Slashdot Mirror

← Back to Stories (view on slashdot.org)

Firefox Quickies

Posted by kdawson on from the three-twisty-little-items-all-different dept.

First, Gypsy2012 writes with a highly critical security flaw involving both Firefox 2.0 and Internet Explorer, which could allow a malicious attacker to gain remote control of a user's system. It exploits the "firefoxurl://" URI handler. ... Next, reader dsinc sends word that the beta for Firefox 3 has slipped by 6 weeks. The new target date is September 18 at the earliest. The article wonders whether the final release will slip into 2008. ... Finally, reader jktowns points out new anti-phishing features in the latest nightly build of Firefox 3. One of them was added into the code base by the guy who developed the LocationBar2 extension.

1 of 245 comments (clear)

  1. Highlighting phishing sites is nice, but weak by Animats · · Score: 4, Interesting

    Just highlighting domains of phishing sites isn't going to be enough. Here's today's list of domains that "sort of look like Paypal". These are after subdomain truncation.
    "paypal-checker.com"
    "paypal-contact.net"
    "paypal-customize.com"
    "paypal-erreur2.com"
    "paypal-security.com"
    "paypal-web-dll-scrnupdateaccount.ici.st"
    "paypal-web-scrn-dll-pl-dai-pl-webscrndllfs-wertyu i.ork.pl"
    "paypal.powered.at"
    "paypal.q.fm"
    "paypalaccverify.com"
    "paypalcomcgibinwebscrcmd.by.ru"
    "paypalcomcgibinwebscrcmm.by.ru"
    "paypalcomcgibinwebscre.by.ru"
    "paypalconstomers.com"
    "paypalct.com"
    "paypall.ro"
    "paypalmd.com"
    "paypalobjects.us"
    "paypalsecuritycenter.org"
    "paypalverification.org"
    "paypel-acc-5.com"
    "paypilpal.com"
    "paypll-wscr.com"
    "paypluspl.com"

    These are from PhishTank, which blacklists at the URL level based on manual reports. For SiteTruth", we're in the process of converting to blacklisting phishing sites by the entire base domain. That's because we now see hundreds of entries like "session-624333.nationalcity.com.userpro.tw", which has to be treated as a bad indicator for all of "userpro.tw".

    There's collateral damage. There are days when "tinyurl.com" and "notlong.com" get blacklisted, because phishing sites use them. MSN gets complaints about this. Today, anybody running something like "tinyurl" needs to continually check the phishing databases for attempts to abuse their service, or their own reputation is toast.