.

Sometimes, when the guy at the other end of the phone has finished laughing, he tells us that Microsoft expect us to keep on writing them cheques.

Re:doesn't work here

[in4mation]

This sucks!!! It doen't work here either: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4
I'm too lazy to check it out...but does it only work on Windows? Or are all platforms affected? Or maybe its because I have the tab extension installed.

Re:Good the flaws are being found so quickly but..

[megarich]

It's open source, audit the code yourself you lazy bum!! :)

Re:Old news.

[alexhs]

I concur.

When opening in new tabs, "target" part of a link is ignored, so it won't work.

But you need to consider that secunia test is just an example, a real-life malicious exploit will probably use javascript, probably bypassing that tab setting.

New Frame Exploit Announced

[megarich]

This just in, putting your picture inside a frame may cause an unfavorable reaction to whoever is looking at it. The results can range from shreeks of horror, to nausea and an look of disdain on the viewers face. The fix is to burn the picture with the frame....

follow up

[5yph3r]

in a follow up with GregThePaladin, he stated that it would really only be likly to exploit this flaw if it were, some one on the inside

Re:Old news.

[2short]

"I'm sure there are some sites that legitimately use this feature"

No, there are not. This "feature" is not used because it has not existed for years; ever since it was eradicated from browsers because it's a nasty security hole.

It is actually something to do with malicious code. It is not about making a fake site, it is about letting you navigate to a real site (like your bank), without you ever knowing you are actually doing so in a frame. And it's about that frame containing javascript that is continually scanning the pages you're looking at and reporting stuff (like your password) back to the bad guys.

This is the first time...

[Spy der Mann]

This is the first time IN MY LIFE that I see a browser add-on INCREASING its security, and not otherwise.

(hypothetical) Secunia advisory

blablablah... bug.
Versions affected: Firefox v1.04 etc....
Workaround: Install the tabbrowser preferences extension.

w00t.

WTF? That flaw is flawed!

[todger]

WTF? This sucks more arse than something that sucks a lot of arse! The flaw is not apparent in my installation of Firefox 1.0.4 The frame opens in a new tab, not in the seperate window. The frame does, however, load across windows in IE6.

Mozilla/Firefox not the only ones...

[canofbutter]

I tried this in Internet Explorer 6 on a fully-patched Windows XP SP2 machine and get the same result. No idea why Secunia would single out Firefox/Mozilla on this one... Try it yourself

Re:Mozilla/Firefox not the only ones...

[WillAffleckUW]

I tried this in Internet Explorer 6 on a fully-patched Windows XP SP2 machine and get the same result. No idea why Secunia would single out Firefox/Mozilla on this one..

I guess we should just uninstall IE6 and Windows then.

After all, wasn't that MSFT's fix for a Netscape bug?

Re:Mozilla/Firefox not the only ones...

[julesh]

They aren't singling out Firefox. Read the text on the page you linked to -- they discovered it in IE on 2004-06-30 (i.e. nearly a year ago) and in Firefox on 2005-06-06 (i.e. yesterday), which is why it's news that it's happening in Firefox, but not news that it happens in IE.

The spirit of Captain Obvious lives on

[suitepotato]

For a spoofing attempt to work, a surfer would need to have both the attacker's Web site and a trusted Web site open in different windows. A click on a link on the malicious site would then display the attacker's content in a frame on the trusted Web site, Secunia said. The company advised people not to visit trusted and untrusted Web sites at the same time.

Gee, do you think?!

Who are these people surfing in multiple windows and tabs to trusted, sort-of-trusted, and untrusted sites simultaneously while doing critical transactions with personal information and finances? We need to know, we need to identify them, we need to prevent them from polluting the gene pool without having their common sense upgraded to "semi-conscious of surroundings" first.

Actually, I've seen people load their machines with cr*pware on "free" pr0n sites all day long and among the many open pop-up windows they've merely reduced to the taskbar, they open another IE session and start doing online banking. It makes me cringe.

Re:The spirit of Captain Obvious lives on

[aftk2]

Who are these people surfing in multiple windows and tabs to trusted, sort-of-trusted, and untrusted sites simultaneously

Perhaps the same people who thought that switching to Firefox would gain them greater security, thereby allowing them to do this?

Tried it.. FUD

[cybrangl]

Ok, I tried this with FF 1.04 and could not get it to work no matter what I tried. I tried both the using tabs and opening all links in new windows and I could not get it to work. IE, on the other hand, handled the exploit perfectly, thank god. At least I can still count on IE to run the flaw correctly.

Re:Old news.

[Chewbacon]

Apparently Microsoft still uses frames. Like many things in web design: if you use frames appropriately you can minimize problems. Think in terms of filling a page up with GIF animation. Keep it simple when you use those; otherwise I'll get seasick and puke on my keyboard.

Re:layout based on frames is bad

[De Lemming]

2) not able to bookmark properly

I don't like frames either, but Firefox's inability to properly bookmark sites using frames really irritates me. Because very occasionally, I want to bookmark a webpage which I didn't design myself :-) IE does implement this feature correctly. But the Mozilla developers don't seem inclined to fix it: "Frame State Bookmarking (frameset bookmarks)" bug... (You can vote for this bug if you agree.)

Re:Good the flaws are being found so quickly but..

[jschrod]

You mean, like, checking old security bugs of previous versions does not need to be done for rewrites of some important software component used on millions of desktops?

You are not concerned by the Cascade of Attention-Deficit Teenagers (CADT), are you?

non-news for me

[budgenator]

I'm using

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.8) Gecko/20050512 Firefox/1.0.4

and it does not demonstrate the supposed vulnerability; maybe what mozilla should do is not start coding from scratch as you suggest but stop trying to shoe-horn good linux code onto the windows platform. First time through I read click so I centerclicked and tried the exercise in a tab, then went back and centerclicked the test, it opened a new browser window with the secondia page; so to be fair I went back and re-did the demo by left-clicking and still nothing.

Panic time

[stinky wizzleteats]

Wow. Another Firefox vulnerability. Tell me, how many companies have either been completely shut down by a massive megaworm and/or have preemptively shut themselves down to stop the spread of destruction from this egregious and terrible flaw?

FF 1.0.4

[Mozk]

I'm using Firefox 1.0.4 and it's apparently not vulnerable because the test didn't do anything...

Re:Old news.

[Master of Transhuman]

I've never understood why they do that anyway. I always end up clicking on the "see image in original size" button anyway and viewing it in a separate window.

They don't put a frame on news articles from Google News, why bother doing it with images?

Google, get RID of the frame!

Re:Old news.

[Master of Transhuman]

And if IE and the other browsers properly supported the "object" tag, you wouldn't need iframes, which are supposed to be superceded by the object tag.

I mucked around with this crap for several weeks a few months ago trying to get a simple form of dynamic page loading done. Can't be done with the lame support for object in most browsers. At first I tried iframes using the JavaScript trick of extracting content from an invisible iframe. Not good enough. Tried object - much cleaner, but not supported properly on all common browsers.

Frames are bad news, iframes are inadequate, and objects aren't supported.

Get on the fucking stick, browser makers! Stop adding bullshit like "voice commands" (Opera) to your browsers until you make the STANDARDS WORK!

Re:Old news.

[ccady]

That is indeed a security hole -- unless you want to claim that it's one of those extra features that differentiates Firefox from Safari and IE ...

Except, of course, that it does not differentiate Firefox from IE, as the latest versions *both* have this vulnerability. (Just tested with Firefox 1.0.4 and IE 6.0.2900.2180.xpsp_sp2_gdr.050301-1519. Seriously.)

Re:Opera is looking Good

[whitehatlurker]

Well, yes. Opera really looks good. Take a look for yourself. :-)

Seriously, the problem is that this was (supposed to be) killed in a previous version of the Gecko browsers. It should not have revived itself.
The following browsers are not affected:
* Mozilla Firefox 0.9 and later
* Mozilla 1.7
* Opera 7.52
* Netscape 7.2
* Camino 0.8 (build 2004062308)
Source Secunia

At least in Opera, dead bugs stay dead.

Epiphany users?

[codergeek42]

This only seems to be for Mozilla/Firefox, but since Epiphany (GNOME's browser) uses the Mozilla/Gecko core, are we Epiphany users also at risk?

Re:Old news.

[koreaman]

Then I wouldn't be able to read the MSDN help, which is an invaluable resource.

Frames suck... most of the time, but not always.

[kiddailey]

"Frames suck, and you deserve to cause problems if you use them."

No, frames suck most of the time.

There are many uses for frames that can increase usability or enhance/ease integration with other systems (that you cannot directly modify for example), particularly inline frames -- if you know what you are doing.

Simply saying frames suck without qualifying further only shows your lack of understanding of appropriate applications of them ;)

Re:Old news.

[budgenator]

Actualy I've dug into the source code, secundia open a child browser, with

href="http://msdn.microsoft.com/library/default.as p" target="_blank

once msdn loads, it creates a frame named

FRAME name="fraRightFrame"

going back to secondia.com and clicking the test links supposedly causes the browser window that secondia.com Created to be changed to content that the parent window directs. I'm not sure that I'd consider a parent window having control ofver a child window a security violation, in fact because the supposed security problem doesn't work in my firefox I might consider that an unexpected behaviour; but i expect that microsoft's javascript code

// this page should never load inside of another frame
if (top.location != self.location)
{
top.location = self.location;
}

is really whats is making secondia look like a bunch of morrons. Perhaps MS has a function in their ASP code called

makeSecondiaLookStupid

that fires when the referrer is secondia.com and the IP address of the requester doesn't belong to secondia.com!

Re:Old news.

[bismark.a]

It did work on my FF 1.0.4. Took control of the MSDN frame. May be they changed something on the Secunia site now?

Re:Old news.

[budgenator]

actualy you have to go to hack.ru first, let hack.ru open a browser window as a child, and have javascript shut off becuase if the targeted site has this code in it,

// this page should never load inside of another frame
if (top.location != self.location)
{
top.location = self.location;
}

like MSN does, the vulnerability doesn't work, additionaly the 'vulnerability' is also reported in IE6.0

Re:Old news.

[baadger]

"I can think of a few times it would be great if one website could help someone fill out another websites forms"..."If someone really wants to do that, they should attain permission and do it via GET or POST vars, or some serverside communication."

Essentially you can do this already using 3rd party cookies (setting domain=TheOtherSite.com). Of course most savvy Firefox, Opera (and maybe Safari?) users block or whitelist 3rd party cookies due to ads and trackers.

At the moment this 9 month old, and as of yet unpatched, oversight in Firefox/Mozilla let's webmasters pass their own website cookies to any domain (maybe coordinated with advertisers) in the same TLD anyway though.

Has anyone else noticed Firefox 1.x now has 28% to IE's 31% of unpatched vulnerabilities?

Re:Old news.

[BrokenHalo]

Never mind, I've checked it out myself; that's an iframe, and I've blocked these ads through my /etc/hosts file (pagead{1,2,3,4,5,6,7,8,9}.googlesyndicate.com).

Yes, I know I could install the adblock extension or do it through the userchrome.css, but I I'm a bit short of RAM and don't want to put extra load on the browser unnecessarily...

Errrr - my firefox is safe...

[HaydnH]

Did anybody else try the test from TFA? I tried it in my firefox and the 'flaw' doesn't exist! If the vulnerability exists in other users firefoxes perhaps it's something to do with the TabMix plugin (opens new windows in tabs instead) which breaks the vulnerability??

Re:Errrr - my firefox is safe...

[HaydnH]

OK! I've tested this, the vulnerability doesn't exist if you use the Tab Mix extension!

Enjoy secure browsing,

Haydn Haines.

Re:layout based on frames is bad

[ArtStone]

3) "Back" is ambiguous about whether you want to back up within the frame or back up from the main frame...
4) poorly designed frames make assumptions about the screen size or text size of the browser, making some portion of the text unviewable because it exceeds the width or height of the frame (think people using larger text sizes due to vision issues)

Even more annoying are the frames pages that gratuitously force the main frame to be loaded if you try to look at only the frame..... or people who try to disable right clicking with javascript...