Gaping Holes In Fully Patched IE7, Firefox 2

Continent1106 writes "Hacker Michal Zalewski has ratcheted up his ongoing assault on Web browser security models, releasing details on serious flaws in fully patched versions of IE6, IE7 and Firefox 2.0. The vulnerabilities could cause cookie stealing, page hijacking, memory corruption, code execution, and URL bar spoofing attacks." Here is Zalewski's post to Full Disclosure.

Comments

Ah well

[GFree]

Gaping Holes In Fully Patched IE7, Firefox 2

In other words, it doesn't matter which browser you use, you're gonna get F'd in the A regardless? Sounds painful.

Re:Ah well

[Anonymous Coward]

I use wget.

Pr0n never looked so good....

Re:Ah well

[rts008]

RTFA...Try the demo's...It will reduce the FUD.

I tried the demo page/file and got no response whatever.

"2) Title : Firefox Cross-site IFRAME hijacking (MAJOR)
      Impact : keyboard snooping, content spoofing, etc
      Demo : http://lcamtuf.coredump.cx/ifsnatch/
      Bugzilla : https://bugzilla.mozilla.org/show_bug.cgi?id=38268 6 [May 30]"
from:(http://lcamtuf.coredump.cx/ifsnatch/) which is from:2) Title : Firefox Cross-site IFRAME hijacking (MAJOR)
      Impact : keyboard snooping, content spoofing, etc
      Demo : http://lcamtuf.coredump.cx/ifsnatch/
      Bugzilla : https://bugzilla.mozilla.org/show_bug.cgi?id=38268 6 [May 30]"

and this:"3) Title : Firefox file prompt delay bypass (MEDIUM)
      Impact : non-consentual download or execution of files
      Demo : http://lcamtuf.coredump.cx/ffclick2/
      Bugzilla : https://bugzilla.mozilla.org/show_bug.cgi?id=37647 3 [Apr 04]"

I tried both link's test button and got no response whatever.

IMHO, this must be something related to running Windows, as my Kubuntu 7.04 Feisty w/ Firefox 2.0.04 (with NoScript, Adblock, Adblock Filterset, and Flashblock) just does not act on this.

I guess I need to install some version of Windows to experience this...I feel deprived and left out!

Does this work with Firefox w/ NoScript on Windows?

From past experience, I have no doubts that it works with any version of IE on any Windows platform.

Re:Ah well

[Sizzlebeast]

Firefox 2.0.0.4 w/ NoScript and it won't work on windows either. I guess i have to allow it...not gonna happen :) I guess I'm safe

Re:Ah well

[egr]

first two works on my Fedora 7 (Firefox 2.0.0.4 without NoScript), NoScript is not a part of Firefox so I think it should be really tested without it, however the last one didn't work, instead it asked me to download html page with download manager

Re:Ah well

[Anonymous Coward]

and this:"3) Title : Firefox file prompt delay bypass (MEDIUM)
            Impact : non-consentual download or execution of files
            Demo : http://lcamtuf.coredump.cx/ffclick2/
            Bugzilla : https://bugzilla.mozilla.org/show_bug.cgi?id=37647 3 [Apr 04]" That has got to be one of the worst attempts at getting me to open a file from the internet I've seen in a long time.

For those that didn't try it... it'll show the file download box, then it'll pop-up another window with a game inside it, that requires you to continuously press the "Enter" key for ~10 seconds. The pop-up disappears and the focus shifts back to the download dialog where a press of the "Enter" key will automatically download/open the file.

A) You have to somehow not notice the file download dialog appearing behind a pop-up window
B) You have to want to play a game you see in a random pop-up window
C) The file is only going to run as a very limited user account with the correct Firefox process permissions (yes, this can be done in Windows XP as well, although no one does it)
D) Executable files by default don't have an "Open" option when downloading a file in Firefox - you can only save them

Re:Ah well

[Illogical Spock]

I'm glad I use Lynx...

Re:Ah well

[macs4all]

Safari 1.3.2 (running on OS X 10.3.9) seems immune.

But we knew that.

Re:Ah well

[Anonymous Coward]

Well the so called CRITICAL one for IE7 doesn't seem to work on Vista.
It just clicked back and forth between the "nothing.html" page and Google for 2 mins and called it quits.

No idea if the sandboxed security model of Vista is what prevented it from working or it's a very hard to trigger race condition.

Re:Ah well

[rts008]

Thanks for the info! :-)

I can't convince my wife to switch to *nix/BSD, she is used to WinXP and IE 7 from work, and doesn't want to change. :-(

I might be able to sneak Firefox in on her with some creative registry hacks, and some install/configure obfustications. We'll see.

Re:Ah well

[eli pabst]

It says in the advisory that javascript is used to inject the exploit. Disabling javascript, whether manually or through NoScript is obviously going to cause the demo to fail. That doesn't mean that your version of Firefox is not vulnerable though, it just means javascript is required to exploit the vulnerability.

Re:Ah well

[rts008]

Thanks for the reply.

Was the NoScript extension running?

Re:Ah well

[Kelson]

I use wget.

You have not truly experienced the web until you have experienced it using telnet to port 80.

Re:Ah well

[rts008]

Thanks for the reply!

You make an excellent point.

Also, thanks for the clarification. What this means to me is that I can go into the settings in IE 7 on my wife's PC (WinXP Pro SP2...so far I cannot get her to switch to Linux) and discourage this crap.

Anymore, just connecting to the internet is like fighting the Borg...they always adapt to the frequencies and continue to try to assimilate all.

Re:Ah well

[Sizzlebeast]

Good Luck! :)

Re:Ah well

[TheRealMindChild]

Im not sure these even worked on me... sure, I still use Firefox 1.5.0.8. Haven't had a reason to upgrade. Maybe I still shouldn't.

Re:Ah well

[JensenDied]

If you view source on the page you will see that the buttons use javascript to execute their demo, so you would need to allow the malicious script in order to be vulnerable to these attacks.

Re:Ah well

[froggero1]

confirmed as well with the latest FF on OS X... I can't wait for the article that shows who patched their browser quicker.

Re:Ah well

[Anonymous Coward]

browser has to actually be capable of doing stuff, hence safari is obviously immune.. but hey we knew that :)

Re:Ah well

[megaditto]

Just use Opera.

Re:Ah well

[Anonymous Coward]

You can block scripts in IE too. Wheres the FUD now?
The site talks about FF and IE not FF + extentions-to-make-it-secure. If the exploit is to do with Javascript its a no brainer that it wont work if you block JS. Your entire post was useless and offtopic.

Re:Ah well

[Virtual_Raider]

You can also install Firefox and use one of the IE-look-alike themes. I have one for Luna at home (the XP Fisher-Price interface) and one for Vista at work, and suddenly Firefox behaves a lot like IE. You can also set IE Tabs and have it open IE-only sites on an IE tab by default, this requires nothing more than two mouse clicks. Obviously, you need to get IE patched up if you are going to use IE tabs =)

Then you can slowly add nifty FF extensions and slowly win her over to the Dark Side, bwahahaha... er, to the Good side I mean, yeah, the good side...

Re:Ah well

[Anonymous Coward]

excellent point?
i pity the fool who doesnt know that JS exploits dont work if JS is blocked in the browser ... :/

Re:Ah well

[Arancaytar]

telnet? Pfft. When I used to be a wee kid, we encoded our TCP packets by hand and by golly we liked it!

Re:Ah well

[macs4all]

You mean do things like render pages correctly?

Let's see which browser passed the ACID2 test first, shall we?

Or, do you mean "do things" like totally pwn your Windows box with some wayward ActiveX component (note that that was patched, but was only a few months ago, in February)?

I guess I'll just have to be content with my plain ol' Standards Compliant browser, then.

Pity me. Mwuhahahahahahaaaaaa!

Re:Ah well

[SleepyHappyDoc]

The test cases linked to on Bugzilla require scripting. I'd link you to the document, but that wouldn't work from here, so you'll have to dig them out of Bugzilla yourself. They're on the non-duplicate bug page, the one from the middle of May.

Re:Ah well

[Anonymous Coward]

ah well, indeed.

from the demo:

"frame spoofing using document.open() testcase
this testcase requires JavaScript to run."

Seems like all these holes are more the fault of javascripts then of any particular browser.

Re:Ah well

[jez9999]

I might be able to sneak Firefox in on her with some creative registry hacks, and some install/configure obfustications. We'll see.

I'm glad to see the art of practicing trust in marriage is alive and well!

Re:Ah well

[jrockway]

> Let's see which browser passed the ACID2 test first,

The ACID2 test is really irrelevant. It is a test for making invalid CSS render "properly". Except if you provide CSS that's against the spec, "proper" is not defined. Oops.

So basically ACID2 is "some guys pulled this out of their ass, now make it work". Great.

Re:Ah well

[427_ci_505]

Just tried it on FireFox 2 with NoScript on Ubuntu, all up to date. I've been haxxed.

Re:Ah well

[QuoteMstr]

You couldn't be more wrong, sir. Error handling in CSS is defined in great detail in the CSS spec, and it's important that browsers handle it properly so that future CSS revisions can provide new properties and syntax without breaking old clients. ACID2 ensures that browsers are forward-compatible with future versions of CSS.

Re:Ah well

[Omnifarious]

*rolls eyes* Like most people are ever going to install NoScript. I suppose you think that Microsoft was perfectly reasonable in declaring C2 security certification when NT wasn't connected to a network too?

Re:Ah well

[Anonymous Coward]

**rolls eyes** I've been trying to tell everyone that javascript is the major browser security hole for years. Every vuln I hear the same tired excuses about how it's oh-so-important for da intarwebb and will be securely sandboxed real-soon-now.

Perhaps it is time for vendors to be a little more pro-active about security, noscript extensions functionality should've be in the damn browser from day one anyway.

Re:Ah well

[MrSenile]

New to marrage, are we? :)

Re:Ah well

[Aoreias]

netcat is a far, far better utility for such activities. Telnet has formatting, and all kinds of control characters. You can interect much better with netcat.

Re:Ah well

[rts008]

*rolls nutsack*

Well, since my 'blind supposition-fu' is not as strong as you, I can only go by my own experience.

Since everyone (yes, everyone) I know that uses Firefox also installed (or installed by me at their request) and uses NoScript. So all of your eye rolling makes no positive impression on me whatsoever.

As for your supposition- No. You're dead wrong on this one...Try again, you need the practice.

Windows and secure/security in the same sentance? You're funny!
Whether it be Computer/Network security, or physical security, Windows are security's biggest nightmare-a weak point in any bulwark.

Re:Ah well

[RebelWebmaster]

What, these aren't enough reasons to upgrade? Honestly, users who know vulnerabilities exist and specifically choose not to upgrade deserve what they get in my ever so humble opinion.

Re:Ah well

[Anonymous Coward]

Oh gosh, you are running Kubuntu 7.04 Feisty? That is pretty darn one-three-three-seven.

I'm just going to throw out an idea here, though. If you look at the source of the page, clicking the test button executes a script. If you have NoScript installed, then that script will not be run (unless you say otherwise).

Maybe that is why nothing happened... and it has nothing to do with your super haxxor operating system?

Re:Ah well

[Anonymous Coward]

Read again... those demos rely on javascript and you have noscript installed.

duh?

Re:Ah well

[darkwhite]

I tried both of the Firefox exploit demos on Linux too and they both failed. No noscript, either, all javascript is allowed to run.

Re:Ah well

[Omnifarious]

Now, that's an interesting argument, and one I don't necessarily disagree with. But most people will not install it themselves no matter what anybody thinks. Things have to be secure by default, not secure if you install a bunch of extra stuff.

Re:Ah well

[Anonymous Coward]

I'd rather laugh at you. Bwuhahahahahahaaaaaa!

Re:Ah well

[Anonymous Coward]

--My ISP blocks port 80 for domestic users and if you want port 80 they charge commercial fees

Re:And Opera

[WilliamSChips]

Naw, Opera just randomly crashes and then has a default behavior of restarting the site that causes it to randomly crash.

Woot!

[Anonymous Coward]

Wow, I'm so glad I installed Firefox so I'm immune to all of these IE bugs!

Oh, wait, what did that say?

-AC

Re:Woot!

[Mark_in_Brazil]

Wow, I'm so glad I installed Firefox so I'm immune to all of these IE bugs!

Oh, wait, what did that say?

It said the only critical flaw in the bunch is in MSIE 6 only.

This has been another edition of Easy Answers to Stupid Astroturfer Questions.

Re:Woot!

[Anonymous Coward]

From the full disclosure list:

1) Title : MSIE page update race condition (CRITICAL)

[snip]

This is tested on MSIE6 and MSIE7, fully patched.

Re:Woot!

[nwbvt]

Yeah, all firefox users have to worry about are 'major' bugs like keyloggers getting installed or malicious content getting inserted into legitimate pages. I mean who really cares if some random hacker can get access to all my keystrokes. I feel so much safer now that the powers that be decided not to designate the firefox vulnerabilities with the arbitrary label 'critical'.

Victim Statistics?

[Anonymous Coward]

Perhaps I'm ignorant, but does anyone ever find themselves a victim of these "gaping holes"? I can't say as I've ever browsed on to a site and found myself the victim of a compromised computer or ended up with viruses. Is there a site/blog that reports such statistics?

Re:Victim Statistics?

[eli pabst]

There are a shitload of sites that host malicious code to intentionally infect vulnerable browsers. Even regular sites are occasionally hacked to host malicious code. The most recent big name one I can think of is the Miami Dolphins football team website during the last superbowl. A few years back a number of sites that produce banner advertisements were hacked, which resulted in widespread malicious banners getting hosted on tons of otherwise secure sites. I don't know of any database of malicious websites, but http://isc.sans.org/ usually has a good daily handlers report that lists widespread nastiness and other new developments.

Link to info on the Dolphins hack:
http://www.infoworld.com/article/07/02/02/HNdolphi nssiteshacked_1.html

Re:Victim Statistics?

[Anonymous Coward]

These kind of holes are way too sophisticated for your local script kiddie to exploit. The real use for these kind of holes is in industrial espionage scenarios - consider Evil Inc. that wants to get a $50 million contract at all costs - they can be persuaded to pay someone of Zalewsky's calibre something like $500K to unleash such an exploit on the CEO of Competitor LLC. who is also bidding for the same contract. Such an exploit can potentially allow the attacker to grab confidential files from the CEO's workstation or even their document management system.

Gaping holes?

[Paktu]

Article tagged as goatse.

Re:Gaping holes?

[mr_josh]

Mod. Parent. UP.

Re:Gaping holes?

[Anonymous Coward]

That's really a good idea for a new slashdot icon for critical security flaw announcements. Long live goatse and OMG Ponies!!!

Re:Gaping holes?

[evanbd]

Is it just me, or are the more humorous / inane tags showing up less? "duh" "haha" "itsatrap" and friends. Is this because the slashdot editors changed something, or because people are using them less?

Re:Gaping holes?

[Nimey]

Do you really think *this* crowd would use those tags less? Or any established Internet forum?

Taco changed the code; I'm guessing to disallow the stupid tags that got put on almost every story, like those you mentioned. Maybe to greylist those who kept tagging that way, too.

Taco, got anything to say?

Re:Gaping holes?

[sr180]

Possibly like how the dupe tag doesnt work anymore.

Re:Gaping holes?

[TheVelvetFlamebait]

Don't forget the inseparable three: "yes", "no", and "maybe"

Re:Gaping holes?

[veganboyjosh]

TAG PARENT: yes, no, maybe

Re:Gaping holes?

[dkf]

Taco changed the code; I'm guessing to disallow the stupid tags that got put on almost every story, like those you mentioned. Maybe to greylist those who kept tagging that way, too.

I think there's a list of tags that are permitted (blacklisting tags would be easier to route around by finding alternate things that mean the same thing) but as far as I can see, there's no downside to using a non-blessed tag; it just gets dropped on the floor.

I think it's a shame though; the old tagging system added a good bit of fun to the site, and the "joke" tags were sometimes very appropriate indeed. The new system is just boring crap that reproduces what is already in there from the article categories or a simple search of the part of the story on the front page; a search engine could do those tags, or even plain old grep, and so they add nothing of value. The old system was better because it provided a snapshot of what people thought about the story, despite being much more open to abuse.

Bring back the open tags! Please!

Re:Gaping holes?

[Jugalator]

I always thought it was some sort of cooperation behind a range of computers, almost like a botnet... At worst, you could see the most weird tag for an article (not just the common "itsatrap" stuff), so I have to wonder if there was really either an implementation defect that some exploited, or that they've banned whatever GNAA-like network that did that, and they were behind a lot of these tags.

But in order to be affected...

[DaveWick79]

In order to be affected, doesn't one first have to go to the shady site that has this stuff scripted in the page? Yes, this may be a bug, but like a web page-bound virus, is one that the user has to inflict upon himself by going to a site he probably shouldn't be going to in the first place.

Re:But in order to be affected...

[afidel]

Hacker hijacks web server of popular site, but instead of simply defacing the front page the slip in a little bit of code to release a botnet installer or adware installer based on this type of vulnerability. It happens all the time.

Re:But in order to be affected...

[snowraver1]

It's called a Man-in-the-middle attack. Say you go to google.ca (I'm Canadian) It goes something like this:

You> Yo DNS server, I wanna Talk to google.

DNS> Roger that! Go to 72.14.253.103.

You> Yo 72.14.253.103 Whacha got?

72.14.253.103>Index.html

You> Looks like Index.html says I need the google picture.

Eve (Eve is sitting at the same coffee shop as you. Eve is bad)> Ahem, err, sir, I have this envelope for you. It's from google. It contains your picture. *Sniker*. (You don't notice the snicker)

You> OH N0E$! TH3 P1CtUr3 us3d a buff3r ov3rflow vuln3rab1lity and n0w you have a virus that mak3s you typ3 lik3 a n00b!

For more information look here: http://en.wikipedia.org/wiki/Man_in_the_middle_att ack

Re:But in order to be affected...

[I'm Don Giovanni]

Two problems with your theory:
1. Hackers can post to message boards messages containing innocent-looking links to "bad" sites. This happened to me years ago at IGN's boards, before I started checking the status bar to see what the actual URL of a link was before clicking it.

2. Hackers sometimes hack legit sites and inject script code into them (normally at the end of the page), so that visiting a legit sites runs mal-script.

Re:But in order to be affected...

[Bob of Dole]

Don't be so sure that avoiding "shady" sites will protect you.
I run a few perfectly un-shady sites (an imageboard, a specialized search engine, and a funny images repository), but recently some users started complaining about the popups that were trying to install spyware.
I don't have any popups on my sites! (I don't even use target="_new"!) but still users were getting spyware popups. The popups were so evil that the only way to avoid getting redirected to the spyware site was to disable javascript (Even in firefox. in IE it just installed the spyware automatically, but firefox at least you had to click "download". Still, it made my site unusable)

I went into my advertisers control panel, checked for anything remotely shady. Nothing. I tried turning off all third party advertisers (like doubleclick), figuring maybe one of them was redirecting users. Nope, some users still got popups. Worst of all, I NEVER got the popup, no matter what browser I was using.

It turns out it's cause I'm an American. The advertiser had specified that the advert with the embedded redirect only show up in every country except America. That stopped me from seeing it on the site, but what about the control panel? I could see all the ads there, even the ones not targeted at my location. Here's what they did in actionscript: (pseudocode)

if getTimeZone() in EUROPE_TIMEZONES:
    redirectToSpyware()
else:
    displayHarmlessAdvert()

So even when I checked the ads in the control panel they looked fine.

My point is, don't think there's a scary corner of the internet where all the spyware/exploits hang out. The bastards making this crap know that most people don't go to those kinds of places, so they'll do anything they can to sneak their crap onto legitimate sites. (MySpace got hit with one of these a few months back, I think)

Re:But in order to be affected...

[shadowmas]

unless because he went to the site by accident by typo error like www.goggle.com. i don't know but you but i've made plenty of typos while typing web addresses.

Re:But in order to be affected...

[beyondkaoru]

ok, i'm not a web developer so i wouldn't know, but is there any way to force your advertisers (malicious or otherwise) to not use javascript/flash/whatever? since it's essentially running code we don't trust on the client's computer...

essentially, do the noscript thing on your own servers, or host ads (i assume they're mostly just pictures with links) on your own servers somehow.

Re:But in order to be affected...

[TheLink]

From the perspective of a web application programmer and security consultant, I think it would be very useful to have HTML tags to mark HTML
sections where active content should be disabled, possibly selected active content.

Right now the HTML environment with respect to potentially dangerous
content is:
In order to stop, you must make sure that none of the 1001 GO buttons were
pressed before. There is no STOP button. No Big Red Emergency Stop button.

This seems to be a disaster prone situation. Like driving a car without
brakes. Only experts can do it, and typically even they screw up too.

I think we need some form of brakes. Something like the following:

<activeoff lock="matchingrandomstring" allowed="java" />
Any active content disabled here. Even if slips past site's filters.
<activeon lock="matchingrandomstring" />
The disabled active content reenabled. Does not mean everything enabled,
just those disabled earlier.

Rest here:
http://groups.google.com.my/group/netscape.public. mozilla.security/browse_thread/thread/c02d6dfa7181 1d62/6d4cf22651a72812?lnk=st&q=&rnum=2&hl=en#6d4cf 22651a72812

Re:But in order to be affected...

[Anonymous Coward]

Please do not leak Vista source code.

Re:But in order to be affected...

[Monkier]

unfortunately hackers are now getting into 'reputable' websites, and putting in 'shady stuff'... as happened when the Miami Dolphins website was hacked..

Re:But in order to be affected...

[Raenex]

The advertiser had specified that the advert with the embedded redirect only show up in every country except America.

        if getTimeZone() in EUROPE_TIMEZONES:
                redirectToSpyware()
        else:
                displayHarmlessAdvert() Ok, it's a silly mistake, but I can't ignore the (World = America + Europe) equation implied by your remarks :)

Re:But in order to be affected...

[icepick72]

... Say you go to google.tv (I watch TV) ...

Re:But in order to be affected...

[Bob of Dole]

Don't be silly. I'm an anime geek.
World = America + Europe + Japan.

Didn't learn lesson from javascript

[mrcaseyj]

They said they could make javascript secure but it's still a huge source of holes. Instead of learning our lesson, Flash, another executable web format is taking over. Don't use flash because it's cool. Only use it if you really need it for your web page.

And if Ubuntu was really concerned about security they would ship it by default with a web browser already set up under a separate username with strict selinux policies.

Re:Didn't learn lesson from javascript

[Crazy Taco]

Yeah!! DOWN with teh flash and javascript! Time to move on to something better. Silverlight, here I come!!!11!one :D.

Re:Didn't learn lesson from javascript

[mrcaseyj]

Yeah!! DOWN with teh flash and javascript! Time to move on to something better. Silverlight, here I come!!!11!one :D.

OK Crazy Taco, to even suggest something like Silverlight, proves that the excess hot sauce has gotten to your brain. We're your friends and we're here to help. Slowly step away from the keyboard.

Re:Didn't learn lesson from javascript

[foniksonik]

When the browsers provide support for seamless SVG that gets push data from a socket connection I'll stop using Flash. When browsers provide seamless client side data validation and inline error prompting for forms, I'll stop using Javascript.

Any web page that can't benefit from the above uses of the technology probably isn't all that more informative than an email would be.

Static information is useful but stateless information is becoming useless. This is interactive media... not a book that you can access over a phone line. Keeping state on the server is too slow... it's great for long term session storage but very bad for user-time interaction.

Re:Didn't learn lesson from javascript

[javabsp]

> And if Ubuntu was really concerned about security they would ship
> it by default with a web browser already set up under a separate
> username with strict selinux policies.

It is non-trivial to setup, but I use firefox under a different
username today. It doesn't solve the problem of cookie stealing
though.

Re:Didn't learn lesson from javascript

[mrcaseyj]

>When the browsers provide support for seamless SVG that gets push data from a socket connection I'll stop using Flash.

There are some applications that would be so much better with SVG that even I might recommend Flash for the purpose. But please don't use Flash just because it would make your site a little cooler when it would be fine without it. For example my doctor's home page uses flash and won't even load at all without it. There's not even a link to get to a static page. Of course that's exceptionally lousy web design, but what does my doctor's home page really need Flash for anyway? Most of a doctor's site would be just fine with old fashioned html.

>When browsers provide seamless client side data validation and inline error prompting for forms, I'll stop using Javascript.

Client side data validation is nice but not really necessary. Maybe a simple and secure form of validation is something that should be put into browsers.

>Any web page that can't benefit from the above uses of the technology probably isn't all that more informative than an email would be.

>Static information is useful but stateless information is becoming useless. This is interactive media... not a book that you can access over a phone line.

Slashdot works just fine with JavaScript turned off. I'd rate Slashdot a little higher than useless. A lot of sites I buy stuff from work fine without JavaScript. On the other hand, the value of some features used by some sites, like Google Maps, justifies their use of JavaScript.

Re:Didn't learn lesson from javascript

[foniksonik]

probably isn't all that more informative than an email would be

While /. is more useful as a web site it could as easily be an email list. Even though /. manages to stay somewhat relevant as a forum without providing live updates to posts, this is going to change in the future. I'm not saying that /. is going to change, I haven't a clue what if any changes they have planned to improve the site, but very soon there are going to be forums such as /. that do a better job of providing the information and entertainment value niche it serves and they'll do so by giving users the option of seeing posts in near real time rather than having to refresh a page.

I also said that stateless info is 'becoming' useless... meaning that there is so much info coming down the lines that unless We can impose live filters on it (much like being able to filter out unwanted flash content at the click of a button) there will be a ratio of noise much higher than signal... it's arguable that this is already the case and that much of what we could be exposed to that is relevant to us as individuals is getting lost in between spam, superfluous fluff and non-spam marketing cruft.

Google does it's best to find relevant results for a simple search and they do a great job but there are so many possible and easy to use tools they could be providing. These tools all require advances in client side interaction capabilities.

We need data visualization and UIs with visual models to filter and constrain data. I'd love to see sliders used for live results pagination... want 5 results, 10, 30 just move that little knob to the right a little... want less summary info, just move this one left a little, want to see more results from a particular site using the same criteria, just bump up the weight on it using this right pointing arrow next to it's name (3 more pages show up), want to see a list of analogous terms that have a higher relevance rating... click this button and select the new terms you'd like to see results for.

This is the kind of toolset that will require client side data manipulation, dom manipulation and asynchronous requests to the server/database. Nobody will use a tool like that if they have to wait for a refresh each time they make an adjustment.

These same tools can help you find the best price for a product, narrow it down to a zip code radius and provide fastest route info to the store from your job site or your home with a couple clicks... rather than 15 minutes of form entry and waiting for results that may or may not be what you're looking for.

This is coming if I have any say in it (and I do for some companies... prototypes are in development).

FYI I think Flash has it's uses for very creative UIs to locked down specifications, Kiosks are a great example, some online data browsers where the data is visual and the experience is as important as the accessibility (movie/game sites for instance), and for charting data with live interactivity (think google's stock charts). I don't think it's useful or necessary for fancy menus, slideshows of marketing messages, slide browsers or basically anything that can be done in a grid layout... javascript is now more than capable of all the special effects you can throw in, that won't get in the way of using it ;-p

alternatives

[sudo]

Well there's always Opera?

Re:alternatives

[nothing now]

And for your mac Safari or Camino!

Re:alternatives

[Anonymous Coward]

Absolutely: Opera IS the finest webbrowser creation out there, no questions asked, in terms of both speed and security also!

EVIDENCE = THE MOST CURRENT WEB BROWSER SPEED TEST I HAVE SEEN ONLINE:

http://www.howtocreate.co.uk/browserSpeed.html

(As far as security goes? Opera is never mentioned as having 1/100th the problems the "big boys on the block" have in IE & FireFox)

As to my statements - can anyone show me otherwise? You see, I would appreciate contrary data, and can use it, if it exists that is.

Re:alternatives

[giorgosts]

Third exploit works on opera but it doesn't work on FF for me

Re:alternatives

[Anonymous Coward]

"Third exploit works on opera but it doesn't work on FF for me" - by giorgosts (920092) on Tuesday June 05, @01:04AM (#19392125)

The CURRENT version of Opera, 9.21.8776? Is this the version/build you tested it on?

(Curious, & thanks for the feedback! I can always use good reliable info., of course!)

APK

P.S.=> Opera does seem to come up with less security holes though, that I am FAIRLY certain of...

Mainly because I hear a lot of "hooting & hollering" about browsers'/email clients' security the past few years (as do we all, they are part of what weakens today's systems overall & imo, more than the OS of today have in them, or imo, other peripheral softwares even (yes, even office suites)).

Plus, I am NOT sure of the nature of this "3rd exploit" you note!

However, here? If it is involved in scripts engines having problems??

Well, I turn off scripting (javascripting AND java) in the webbrowser here (and my LinkSys BEFSX41 unit filters that as well, at the JAVA level @ least, w/ cookies if I choose even)!

Generally, for most things I turn scripting languages off online, on the public internet (vs. intranets work)!

However - Opera does offer me (not by source as FF noscript addon extension does, but by site level) the ability to "turn on/off" scripting as needed though (one of its 'right-click' options) for particular sites & it remembers this, of course, for subsequent re-uses of them as well.

(I do ALL/EACH of these things, & have for many years now online on the public internet, because of security!)

Especially now that the past 2-3 years now, even adbanners have shown that type of exploit in them (generally, I don't see those though - hosts files & Opera's native adbanner blocker plus .pac files do the job on banners (HBO T.V. internet here - NO commercials, more bandwidth, better security)... apk

Re:alternatives

[giorgosts]

Version 9.21 on kubuntu feisty. You play the wack-a-mole, but of course no c:\ contents is displayed cause that's windows-only my safest option is Konqueror, the default kubuntu browser

Re:alternatives

[Nicolay77]

Tested: Opera 9.20 in Windows XP SP2 is safe against IFRAME hijacking.

Lynx

[Anonymous Coward]

I use Lynx, you insolent clod! Get off my lawn!

Re:Lynx

[rustalot42684]

If you can't do it from the command line, you shouldn't do it at all! Who needs pictures, anyways?

Re:Lynx

[technopinion]

Lynx is for Lusers. The cool kids are all using telnet these days.

Re:Lynx

[feedmetrolls]

If you can't do it from the command line, you shouldn't do it at all!

That's what she said!

Re:Lynx

[Xiph]

telnet is a ripoff, write your own socket-handler.

What about Flock?

[ringfinger]

Anyone have info on how stacks up to IE/FF? http://30days.itious.com/

Re:What about Flock?

[dn15]

I'm in no hurry to test the exploits but I suspect they'd work in Flock as well -- after all, Flock is essentially Firefox with a new theme and a few extra extensions bundled in.

Re:What about Flock?

[Kelson]

You can assume that any vulnerability in Firefox that's in the rendering engine will also work in any other browser built with that version of Gecko. That includes corresponding versions of Flock, SeaMonkey, and probably even K-Meleon and Camino (depending on the original platform). You may have noticed a lot of Flock point releases include things like, "The 0.7.14 Flock Maintenance patch incorporates Mozilla's patch 1.5.0.12."

Now, vulnerabilities in the UI -- say the pop-up blocking system -- could be specific to Firefox, but Flock shares a lot of the UI with Firefox, so there's a good chance that it relies on common code and will still be vulnerable. IIRC Flock 0.8 is based on Firefox 1.5, so if this exploit requires Firefox 2, it's probably OK -- unless you're one of the lucky users testing Flock 0.9.

Re:What about Flock?

[Anonymous Coward]

You piece of shit, quit spamming your shit URL.

One of the demos on Firefox doesn't work

[ericferris]

I am using the latest Firefox 1.5. I went to the demo page : http://lcamtuf.coredump.cx/ifsnatch/ . The first test shows that it is possible to rewrite the content of an iframe. That is rather dangerous in situations involving trusted messages.

The 2nd demo was supposed to snoop on the keyboad, but it invoked a pop-up, which was immediately blocked by the pop-up blocker. So unconfimed as far as I know. However, the demo page did open a CNN.com page.

Anyone has better "luck" to demo the keyboard snooping?

Re:One of the demos on Firefox doesn't work

[Anonymous Coward]

The second one is really lame. It's supposed to fool you into pushing the enter key repeatedly and then prematurely close the window which had attempted to open a file or executable. I did it in the interest of seeing the exploit but I don't think any power user would let a file dialog sit open. It has to be in that order because the download/open dialog popping up normally has a delay. Completely clueless people maybe.

Re:One of the demos on Firefox doesn't work

[Anonymous Coward]

Wait for a couple of minutes and press X on the *CNN* webpage and it will display a message - which means they present a hacked version of a popular new website.

Re:One of the demos on Firefox doesn't work

[Anonymous Coward]

Completely clueless people maybe. The "Completely clueless" make up about 99% of the internet population.

Wonderful

[Saint Stephen]

Just frickin' wonderful. In every version of the browser, totally massive security holes, all announced at the same time. Sheer beauty.

Get to cuttin, boys!

Oh I have to enable javascript on the site?

[McNihil]

oh well... most if not all sites that I frequent that use javascript I tend to trust... if they have a backend exploit then they would rather take other info without bothering us web surfers.

Sounds like Terrorist to me.

[3seas]

cookie STEALING, page HIJACKING, memory CORRUPTION, code EXECUTION, and URL bar spoofing ATTACKS.

So where the fuck is home land security when you need them.

Re:Sounds like Terrorist to me.

[Anonymous Coward]

what's so terrible about urls?

Re:Sounds like Terrorist to me.

[Anonymous Coward]

The letters were already capitalized?

Re:Sounds like Terrorist to me.

[Anonymous Coward]

> So where the fuck is home land security when you need them.

They're out guarding all the game stores on the off chance that someone foreign looking comes in to buy a copy of MS Flight Sim.

Re:Sounds like Terrorist to me.

[l0cust]

Its terrible because its just a nerdy way of saying 'Ur Real Life', and I don't have much of it you insensitive clod!

Re:Sounds like Terrorist to me.

[HydroPhonic]

Urls home to Russian missiles. Must them nuke from orbit; is only way to be sure!

Go old NoScript

[Nutsquasher]

Keeps all of that Firefox JavaScript nastiness at bay, plus flash ads to boot. :)

Re:Go old NoScript

[MightyYar]

I wish NoScript were the default behavior.

Re:Go old NoScript

[Bender0x7D1]

Yes, that is a solution, but it isn't a good solution.

If we continue down that line of thought we end up at the point where we just go back to static pages with no scripting. Now, in general, I prefer static pages without all the extra "eye-candy", but I also understand the benefits of having scripting, (and even flash) running. By even having a preference for static pages, I think I am in the minority of people on the Internet. Let's face it, the average person likes all of the "extras" that come with scripting.

With this preference for synamic content, we also have to accept that there are going to be some security problems. We can blame Microsoft. We can blame the users. We can blame the Flying Spaghetti Monster for forsaking us. We can blame the hackers who produce the infectious content. However, what matters is that with new things on the web appearing so quickly, there hasn't been time to stop, take a deep breath and look for the security holes that exist. This means that the bad guys have the advantage and we have problems. If you don't like it, use Lynx and practice safe hex.

Re:Go old NoScript

[MLease]

When I want to allow flash or a script to run, it's easy enough to do. The point of NoScript is that nothing runs without my explicit consent, just because I happened to visit a website. If I allow something malicious to run, it's my own fault.

-Mike

Re:Go old NoScript

[Anonymous Coward]

If we continue down that line of thought we end up at the point where we just go back to static pages with no scripting.

Could we? Please?

The only good uses for client side web scripts and flash:

• Disguise lack of content
• Pitiful attempts to make "web applications" not seem like cluster fucks

When are people going to wake-up to this bullshit? "Web apps" give you all the performance of regular apps running on an old 286, with half the features. Wow!

"Web applications" are abuses of HTTP and HTML. It's not clever, it's just fucking dumb.

Re:Go old NoScript

[tomhudson]

"When are people going to wake-up to this bullshit? "Web apps" give you all the performance of regular apps running on an old 286, with half the features. Wow!"

Hey, I'm running this on a 286, you insensitive clod!

Re:Go old NoScript

[Matt Perry]

It is an excellent solution. Your post leaves me with the impression that you don't know what NoScript is. NoScript is a Firefox extension that allows a user to selectively enable JavaScript for web sites.

If we continue down that line of thought we end up at the point where we just go back to static pages with no scripting.

I already do that. I only have JavaScript enabled for about 20 web sites. I've found out that I'm not missing anything as most web sites function perfectly without JavaScript enabled. If there's a site that just has to have JavaScript to work then I can click a button in the status bar to temporarily allow it for that domain for that browsing session.

I've also learned that many times the only reason that JavaScript is enabled is for some useless effect like fading in and out.

Re:Go old NoScript

[Kelson]

When are people going to wake-up to this bullshit? "Web apps" give you all the performance of regular apps running on an old 286, with half the features. Wow!

The point of web applications isn't performance, it's ubiquity. Hotmail (and remember, it was one of the first big web apps, even before Microsoft bought it) didn't take off because it performed better or had more features than Eudora, Outlook, Netscape or Pegasus -- it took off because you didn't need to install it and you could access it from any computer with an Internet connection and a web browser.

But you knew that, didn't you?

Re:Go old NoScript

[complete loony]

You should try running it on a C64.

Re:Go old NoScript

[jez9999]

You do realise that if you disabled all JS in Firefox, it would no longer function, right?

Re:Go old NoScript

[Giorgio Maone]

You do realize he's talking about the NoScript Firefox Extension, right?

Re:Go old NoScript

[only_human]

I wish NoScript were the default behavior. So do I. After all, this boils down to a philosophy -- which is a better default javascript permission list for a website you've never been to before: a whitelist, or a blacklist?

P.S. Why is the parent moderated troll? Others are expressing the same thing on this very page.

Re:Go old NoScript

[darkwhite]

Also makes a bunch of websites not work and you with no way to figure out whether or how they were supposed to work in the first place.

Doesn't work...

[TheRealPhilKenSebben]

if Javascript is turned off. Move along, nothing to see here.

Re:Doesn't work...

[Anonymous Coward]

Neither do many web sites.

And Elinks

[gumpish]

No holes for elinks? Oh well...

(sits back in corner with large grin on face)

Re:And Opera

[Anonymous Coward]

Try using a... I don't know RECENT VERSION.

not just browsers...

[X10]

Train stations have bugs too, apparently.

Re:not just browsers...

[larry bagina]

Kathleen Fent's crotch has bugs too.

read b4 clicking, warning , danger !

[weighn]

http://impoll.net/cgi-bin/v.cgi?p=1585&r=0
http://impoll.net/cgi-bin/v.cgi?p=1585&r=1

following could cause cookie stealing, page hijacking, memory corruption, code execution or URL bar spoofing attacks !!

Re:And Opera

[MyLongNickName]

What version are you using? I haven't noticed this behavior.

I have, however, noticed Firefox 2 crashing a lot more than it used to.

AND LYNX!

[Anonymous Coward]

No holes for Lynx? Oh well...
(sits back with biggest grin on face)

Re:AND LYNX!

[SharpFang]

Did they patch the LYNXDOWNLOAD:// URL vulnerablity yet?

Re:And Opera

[Carlinya]

I'm using the latest version of Opera (9.21), and it takes up more memory and crashes more often than FF does. In fact, sometimes opening two heavy flash windows causes it to be unresponsive and then crash shortly afterwards.

Re:And Opera

[Anonymous Coward]

And I'm browsing with Konquerer!

(struts around smugly until his browser crashes due to some plugin incompatibility bug)

And Natalie Portman?

[larry bagina]

3 holes in Natalie Portman? Oh yeah!
(sits back with the biggest grin on his face)

Re:And Opera

[Lisandro]

I had Opera crashing on me on, say, 50-60 times in the past 5 years i've been using it (back from version 6). Of those, 60% were issues with that piece of shit Flash plugin for Linux, and even that got much better. Opera crashed? No problem, just hit "resume" when you restart.

Opera is as stable as FF (and way more stable than IE) with a fraction of the system requirements - and faster than both. Try an up to date version, you'll be surprised.

Does this require javascript to work?

[sycomonkey]

I'm not familiar with iframes, but would not running javascript on untrusted webpages protect from this?

Re:Does this require javascript to work?

[Giorgio Maone]

Yes, disabling JavaScript on untrusted sites (or better said, enabling JavaScript only on trusted sites) protects from this. All these exploits work only if JavaScript is enabled on the attacker's page.

Firefox 1.5

[vanyel]

And they want to drop support of 1.5 this month, when 2.0 isn't even really ready yet? When did Microsoft take over the Mozilla Foundation?

Re:Firefox 1.5

[bunratty]

2.0 has been out since November. I reported one problem in it (actually a problem that was worse in 1.5 and partially fixed in 2.0) and the problem was fully fixed in 2.0.0.1. It's been working great for me. In what way isn't it "really ready yet"?

Re:Firefox 1.5

[vanyel]

See parent article.

Re:Firefox 1.5

[bunratty]

Security researchers find security vulnerabilities in all browsers. Just two weeks ago Opera fixed an arbitrary code execution vulnerability. I suppose by your standards no browsers are ever really ready yet.

First to fix?

[doctor_nation]

Anyone want to wager on who has this hole fixed first, IE or Firefox?

Re:First to fix?

[Nero Nimbus]

I think this is probably some sort of public science experiment to see who can fix what first.

Re:First to fix?

[KarmaMB84]

Microsoft has to be a lot more careful about breaking third party crap with a browser fix so obviously Firefox will get patched first.

Re:First to fix?

[Nazlfrag]

Well not to mention the first party crap they might break by having the browser so closely integrated into the OS.

Re:First to fix?

[man_of_mr_e]

You might have a point if they were the same bug on both browsers, but they're different bugs in different browsers, so obviously time to patch will vary depending on difficulty of the fix.

opera crashes once a month?

[Anonymous Coward]

that is not stable.

Very Often

[Anonymous Coward]

Most of the malware is for IE, but it's quite frequent for an advertising network or such to be compromised and to send out infected ads. Plenty of websites and ad networks have been hacked for no apparent reason other than to infect people. It's far from the only way they trick people, of course. They like to require special software to use their smileys, screen savers, programs to download some site's crap (especially for porn, like the porn dialers from the days when modems were common), fake anti-virus and spyware tools, etc. If you have to download some special tool to use a site, and it's not a well-known thing like a common media codec or something to extract RARs, etc., it seems like it's almost certainly illegitimate.

That said, I personally have not been affected, but I use Firefox (which has the less critical holes) + NoScript (which completely blocks the holes in TFA, not to mention many others). And even if they did get the exploit to work and had it steal my cookies, there's hardly anything in there because all cookies get deleted when I log out. And I have Adblock Plus, so I'm not going to get hit by any compromised ad networks or whatever to begin with, especially because I'm incredibly mistrustful about what programs I install.

If you want a blog to read, try F-Secure's blog.

Slashdot responses

[Frankie70]

1) If Article Posted about IE security bugs
    - Regular mudfest, everyone throwing mud on Microsoft
& IE. Everyone saying I have FF/Linux/Safari whatever,
so I am safe. Nobody talks about changing settings,
disabling javascript or Activex as a good workaround.

2) If Article Posted about FF security bugs
    - Lot of workarounds posted - disable Javascript,
get some plugin, change some settings, don't go to
the website etc. How great that the it is open source,
someone will fix the bug in one hour & release patch.
Bugs are avenues to show how great open source is.

Now both are posted together, let's collate responses
at the end of the day

Re:Slashdot responses

[GoodbyeBlueSky1]

That was awesome. You know, I'm not even going to read any further down the page, I think you've said all there is to be said.

Re:Slashdot responses

[Anonymous Coward]

You know, EVERY time any story is posted about Mozilla, the nutjobs like you come out of the woodwork attacking Mozilla and you ALWAYS get moderated up to 5 for it. So now that you guys have been doing this for, oh about 5 years now, can we finally STFU about some perceived bias against poor wittul Microsoft on slashdot?

Re:Slashdot responses

[beyondkaoru]

ok, i use firefox cuz 1) i'm on linux and 2) i love the plugins that are available (noscript, adblock, etc)

anyway, this is a question out of curiosity, is there a no-script kind of thing in ie? i mean, selective disabling of javascript. i'm guessing that aside from ideological issues with ie a lot of the stuff on /. about it are that we just don't know much about being a power-user in it.

anyway, for anyone who wants to write a browser, it seems like an incredibly complicated thing to do, what with trying to maintain compatibility and all. personally, i think it would have been nice if a browser was expected to work like a compiler does; checking input for correctness and rejecting it outright if it doesn't 'compile'. with all the corner cases that a browser must accept due to different browsers' inaccuracies, and javascript/flash/whatever on top of that i'm not really surprised that there can be bugs.

on a side note, if we could purge the web of javascript (and replaced parts of it with xml-stuffs or css or something else), well, maybe we'd all be better off.

Re:Slashdot responses

[Anonymous Coward]

Actually yeah there is, you can organise sites by trust levels, at the low level of trust you simply say I will not allow script execution. Works very well in IE and has for a long long time. People just seem to complain as by default it is not all done for you, but if you actually take a look IE is extremely configurable.

Re:Slashdot responses

[kurokaze]

Thank You.. I was going to post the fact that Yes, you can mimic the same functionality of NoScript for FF in IE via the different Zones under the Security tab.

Hell, you can lock down the Internet Zone so that nothing my text shows up.... and leave everything open in your Trusted Sites Zone.

Re:Slashdot responses

[Yfrwlf]

Yes that's a great summary, and regardless of whether or not Firefox or IE is first to be patched, at least Firefox CAN be patched by us, instead of relying on one single company. 0p3n 50r53 15 t3h b35t 4 h4x0rz. Even if it's not actually...you know...hacking. Go go grey hat machine!

Re:Slashdot responses

[Anonymous Coward]

Sure glad I'm still using Safari.

Re:And Opera

[Xeriar]

Quicktime's FF plugin seems to be insanely unstable. I can only play a few files before it crashes Firefox. Otherwise it's been rock solid (aside from this exploit deal).

crashes: probably exploitable

[r00t]

A damn lot of crashes are exploitable.

Even something as harmless-looking as a NULL pointer read can indicate an exploitable crash. It may mean a stack overflow. It may just be a NULL pointer read, which is (almost unbelivably) exploitable on Windows because of the way plug-ins and exception handlers work.

Re:crashes: probably exploitable

[Lisandro]

On my experience, most of the crashes are plugin related. I was conservative with the (pulled off my ass :) 60% figure - Flash, until recent versions, was a guaranteed way of hanging your browser. I had some memory leaks back with version 7, which were promptly fixed in an update, and a crash when you opened and closed tabs in a certain way, which was also fixed quickly.

Other than that, i can't honestly recall major problems with Opera. Not that i had a lot of issues with Firefox either (outside Flash, that is), but it does run much faster and with less memory requirements.

Re:crashes: probably exploitable

[Kelson]

I've actually found Flash to be less stable lately. It's not uncommon for a couple of Flash ads to start chewing up all my CPU until I have a chance to close the tab.

I'm seriously considering backing down to Flash 7, despite the horrible audio sync problems with the Linux version.

Re:And Opera

[QuietLagoon]

Opera just randomly crashes and then has a default behavior of restarting the site that causes it to randomly crash.

More than likely, Opera restarts with the site before the one that caused the crash.

Unfortunately for Opera, most sites are written according to IE's buggy standards. While Opera does try to accomodate the poor HTML written by web programmers who think the Internet is viewed only through IE-colored glasses, sometimes it is difficult to accomodate to flagrant stupidily that is IE's rendering engine.

probably NoScript

[r00t]

You're a rare weirdo. Much of the web won't work without scripting, or at least won't work well.

You're missing out on the nicer wiki/blog editors, live updates to the price of a computer purchase as you add/remove components, tolerable web mail interfaces, and (if your CPU is fast) the experimental slashdot interface.

Those are just the nerd things. I'm told there are numerous non-nerd things on the web as well, with far more scripting.

Re:probably NoScript

[MightyYar]

But you can use NoScript and still allow useful scripts... that's the whole point! The whole advantage of NoScript is that you can click on any shady site that you wish with little-to-no chance of compromising your machine. Presumably, you won't allow scripts from said shady site... when you get to YouTube and the videos won't play, then you enable scripting.

Re:probably NoScript

[Barny]

Yup, noscript doesn't let such nasties run, unless you give them permission, which seems to be half the problem for most internet users.

As for the person saying noscript is hard to use, its usually a matter of just clicking the script item (like a youtube vid that is being blocked) and it allows it to run temporarily, should be built in standard imho.

Combine it with a nice ad server blocker (kerio personal firewall for instance) and the web just suddenly starts working as it was meant to :)

Re:probably NoScript

[MightyYar]

...which seems to be half the problem for most internet users. Yeah, I really don't see any software product that will solve social engineering tactics.

Re:probably NoScript

[Doctor_Jest]

I'd rather decide which scripts run, and which do not. Noscript does that and does that well. I won't install Firefox without it. :)

Re:probably NoScript

[KoldKompress]

I've got the solution. Make a Sudo-esque command which means they have to enter a password to run a certain thing, such as Javascript, but don't accept any password they give. At all. Ever.
Bam! Problem solved. People won't be able to mess up their computers that way.. bwahahaha.

Re:probably NoScript

[TheSeer2]

NoScript blocks certain activities by default without any option of re-enabling them. I used to use NoScript but after it interfered with a website I used regularly (this was on my NoScript allow list) I had to abandon it.

Re:probably NoScript

[jez9999]

Combine it with a nice ad server blocker (kerio personal firewall for instance) and the web just suddenly starts working as it was meant to :)

Yeah. Where you have to have 500 subscriptions to fund every site you visit.

Re:probably NoScript

[Onan]

You're a rare weirdo. Much of the web won't work without scripting, or at least won't work well.

On the contrary: if it doesn't work without scripting, it didn't work well in the first place. I haven't seen anything done with javascript that I actually ever want to have happen on my machine anyway.

You're missing out on the nicer wiki/blog editors, live updates to the price of a computer purchase as you add/remove components, tolerable web mail interfaces, and (if your CPU is fast) the experimental slashdot interface.

I suspect that I'm far happier with vim than with any javascript editor, thanks. I'm perfectly capable of managing the simple arithmetic of prices changing as I add and remove items. Given that there are no tolerable webmail interfaces, there's really nothing there to be lost. And slashdot has, sadly, been going in the wrong direction usability-wise for some time now. This hideous CSS-laden version of slash is a big step down from the previous pure html version, and the new new version is worse still. None for me, thanks.

Re:probably NoScript

[Anonymous Coward]

Woops, did someone feel their business model shake?

Re:probably NoScript

[asylumx]

Yeah, but you also can't sit there and call the article FUD because noscript makes it moot. You can disable javascript on any browser.

Re:probably NoScript

[Keeper Of Keys]

You might find they've fixed that. NoScript is under very active development and release a couple of updates a month. I have to agree with all the positive things that are said about it. I tend to enable scripting permanently only for trusted sites which I know require javascript (and smile a smug standardista smile to myself to think that I would never let a bit of javascript functionality go un-fall-backed). You see a lot less ads with NoScript, too.

Re:probably NoScript

[nwbvt]

...not to mention those really cool advertisements that cover the page with a trailer for the next Disney movie, fun scripts written by 15 year olds who don't understand the concept of memory management and cause the browser to blow up after a few hours sitting on the page, and those really useful scripts that disable right clicking on a web page!

In all seriousness, I use noscript, and I don't miss out on anything I don't want to miss. This is because it is easy to mark a script as trusted and allow it to run. Just simply click on the little button on the corner and choose "allow slashdot.org" (sorry, hell will freeze over before I do the same for doubleclick or google-analytics). And as far as those pages written by 15 year olds, well I don't really care if I miss out on whatever neat tricks they have written. In this day and age, running arbitrary scripts from sources you do not trust is no different than downloading and running arbitrary executable programs from sources you do not trust. In fact, that is pretty much exactly what you are doing.

Re:probably NoScript

[Anonymous Coward]

I'm not the GP but I'm going to respond to you anyway because I find the argument for enabling script interesting.

You're a rare weirdo.

I don't even bother with noclick, I just disable javascript outright.

Much of the web won't work without scripting, or at least won't work well.

The web works fine without scripting. A page that doesn't work without scripting simply doesn't work.

You're missing out on the nicer wiki/blog editors

I'll cut and paste or upload from vim if I'm forced to use a web form. I update my "blog" like this `vi ~/.plan`

live updates to the price of a computer purchase as you add/remove components

A properly written shopping cart or configuration app allows updates to quantities and price without requiring javascript. I'm missing out because so-called web application developers can't do their jobs properly?

tolerable web mail interfaces

webmail? The only webmail I use is mailinator.

and (if your CPU is fast) the experimental slashdot interface.

Which I could convert into a browser extension if I wanted that functionality.

Those are just the nerd things. I'm told there are numerous non-nerd things on the web as well, with far more scripting.

Yep, XSS and browser exploits for example!

I don't run script period and I'm nervous enough about having an EXSLT capable browser. There are around 5% of users with script disabled, that number would increase if more people understood the problem and had the technical skills to work around broken web pages. The option is "convenience" OR "security".

Re:probably NoScript

[Anonymous Coward]

What about if someone is able to inject javascript into a page? Does noscript allow for checksumming of scripts marked as trusted or is there still a potential security hole?

Re:probably NoScript

[MightyYar]

You are absolutely correct - the article is not FUD (at least for Windows users). I was simply pointing out that a NoScript user can have their cake and eat it too. AFAIK, Firefox/Seamonkey with NoScript is the most secure way to surf the modern web. Yeah, you are probably even safer viewing the raw html in vi, but that doesn't really take advantage of more modern web technologies.

Now that I think about it, you could probably do something similar using IE and the security "zones", but that's way more involved than clicking a little "allow" icon.

Re:probably NoScript

[Vexorian]

Such an insightful comment, I have survived pretty well enabling javascript only on google, a site I administrate and slashdot. The deal is just use "temporarily enable" when some new site doesn't work for no reason.

It looks like all of these 'serious' vulnerabilities rely on two things:

• The user should go to a page that wants to exploit it, uhhuh well I guess that if the user is a fool his computer will die eventually.
• Requires an XSS hole in some web page.

The good thing about noscript is that even if you enabled google, if there is some XSS exploit in google it is gonna be blocked anyways.

And another plus is that it is way more effective than adblock, since a lot of ads lately are not popup windows but some very sophisticated javascript.

Re:probably NoScript

[Barny]

Or just block iexplore and make lynx the default browser :)

Re:probably NoScript

[r00t]

"live updates to the price of a computer purchase as you add/remove components"

Note: "live"

The price changes immediately. You don't have to press a "submit" button and/or wait for the page to load.

That's not a case of "web application developers can't do their jobs" at all. (assuming they don't trust the price your browser computed!)

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:And Opera

[McNihil]

The problem is on some installs+assorted plugins when it opens up a window with the help of javascript. Running FF2 on Fedora 7 x64 now and it does not behave like that anymore.

Another Firefox vulnerability posted today

[whitehatlurker]

Thor Larholm also announced a Firefox hole today. Wasn't completely patched in the last release.

What OS?

[baomike]

Now I can figure IE is running on a MSFT product, but Firefox is a little more eclectic.
So is this a problem with Firefox on Linux, and on what flavor?

Re:What OS?

[SharpFang]

Firefox is running on its own cross-platform framework and the bug exists in the upper-level layers - javascript, frame display etc. The exploits aren't really bugs per se, they are more of a clever hacks that use existing mechanisms to permit actions they were not meant to. Say, Firefox prevents input into a dialog/field from within javascript, just from the keyboard, but it allows to manipulate the focus, so when you press enter in one element, your keypress gets executed in a different one, say you put a newline in a forum and the keypress confirms installation of an "extension" from an evil site, instead of putting a newline in your post.

Are you sure?

[kybred]

I can't say as I've ever browsed on to a site and found myself the victim of a compromised computer or ended up with viruses that I know of.

There, fixed that for you.

Re:Are you sure?

[Anonymous Coward]

"you have nothing to fear but fear itself" - no

"it's not paranoia if everyone's out to get you" - nah

"good enough for government work" - we have a winner!

Re:Are you sure?

[Anonymous Coward]

Yes I am sure, I have an IQ greater than 7.

Well...

[mattgreen]

I run Microsoft Windows XP SP2, so I am safe. IE users can simply disable JavaScript in the control panel - any user of closed source knows how to do that! Plus, they don't even have to go to the web site. Microsoft will fix the bug by the next Tuesday of the next month, which is an AMAZING response time, don't you think! The best thing about closed source is you don't have hackers accessing it!

Now, as far as Firefox, that STUPID Mozilla Foundation makes some of the most amateur mistakes! They can't even forsee these sorts of bugs! What sort of poor excuse for a QA department do they have over there? I bet they employ high school kids just learning C to write their code for them. And, plus, they have the gall to be open source! I despise them with every ounce of my very being. Everything they do makes my blood boil!

Friends don't let friends install MZ junk!

Re:Well...

[jez9999]

I run Microsoft Windows 95 unpatched, so I am safe. No-one targets this old piece of crap anymore!

Re:Well...

[darkpixel2k]

Up until a year ago, I had a friend that actually believed that logic and ran Windows 95 and connected to the internet via dialup. No virus protection either. He stated that is was perfectly secure because it was so old no one could hack it--and even if they could, why would they want to?

So I promptly sent him an email that tried to load an image from c:\con\con.
He promptly reformatted and installed XP.

Not much better, but at least a minor improvement.

have you ever tried to do anything local w/ flash?

[Anonymous Coward]

i'll give it this, even though it's HIGHLY frustrating when trying to create truly rich experience applications: Flash is now amazingly sandboxed. so much so that it's actually quite handicapped. you can go so far as to disallow hyperlinks from flash domain-wide, as myspace has now done after flash was used in an XSS attack - which, incidentally, is not so much the fault of javascript as it is poorly sanitising input on the part of web developers.

Re:And Opera

[TitusC3v5]

I would be more inclined to use it if the default QT appearance for Opera didn't look like ass when running under non-KDE environments.

Re:And Opera

[Lisandro]

It looks allright (using the static QT version) under XFCE, which happens to be a pure GTK+ desktop enviroment. Stock configuration - i only adjust toolbars and such.

CrashZilla

[EEPROMS]

Ive renamed Firefox "CrashZilla", it would be nice to browse the web for more than 1 hour without it freezing up or crashing. Yes I have the latest version and all the latest plugins. I have no issues with Konqueror on KDE 3.5.7 (using the same plugins) and Firefox 1.5.* ran for days without crashes.

Re:CrashZilla

[laffer1]

Yes, the newer versions of Firefox seem to crash often. I've had 2.0.0.4 crash on me 4 times today in Vista and it crashes on OS X and MidnightBSD as well. (MBSD is using the linux version) It tends to happen on sites that use plugins. I've seen it with Flash sites, and anything loading quicktime. The linux version crashed on JavaScript heavy sites. I have absolutely no plugins or extensions installed in that version. My OS X version also does not use any extensions.

Safari is crashing in OS X after the last quicktime security update. I think Apple has a problem with it.

I haven't looked at the exploits, but considering both browsers are affected, it makes me wonder if there is a common behavior or something implied in various web standards which led to this problem. Its similar to the image format security issues. Most people were using the same code or at least the same technique to read gif/png/jpeg files. Perhaps its time for an openbsd style audit of the Firefox code so we can avoid some of this in the future.

Re:CrashZilla

[Kelson]

I haven't looked at the exploits, but considering both browsers are affected, it makes me wonder if there is a common behavior or something implied in various web standards which led to this problem.

Nope. The exploits in Firefox and IE are completely separate -- just announced at the same time.

Re:CrashZilla

[Anonymous Coward]

Running Firefox 2.0.0.4, compiled from source, on Gentoo Linux... No issues here!

Re:CrashZilla

[dvice_null]

You probably have a corrupted profile. Try with a new profile. That usually fixes crashes like that.

Re:CrashZilla

[Bazzargh]

The only crashers I get:
- java. some applets seem badly behaved, like the jboss web management console (theres a bug filed for this by someone else) (windows)
- the divx web player. crashes on resize, sometimes on ff/rew (os x)
- javascript (os x and windows)

The last one's harder to pin down, but its usually cos I had NoScript turned off at the time. With NoScript on, none of these issues get me, and the browser is rock-solid. Yes I hear you say, how can you call it rock solid if javascript can crash it...

BTW re the plugin thing, Zack Rusin has been blogging recently about how the plugin architecture could/should be changed on X to avoid badly-behaving plugins crashing the browser, with code. Interesting stuff.

http://zrusin.blogspot.com/2007/05/browser-plugins .html

Re:CrashZilla

[EEPROMS]

This isnt happening on one machine but a few I use and it isnt distro specific either.

Re:CrashZilla

[Anonymous Coward]

I had a similar problem, in the end it turn out to be related to my network driver which I fixed by... installing a new MB!

Re:CrashZilla

[Anonymous Coward]

Yes I have the latest version and all the latest plugins. There's your problem.

Re:CrashZilla

[Anonymous Coward]

Yes I have the latest version and all the latest plugins.

There's your problem.

Exactly. Don't you just love how AC posts that contain the correct answer are completely ignored? You've just got to love the slashdot censorship system.

Overhyped and undertested?

[ericmedici]

I have yet to get the demo to work for the "bait and switch" attack. I'm running IE7 on Vista... Anyone had success getting the demo to work? Scratch that... As I was typing this a dialog prompted me my Google cookie info. OK... this "vulnerability" took over a minute to accomplish and my browser kept navigating back and forth between 2 different sites. It was pretty obvious that something malicious was going on and I hardly doubt that this will be leashed onto many unsuspecting web users. This is one hole that is far stretched... err... fetched.

Re:Poll

[digitalchinky]

Sorry, posting to undo an accidental negative moderation.

with firefox use the noscript extension ...

[geraint-nz]

then the demos don't work :-)

Opera...

[Unavoidable]

Bring out the Opera fan boys... (of which I must deny if asked if I am one... for safety purposes)

Fx/Windows not affected...

[sid0]

while Fx/Linux or OS X are? This had to come some day. :P

Re:And Opera

[feedmetrolls]

Yesterday Firefox crashed on me TEN TIMES!!! Today it was about five. Before yesterday, hardly ever. Is it time to finally make the move to Linux? I think Ballmer has finally grabbed my browser by the balls, and there's nothing I can do...on Windows at least.

Me too: Javascript is evil

[Charles Dodgeson]

I don't know if anyone has done a count, but it seems like every time I look at a report of a major security problem in some browser it is Javascript or ActiveX or something similar where the browser locally executes code served up by the server.

We all knew back in the early days of Javascript that it would be a security nightmare. But we (collectively) went ahead with it. We put together web pages that depended on it, so browsers had to support it and users had to enable it. Now we've waited so long that it seems impossible to undo what we've done. But maybe it isn't completely impossible to undo. And keep in mind that the longer we wait, the harder it will be to undo.

Command line? Hah!

[spun]

You young whippersnappers and your fancy shell doo-dads. In my day, we had to lick a live 10Base5 cable to browse gopher and that's the way we liked it!

Re:And Natalie Portman? - yeah but...

[Anonymous Coward]

3 holes in Natalie Portman? Oh yeah!
(sits back with the biggest grin on his face)

but do you have pics of her sealed up air-tight?

Psst... Hey AC, your bias is showing

[aussie_a]

If we're going to require that the most secure OS for IE7 be used to test it, shouldn't we use the most secure OS for Firefox 2.0 be used to test it? If so then a Linux distro is required for Firefox and none of these holes work (or so people here claim, if you've got evidence to the contrary I'd be interested to hear it). Or we could simply use the most common OS that IE7 and Firefox is used in, which would be XP. Your choice.

Re:Psst... Hey AC, your bias is showing

[Anonymous Coward]

iFrame hijacking works. except, y'know, if you close the "pop-under" which isn't one with my Firefox settings. What with JavaScript not being allowed to raise and lower windows and all that.
What are the default Firefox 2.0 settings for JavaScript? I seriously hope all boxes for what it's allowed to do are unchecked by default.

Re:Psst... Hey AC, your bias is showing

[Thundersnatch]

none of these holes work (or so people here claim, if you've got evidence to the contrary I'd be interested to hear it).

I think you meant "If so then a Linux distro is required for Firefox none of these exploits work". The holes (vulnerabilities) are almost certainly still there in the code base for FF on Linux, but the exploit code needs to be crafted differently for the non-Windows OS. It very likely that creating exploit code for the Linux versions of these holes is trivial.

I'll bet you the same exploit code wouln't work on the Itanium versions of Windows, either. But the holes are still there.

Re:And Opera

[Kelson]

It's a bit simplistic to assume that $browser will always keep you safe. On the other hand, it's important to remember that there are many alternatives available. The good thing about this is that each engine has its own vulnerabilities, so for the same malware to target Firefox, IE, Opera and Safari, it would have to target four different exploits. At least with intended behavior of HTML/DOM/CSS, Gecko, Trident, etc. are (ostensibly) aiming at the same target.

Ever notice that the only vulnerabilities which are really cross-browser tend to be misuse of functionality (like the Unicode domain spoofing attacks a few years back), rather than exploits of bugs?

Re:And Opera

[lastchance_000]

That's because it's Insanely Grrrrreat!

Using them less?

[Kelson]

Is it just me, or are the more humorous / inane tags showing up less? "duh" "haha" "itsatrap" and friends. Is this because the slashdot editors changed something, or because people are using them less?

My first reaction was that people had gotten bored with the joke tags. This is the internet, after all, and internet fads fade with time just as the real-world ones do -- faster, even.

Then I remembered that a few days ago I saw people commenting on pouring hot grits down pants, and petrified Natalie Portman (though admittedly this was a Star Wars thread), and realized that on Slashdot, old jokes don't fade away.

One might even say, in Soviet Slashdot, old memes forget you!

Re:Using them less?

[Adambomb]

and internet fads fade with time Really? I am not sure I agree.

Re:Using them less?

[Anonymous Coward]

Forget threads from several days ago... the Natalie Portman jokes are here, in this very thread!!!!

Nooo!!!

Dantooine! They're on Dantooine!

Re:Using them less?

[Anonymous Coward]

In Korea, only old slashdotters forget the old memes

Re:Plug it

[Anonymous Coward]

BTW, mark that one NSFW. I must be new here, I haven't seen that one before. OMG. Is that goatse in another pose? I dunno if there is anyone else whose ass is that gaping... Well if I were a slashdot editor I'd make that a new front page icon. But alas people are entirely too serious much of the time...

Re:Me too: Javascript is evil

[beyondkaoru]

i definitely agree; there's so much complexity to securing a browser regarding javascript (since the javascript concept is essentially innately insecure), i definitely feel that moving to a static-er web would make sense. additionally, without having to develop things with javascript, developers could put more effort towards more useful things, or experimenting with newish interesting stuff like xhtml (and xlink's embed feature, so we can have the 'slashdot new discussion system' types of things without javascript, maybe)

No holes?

[Kelson]

No holes for Opera?

Are you serious? Have you looked at that icon? There's a huge hole right in the middle, and no one seems to acknowledge it!

Re:No holes?

[6Yankee]

No, there's no hole there. But, just to show where it would be, they drew a circle around it.

I've had something similar with nedstat ...

[freaker_TuC]

I've been using their "free" basic service for years; it was always their small little 16x16/32x32 icon; not really intrusive.

Then suddenly my pages using their stats service had a nasty pop-under. I've seen this at other sites too and found out the "new" advertisement ways after a few weeks when I started getting bothered seeing the same pop-unders over and over while I wasn't even on any other sites.

These pop-unders were all activated under Firefox and it's clearly in their TOS they can advertise on websites; only; which I had on my website was all except "good" for my site; the pop-under involved pornography because of a reference to some articles about STD's a couple of years ago. It made me sick to always get that XXX-commercial on my own website and got rid of Nedstat ever since.

webalizer for the win! less eye candy but still enough stats to chew on without all the nastyness...

WoW password stealer

[Myria]

Cue website installing a WoW password stealer in 3, 2, 1 ...

Re:Poll

[Anonymous Coward]

posting ac will do it, and you can moderate the discussion properly after doing so

JavaScript itself is secure

[Anonymous Coward]

So secure in fact, that you could write an operating system with full memory protection and filesystem access control in it. It only needs threading, but no doubt someone has already figured out a way to do that, probably by letting the host application add some needed functions to the object model. There is nothing in the JavaScript language that is inherently insecure. Perhaps implementations can be buggy, but then again, HTML or CSS implementations can be buggy too.
The security holes are usually not within JavaScript, but within the obscure, convoluted object model that has become the standard, most often some way of having the browser fetch pages from other websites as if the user loaded them or similar loopholes. That these are possible at all is a major design flaw, but, and I'll say this again, it's not a flaw in JavaScript.

Re:JavaScript itself is secure

[mrcaseyj]

>JavaScript itself is secure

No, I don't think JavaScript is secure. It's not because of a flaw in the language specification or in the security model or something like that. It's the very idea of JavaScript. A programming language executed in a web browser is dangerous. It wouldn't matter if it was PythonScript or VBScript or LispScript or FlashScript, it would be a bad idea because it would be practically impossible to implement securely.

Re:And Opera

[Anonymous Coward]

And Safari?

I can't reproduce the last one

[z-j-y]

Windows XP, IE6, FF2

the first and second ones are pretty scary. the 3rd one is kind of silly to me.

by the way, this is a test page I wrote, stealing your slashdot cookie by exploiting vulnerability #1: slashdot_hack1.html. once clicked your session will be kicked out because I pwned it. tested under IE6

lets be pro-active

[andy_t_roo]

"Upon completion of this investigation, Microsoft ... may [issue] a security advisory"

Re:alternatives GETTING BACK TO YOU giorgosts

[Anonymous Coward]

First off, thanks for replying & sorry for my late reply (busy & it's late now, here goes):

I tried it, & didn't see it! NO PROBLEMO here, & I checked for "error #3" you mentioned, on Mr. Zalewski's actual referring page...

SOME BACKGROUND INFO. HERE (I assumed you were on Win32 yourself by the by, like I am) FOR ANYONE WHO TRIES THIS TEST ON A WIN32 RIG & OPERA:

Here I am running Windows Server 2003 SP #2!

(A personally 'security-hardened' model I have been working on for many years since the NT 3.5x days onward to this version of the OS)

It has been way, WAY hacked up for security via things like:

1.) IP security policies (modded AnalogX one, very good)

2.) SCW was run over it first to help security it (SCW = security configuration wizard, & it's pretty damn good believe-it-or-not, @ least, as as starting point)

3.) PLUS, this version of the OS has a hardened IE6/7 by default (which can be duplicated on other Win32 OS versions, because it mainly just does what I have been doing for a long time & noted by myself earlier, in stuff like turning off ActiveX & scripting of all types by default)

4.) General security policies in gpedit.msc/secpol.msc

5.) Tons of security & speed oriented registry hacks (reconfiging the OS basically - stuff like you might do in etc in UNIX/LINUX I suppose)

6.) AND std. stuff like AntiVirus (NOD32 latest) + SpyBot as my resident antispyware tool running in the background!

7.) Many services I do not need are either cut off OR secured in their logon entity to lower privilege entities (from default, near "ALL POWERFUL" SYSTEM, to lesser ones like NETWORK SERVICE or LOCAL SERVICE), see this URL where I did a lot of research for a prebuilt list for another forums, to see how/why this works:

http://forums.techpowerup.com/showthread.php?s=518 74ee73e9a212bfbabbaba41cf36e3&t=16097

(And, of course, the user feedback on its effectiveness, as well as MacOS X, which uses the same general principals)

8.) Plus good email client practices like using .txt mail only, no RTF or HTML mail, not opening or allowing attachments unless I know the person (still gets email scanned though)))

As is now? I score an 84.735 on the CIS Tool 1.x (Linux, MacOS X, Solaris, & other OS models ports of this are available too by the way - not really "ports" strictly speaking, they require JAVA to run), from "The Center for Internet Security" here:

http://www.cisecurity.org/bench.html

Ah man... There's SO MUCH MORE I do to secure this, but too much to list really!

(I am sure I am overlooking some stuff, details & such - things like the fact I use a LinkSys/CISCO BEFSX41 "NAT" true firewalling router with cookie & scripting filtering built-in @ the hardware level), but that IS the bulk of it!)

ALL for security... & this post is especially for background to anyone on Win32 that DOES show an error in this test, as giorgosts on Linux did (to whom I am responding).

So, based on my test?

This has to be script related, because I did not see it @ all (no action from err #3 reported on Mr. Zalewski's page (and I did not think I would, because I keep scriptings of ALL kinds generally turned off 99.999% of the time in my webbrowsers on the public internet @ least)).

Good news!

(Above all - Thanks for your response & data)...

I would write more, but it is VERY late here, & time for shuteye!

APK

hii

[sussane]

This Freaking IE is never ever secure. Its really a worthless app. I use Safari and firefox...

Making Scripts Optional

[IBitOBear]

I use NoScript all the time. If I get to a page who's scripts I _want_ I allow them, or temporarily allow them.

I don't miss much except for the bullcrap. Yea, it takes all of a keystroke or a context menu selection whenever I decided I want "the full web experience".

The truth is, most of the time, nobody _wants_ "the full web experience."

Live and Learn... give it a try for a while and you will get hooked (unless you are incredibly lazy, which I am also, sometimes. 8-)

Brilliant

[zCyl]

ok, i'm not a web developer so i wouldn't know, but is there any way to force your advertisers (malicious or otherwise) to not use javascript/flash/whatever? since it's essentially running code we don't trust on the client's computer...

essentially, do the noscript thing on your own servers, or host ads (i assume they're mostly just pictures with links) on your own servers somehow.

That's the most brilliant idea I've seen in this entire thread so far. We need a <noscript>, or perhaps a <sandbox></sandbox> tag which allows us to specify what can be done inside of a frame, embedded object, or anything else linked to from a remote site.

That would make a huge difference.

Re:Brilliant

[cryptoluddite]

Except the inserted script can just close whatever tags you are using... for instance if you have:

[outer] [inner noscript=true]
insert here
[/inner] [/outer]

They can just insert "[/inner] badscript [inner]" and it still parses correctly. It may not render well, but the script still runs and they can cover over areas that don't render or fix it in the DOM with their script. To counter, the noscript tag could have a random value in the that must be the same in the close -- this way they would have to guess what the value is in order for the parser to actually turn scripting back on. Like this:

[outer] [inner] [noscript id=1203526/]
insert here
[noscript id=1203526/] [/inner] [/outer]

But the only real ultimate solution is not mixing scripts inline with the layout though.

Re:Brilliant

[AaronLawrence]

If you read the PDF from Brendan, there is a hash code as an attribute on the "innner" tag which the browser matches up. This means that generic code could not be used to close the inner tag, so spyware via general-purpose ads would stop working.

Re:Brilliant

[Kelson]

One way to work around this would be to disallow HTML in the embedded content and use another markup language instead, such as BBCode or WikiCode. Then the host site will convert the BBCode to HTML, and can pick and choose exactly which tags it will allow.

Re:Brilliant

[zCyl]

That problem is easily fixed by having an id tag like you suggest, and then matching the noscript or sandbox tags from the OUTSIDE in. Then even if the closing tag is matched correctly, it still does not close the sandbox, because it is not the one on the outside. The web developer would then simply have to have unique id tags for each top-level sandbox for the page.

Re:Opera ftw

[zCyl]

I will never get it what is it with people that they will fight over whether white or black bread is better when they can have cookies.

Because if the cookie is made of plastic, then it might be difficult to chew.

Epiphany?

[chemaja]

Is Epiphany affected? (My install of Epiphany (Debian Etch) is using a gecko-1.8 backend, according to Help >> About)

Re:Epiphany?

[SharpFang]

The bugs are not in the rendering engine, they are in the user interface design and protection mechanisms. These are exploits against currently protected features, except the protection is being circumvented.
(when installing an extension, you see a timer counting down before you can click "OK". So if we focus that window on keypress of Enter, the keyup event and the actual keypress will go to the OK button, not to the TEXTAREA you were using before.

Re:Epiphany?

[luk3Z]

I use K-Meleon so I theoretically safe ;) Don't I ?

mod parent up. (possibly gp)

[Xiph]

mod parent up. (possibly gp)

Mod parent up!!!

[TheThiefMaster]

I had mod points a week ago, I wish they hadn't expired.

This is an awesome idea, and we need it!

Re:alternatives GETTING BACK TO YOU giorgosts

[giorgosts]

http://img367.imageshack.us/img367/9813/snapshot9j p4.png

You mean "Home Page" security

[giafly]

homeland security is a fairy tale.

Sounds like...

[Rocketship Underpant]

Sounds like the US government to me. :)

Doesn't seem to bother us

[myxiplx]

Here at work we use IE6 on XP SP2 workstations and not a single one of those vulnerabilities affects us.

Why? Because we don't let IE run scripts of any kind unless it's from a site we trust. IE has had security zones for years yet hardly anyone uses them. A single group policy object enforces our list of trusted sites, nobody's computer can run javascript on any site we've not already decided is safe.

Ok, there's a small risk of someone hacking one of our trusted sites, but I can live with that.

So far we've had 2 years of uninterrupted browsing, with nobody at our company getting a single piece of malware on their machine.

And the best bit: It's surprisingly low maintenance. We get maybe one request a month now to add a new site to the list.

Re:And Opera

[Anonymous Coward]

It's a bit simplistic to assume that $browser will always keep you safe.

Indeed yes. And as the big targets (e.g. IE, FF on Windows) become more hardened against attacks, malware authors will move over to lesser-used targets. There have been vulnerabilities in Opera, Lynx, in fact probably every browser ever. Almost certainly, some still exist.

Browser security is such a serious problem that my gf not only uses Opera, but uses it within a virtual machine (VMware). The only apps that run outside the VM are "trusted" apps that must be protected from keyloggers, such as WoW. Using this VM scheme means that she is safe from unpatched Opera vulnerabilities as well as unpatched vulnerabilities in other net-facing software such as Messenger, Flash, Winamp and Teamspeak. I just hope that VMware is as safe as it is supposed to be.

Nice Bit of Trolling

[Keeper Of Keys]

You almost had me take the bait.

"This hideous CSS-laden version of slash is a big step down from the previous pure html version"

Wonderful mis-use of "laden" and "pure".

The AJAX-y comment system is far better than the old multiple-page-load model, and I suspect you know it. The point being, as you said yourself, that a site has to work without javascript. But it doesn't have to work *well*.

Re:Nice Bit of Trolling

[nwbvt]

I think you are confused. The fact that he doesn't buy into absurd fads isn't 'trolling', its common sense. Unfortunately thats rare in web users nowadays, so I can certainly see how you are too unfamiliar with the concept to recognize it.

Re:Nice Bit of Trolling

[Keeper Of Keys]

Nice going, Slashdot. Modded up for thinking CSS is an 'absurd fad'.

Re:Nice Bit of Trolling

[nwbvt]

Actually I was referring the 'AJAX-y' bit, but neither Javascript nor CSS is the absurd fad, its how they (like any technology) are used and abused.

Re:Nice Bit of Trolling

[Onan]

I assure you that my comment was sincere, not trolling.

My browser of choice is w3m. w3m handles everything I want out of the web, which does not extend to CSS.

The previous html and frames version of slashdot worked perfectly. These days, however, slash decides to just spew out all of its content in a useless linear order, then use CSS to arrange it on the pager later. Which means that those of us who use non-CSS-speaking browsers get to scroll through a few pages of navbar and similarly useless crap before reaching any of the actual content on any slashdot page.

Perhaps you'll see why I consider this to be a huge usability downgrade. The CSS version provides absolutely nothing new except reduced functionality.

And despite your suspicions of my knowledge, no, I really do not consider the ajaxy comment interface to be superior to loading pages. You seem to imply that loading pages is some terrible thing that one should want to avoid. I would suggest instead that we just serve pages that are not so festooned with ecmascript and whatnot that loading them is a slow process.

Re:Nice Bit of Trolling

[jp10558]

I'm pretty sure that CSS is faster and more efficient (as you don't have to redownload the whole thing every time - and there were several stories that said it would save /. lots of bandwidth charges) for any browser made in the last, what - 7 years?

Re:Nice Bit of Trolling

[Keeper Of Keys]

Well, it was a poor design decision of the Slashdot developers to put the nav content at the top of the markup - standard practise with CSS layouts is for the repetitive stuff to go at the end - but otherwise the markup is clean, semantic and accessible. CSS has so many benefits I can't begin to list them all here, but I bet the Slashdot sysadmin is happy with reduced server loads, so you were defnitely abusing the word "laden". And using tables for layout is a bastardisation of HTML, so hardly qualifies as "pure". I admire your wilfulness in persisting with an intentionally under-specced browser, but you can hardly expect the rest of us to join you back in 1996.

Re:Nice Bit of Trolling

[Onan]

I bet that if you were to enumerate the benefits of CSS, they would all be benefits to the site author or admin. But those benefits to the author come at the expense of greater complexity and lesser functionality to the site's readers. It would also reduce server load if they just mailed out photocopies of the site once a month, but the quality of service provided to the users would go rather downhill.

Your comment about 1996 seems to imply that newer is categorically better. I would suggest that while there's some tendency in that direction, there are very many examples of new technologies that in fact steps backward. In my experience, the sullying of html with css is among them.

They're already working on this

[Giorgio Maone]

Content restriction is hot topic, especially after MySpace debacles:

• Brendan Eich, the father of JavaScript, proposes a <JAIL> tag to block scripting (PDF slides warning)
• RSnake's take on content restrictions proposals.

And for users? good ole NoScript :)

Re:Poll

[Anonymous Coward]

Opera

Wii Browser

[sits69]

Where's the multi-million dollar independent security analysis of the Wii Browser?

*Thinks about it*

Runs on Opera so it's probably fine. ;)

Re:Opera ftw

[sits69]

Because if the cookie is made of plastic, then it might be difficult to chew.

"And in other news today, Opera has admitted that its latest batch of cookies are not perfectly organic. Supporters of Firefox and IE -- manufacturers of Coca-Cola and LEGO, respectively -- have claimed this to be a decisive victory in the battle for healthy nutrition."

"Lynx, on the other hand, continues to insist on a breatharian lifestyle."

Cookie Stealing!

[Anonymous Coward]

Oh, gosh, mister! Please don't steal my chips ahoy, or my oreos! Anything, but that!

Re:And Opera

[Kiaser Zohsay]

It looks allright That's a nice banner ad in your screen shot. I remember those.

Re: NoScript is a ridiculous measure

[Omnifarious]

I don't care what you think, nobody is going to use that extension by default and it will never be enabled by default. Your attempt to make measurements of Firefox security with it enabled are reminiscent of Microsoft's attempts to get C2 certification for Windows NT when it wasn't connected to a network.

The most meaningful measurement of security for an application is looking at the default installation. Most people will never get beyond that.

Re:And Opera

[mdwh2]

Troll?

If this has been only about IE, people would be posting "Use Firefox" all over the place.

Just like everytime there's a story about Windows flaws, we get "Get a Mac" comments modded up. As for the "And lynx too" posts, I could say "Get a Commodore 64" for those articles, which is also free of Windows viruses and security flaws.

For some reason, Opera doesn't fit into the cool "be different" crowd. It can't be an issue of not being open source (which is what people usually say as the reason), since that doesn't apply for OS X.

Re:And Opera

[Vexorian]

Who cares about Opera, seriously? I am more interested in usability than that "speed" thing that doesn't show any result.

One crash in a month is for sure less stable than my experience with firefox 2, of course, it all depends on a lot of random factors so it doesn't matter. But that session thing you mentioned about hitting "resume" is not a great deal anyways, I am not sure that IE7 got sessions though. But I guess it would be pretty lame to restore a session after flash caused a crash, it would just reload the page that caused the crash and make you crash again...

what about the memory leak issue ..

[rs232]

:)

Re:alternatives GETTING BACK TO YOU giorgosts

[Anonymous Coward]

LOL, man... that's whacked: "Evil Script"!

(The name, makes the point though, & thanks for showing me that madness - I believe you)!

APK

P.S.=> I am glad I do not keep JavaScript running on my webbrowsers on the public net typically! apk

Demo didn't work

[nmapper]

I'm running Vista Business 32 with IE7 fully patched. None of the IE demos worked for me specifically the first one marked critical. I guess I feel a little better, but I do believe the vulnerability exists.

Re:And Opera

[wile_e_wonka]

It looks allright

That's a nice banner ad in your screen shot. I remember those.

I'm not sure I understand what "ad" you're talking about. (not only does Opera have built in a feature similar to adblock, you can even use Adblock's list of blocked addresses. However, Opera doesn't come with this list by default. But then again--FF doesn't come with Adblock at all by default)

Odd double standard

[bigwave111]

For how much Slashdotters rip apart the DRM industry, which spends millions upon millions only to have their key's hacked in a day, we sure do expect a lot from our browsers.

That's just for starters

[bill_mcgonigle]

Just frickin' wonderful. In every version of the browser, totally massive security holes, all announced at the same time. Sheer beauty.

Hey, don't worry, there are plenty of undiscovered massive security holes in there too.

Plan your backups accordingly.

Anyone tested Opera?

[abb3w]

Opera has an independent code base, so there's hope. I usually install all three for my users to have on days like this.

(Of course, I worry about it less than many, since half of my people are still using PPC-era Macs.)

Re:And Opera

[NeilTheStupidHead]

Go, go Dillo! It's yet to crash on me. Granted I only use the computer in question to run Folding@Home and the occasional /. post where I need/want to say 'And I'm using/doing <something> under linux right now!'. ^>^

The hard thing about NoScript

[ukemike]

The hard thing about NoScript is when a page totally fails to load anything useful and you have to decide to allow one or more of three scripts each from different domain. Often it is easy, you're on yahoo so you allow yahoo. Sometimes it is far from obvious. To get some yahoo pages to work you have to allow yming.com to run scripts, and you have to pick that one from a list including several cryptically named advertiser sites. I don't mind this extra step, and with the current web model I don't see another way around it, but I hardly expect Joe Casual Surfer to even know what a script is.

Re:The hard thing about NoScript

[Keeper Of Keys]

Agree, totally. Perhaps the NoScript developers should draw up a whitelist which is generally agreed to be safe, with an option to install alongside the extension.

Re:And Opera

[Hymer]

hmmm... we usually post "Just use some other browser" and when you run text-only Lynx is the only browser available.
...and my std. question for people comparing an UNIX with Commodore 64 is "What exactly do I need a GUI for ?"

Opera is safe !!

[Nicolay77]

The google groups IFRAME was replaced in FF and not in Opera.

Once again I'm proud of my choice of browser.

Antivirus for Javascript

[Twillerror]

It seems like it would be pretty easy for the Anti-virus vendors and other anti-malware vendors to tap into the javascript engine and detect these sorts of things.

So you go to www.somecrappysite.com and it tries to run jscript. Then the tool you are running does some analysis and says...hmmm...that seems strange. If it knows it is an attack it stops the page from loading and blocks the page straight up. If it is unsure it can ask the user if they want to continue AND ask the user if they can upload the information for analysis.

I think we should keep IE and Firefox patched up, but realtime analysis seems like a better idea.

Re:alternatives GETTING BACK TO YOU giorgosts

[Anonymous Coward]

Oh, additionally:

I omitted 1 more thing I do for securing a Windows NT-based OS: IP Port Filtrations!

Start Menu -> Connect To Item (on the right hand side) -> Local Area Connection (whatever you called it, this is the default, iirc) open it via double click OR, right-click popup menu PROPERTIES item -> Properties button on left-hand side bottom, press/click it -> NEXT SCREEN (Local Area Connection PROPERTIES) -> "This connection uses the followng items" (go down the list, to Tcp/IP & select it & /click the PROPERTIES button there) -> Press/Click the Advanced Button @ the bottom Right-Hand Side (shows Advanced Tcp/IP Settings screen) -> OPTIONS tab, use it & Tcp IP Filtering is in the list, highlite/select it -> Beneath the Optional Settings, press/click the PROPERTIES button on the lower right-hand side -> Check the "Enable Tcp/IP Filtering (on all adapters)" selection -> In the far right, IP PROTOCOLS section, add ports 6 (tcp) & 17 (udp) -> In the far left "tcp ports" list - check off the radio button above the list titled "PERMIT ONLY", & then add ports you want to have open (all others will be filtered out, & for example, I leave port 80,8080, & 443 here open, only - you may need more if you run mail servers, & what-have-you (this varies by application)) -> I leave the UDP section "PERMIT ALL" because of ephemeral/short-lived ports usage that Windows does (I have never successfully filtered this properly but it doesn't matter as much imo, because udp does not do 'callback' as tcp does, & that is why tcp can be DDOS'd/DOS'd imo - it only sends out info., but never demands verification of delivery (faster, but less reliable)) -> DONE!

You may need a reboot:

I say this, because although IP Security Policies work with the "Plug-N-Play" design of modern Windows NT-based OS' (ipsec.sys) & do NOT require a reboot to activate/deactivate them in Windows 2000/XP/Server 2003/VISTA?

This is working @ a diff. level & diff. driver iirc (tcpip.sys) & level of the telecommunications stacks in this OS family & WILL require a reboot to take effect (for a more detailed read of this, see here):

http://www.microsoft.com/technet/community/columns /cableguy/cg0605.mspx

Enjoy the read, it is VERY informative!

APK

P.S.=> Shows you how TcpIP.sys, ipnat.sys, ipsec.sys, & ipfiltdrv.sys interact, PLUS how you can use them to your advantage in security! apk

and watch Eve?

[Tharkban]

and Eve sends you a video of herself? Hmmm...maybe not so bad.

not at all

[AlgorithMan]

the browsers should protect us against criminals
drm protects criminals against fair use

Re:And Opera

[Lisandro]

Usability is the thing that drew me into Opera in the first place! Mouse gestures, excellent keyboard browsing, pop up panels, notes, quick configurations... you name it.

Re:And Opera

[VJ42]

Quicktime's FF plugin seems to be insanely unstable. I had that problem as well, switching to quickime alternative seemed to fix the bug. if you don't fancy that, make sure it's configured properly, there's a good Mozillazine page on the subject.

Re:And Opera

[Anonymous Coward]

What version are you using? I haven't noticed this behavior.

Really? Currently 9.21 on Ubuntu 6.10, and yeah it's crash-happy. It's a lot like the old Netscape memory leaks, except instead of the system slowing down, Opera just stops responding while its CPU use soars. You have to kill the process, then restart where you left off. Then you're fine for anywhere from 30 minutes to 2 hours. I haven't been able to discern a pattern of sites or behavior that will trigger this crash.

And I haven't figured out if it's related to a handful of issues with it being a KDE app running in Gnome. (Mostly window-focus issues, no show stoppers.) The other extra that doesn't show up in my Windows version is a pause for up to 90 seconds when you click Bookmarks on the Toolbar. (No, the file isn't particularly large or deep.)

So yeah, no joke: Opera on Ubuntu is crash-happy and generally not a good port. The smooth crash-recover behavior keeps this from being bad enough to use Firefox, but when people tell you they're having Opera problems, they're not kidding. It's got a lot of bugs and not one has been addressed in the various upgrades of version 9.

Re:And Opera

[Anonymous Coward]

HTML isn't the problem you tard

No prob for Opera 9.21. And it passes ACID2

[Anonymous Coward]

I'm glad I use Opera 9.21 for most of my browsing.

http://www.opera.com/

But I really love Firefox 2.0 because of the Firebug plugin.

Re:probably NoScript & more

[lpq]

You're a rare weirdo. Much of the web won't work without scripting, or at least won't work well.

Count me as another. Not only "Noscript", but a javascript&cookie filtering firewall set to default block everything not explicitly permitted. That's behind a linux proxy server (windows boxes on unroutable, internal subnet) which is behind a hardware firewall box.

May not be perfect, but I haven't had a break-in yet... (~7+ years managing my own broadband vs. using employer's and their firewall).

CSS

[Keeper Of Keys]

Benefits to end user include:

• faster page download times
• reduced bandwidth usage (still important for mobile devices and others charged by the megabyte)
• ability to customise look and feel of pages (eg for legibility)
• ability to hide unwanted parts of pages - eg ads (Firefox' AdBlock extension does this automatically)
• clean, semantic markup - uncluttered by tables - is easier for assistive technologies such as screenreaders to make sense of

Quicktime on FF

[Keeper Of Keys]

Yep, the Qt plugin for Firefox is a piece of crap. Anyone know of an alternative plugin to play mp3s (I mean, how often do you come across an embedded quicktime file these days)?

Re:And Natalie Portman? - yeah but...

[Anonymous Coward]

sealed up.. air-tight... naked and petrified.. covered in hot grits.

OH LAWD.