Slashdot Mirror
Firefox Spoofing Bug Puts Passwords At Risk
hairyfeet writes "Aviv Raff, an Israeli researcher known for his work in hunting browser bugs, has revealed a Firefox spoofing vulnerability which could allow identity thieves to dupe users into giving up their password. According to Mr. Raff Firefox fails to sanitize single quotes and spaces in the 'Realm' value of an authentication header. Raff was quoted as saying 'This makes it possible for an attacker to create a specially crafted Realm value which will look as if the authentication dialog came from a trusted site.' This vulnerability was shown to be in the latest Firefox, version 2.0.0.11 and until Mozilla fixes this vulnerability Mr. Raff recommends in his blog 'not to provide username and password to Web sites which show this dialog.'"
Hope the Firefox guys can get to it quickly, but it doesn't sound too serious. In the mean time, people need to practice the whole watching where you browse idea.
"Thanks for all the money you paid to us. We've used it to buy off ISO among other things" -Microsoft
Too bad he doesn't want to show an online demo of this, I was kind of getting used to being able to try out these kinds of exploits in my own browser. Call me masochistic.
Ugh, This is basically just another form of phishing. Who follows links to websites that require a username / password anymore anwyay? If I want to go to gmail, my bank, whatever, I'm definitely not going to follow a link from some random website or e-mail. I'm going to type in the URL and login. Don't get me wrong, it'll be good to see this patched - But basically this vulnerability only matters if you're the same kind of person that falls for phishing.
You are using English. Please learn the difference between loose and lose; they're, there, and their; your and you're.
What's really to stop someone from popping up a screen that says "Please enter your PayPal username and password below:" anyway? I mean all they gotta do is set up some simple html page that kinda looks official and you can be sure that you'll get more than a handful of dummies who'll actually put it in. I have to wonder when things stop being considered the fault of the program and start being the fault of the user.
Youtube video mentioned in the article:
http://youtube.com/watch?v=NaCPw1s3GFw
Dependency hell? =>
If you post a message in slashdot containing your username in the first line, your password in the second and three blank lines below, "PWND" without the quotes in the subject line, and post it using Extrans you will get loads of karma. It worked for me.
Welcome to Totalitarianism in the 21st Century!
Fight the power!!!
OMG...
What's this mean for all those who's answer to vulnerability was to block Flash and use Firefox!!!
Who pays attention to realm, anyway?
I've always interpreted the realm as an advisory comment for the dialog box, and used the URL of the website to indicate whether or not I want to give up a password.
Sam
blog.sam.liddicott.com
More problems come from giving the user an identical page hosted on some evil server, in that case the user expects to see the login form.Then again, a bug is still a bug, and the only good bug is a dead one.
your username
your password
Post-rock/Ambient/Drone and other noise.
A spanish website with screenshoots of how this is handled by IE6, Firefox, Opera and Konqueror: http://www.kriptopolis.org/falsificando-dialogos-firefox
exp(i*pi)+1=0
What a coincidence that the security researcher's last name is the same as the browser he is testing!
All of them. No wait, let me check...
Yep, all of them!
Please stop stalking me, bro.
I'm having a hard time calling this a *bug*. I would rather call it a presentation problem.
Then again, what's the problem?
The standard Firefox HTTP auth dialog says "Please enter the username and password for $REALM at $URL". Note the included URL to prevent phishing.
Now what Mr Raff does is basically set up $REALM as "Google Checkout (https://www.google.com) for more details see my page at" and $URL as the domain name he controls. The whole thing looks like: Please enter the username and password for Google Checkout (https://www.google.com) for more details see my page at http://avivraff.com/".
So no, I haven't looked at the HTTP RFC, but I am not sure that forbiding spaces and quotes in HTTP auth realms is the answer.
What Firefox actually needs is just a better, more fail-safe presentation of the data on this dialog.
Just my 2 AC cents (too lazy to create an account for just that)
You can get it here
I'll just stop logging in on web sites until they fix this gaping security hole. Right.
As with all FOSS, the first course of action needs to be very vocal denials. It's always worked in the past... after all, would anyone be using Firefox if we were honest from the start about all the gaping security holes, buffer overflows, and the over 300 memory leaks? Not likely, especially since IE7 is both more stable and secure... and most people already have it on their computers! Also, now IE8 is coming down the pipe, we won't be able to use the "itz notz teh stadtards komplient!!11!!1!" whine. IE8 could very well be the final nail in our coffin... unless we keep lying and spinning to increase Firefox's market share (or at least not lose too much).
So really, we have to deny early and often. And hey, this is FOSS: fixing problems is really secondary. If they don't like it, let them go buy something, the cheap bastages. You get what you pay for.
I am still with 1.5, it's a memory hog and doesn't do everything that the latest version does and I am not even sure that it doesn't have the same vulnerability, but I am just not interested in FF2 and/or FF3 for now. The versions switch too fast all in the name of more functionality but the basic security and memory questions are still unanswered.
Here is the real question: How do you really know that your browser is safe at all? You can download the code and read it, but I believe it is not just about code, but mostly it is about the design. I am thinking a browser should allow me to have some sort of an instrumentation bar, where the information pertaining to security/memory/cpu usage is displayed in useful form. Something like a debug window for communications and various internal functions (extensions / plugins) that shows details of what is happening. I know this is not useful for a normal user, but if this was an option, then the powerusers could monitor the activity of their browser while using it and the vulnerabilities could be found faster. A poweruser could then mark something that is happening in the browser as suspicious and this info could be loaded into the developer site. If the same behaviour is marked as suspicious multiple times, it should then get a priority review.
This could be used to detect problems by more people than are interested in looking at the source code.
You can't handle the truth.
I always use my own bookmarks or type the url of the site i wish to visit & of course I never save any user/passwords in my browsers, I always reccomend to my clients to use password storage software to save passwords never the browser & always use bookmarks, theres so many dogey sites out there now, sometimes i find my clients are afriad to click links on sites after i inform them of all the nastyness out there. just my 2 cents worth.
http://www.lagosportugal.info My favorite website in lagos algarve portugal
http://aviv.raffon.net/2008/01/02/YetAnotherDialogSpoofingFirefoxBasicAuthentication.aspx
and
http://www.kriptopolis.org/falsificando-dialogos-firefox (Spanish)
what power?
The power of voodoo, duh.
I am one of many. My idea is not unique, nor do I expect my voice alone to sway you. I speak in a chorus of opinion.
No, the bug in IE will get fixed in the service pack that comes after Microsoft finds and acknowledges the bug.
Finite state machines with more than a handful of states are hard (whether implemented explicitly or implicitly). They are harder for some people. We can try to make sure that the reinventing-the-wheel need is limited, but it's oh so surprising how often you want something that's only a bit different (or you find the standard interface to be so clunky that you roll your own *guilty smile*).
Damn, i'm confused now. I guess the only right choice would be to reply to your post.
What?
The power of voodoo, duh.
Who do?
- The seller's web site directs the buyer to a third-party payment processor such as PayPal, WorldPay, Amazon, or Google. Seller gives the seller's identity, a summary of the order, and an amount to the payment processor, and redirects the buyer to the payment processor.
- The buyer authenticates to the payment processor, commonly using a password over TLS.
- The buyer inspects the seller's identity claims, the order summary, and the amount, and approves the payment.
- The payment processor deducts the amount from the buyer's account, adds it to the seller's account, notifies the seller of the order number and the amount paid, and presents a receipt to the buyer.
- Buyer is redirected to the seller's web site.
If you always use a bookmark to https://www.paypal.com/ to visit PayPal, how will PayPal know the seller, the order number, or the amount?Rats, I thought something was fishy, them ditching SSL and all.
Don't laugh, Datek (now Ameritrade) used basic HTTP auth until about 2001 or so. Yikes!
Give a man a fish and you have fed him for today. Teach a man to fish, and he'll say "WHERE'S MY FISH, YOU IDIOT?"
Maybe add a warning to the basic authentication dialog box that the username/password is send unencrypted (base-64 encoded).
``This is not an injection bug per se, but more a string parsing bug.''
By "injection vulnerability", I mean and understand "a possibility to 'break out' of a certain datum and thus inject (part of) it into the surrounding data structure, where this is not desired". Is that not what is happening here?
``Parsing needs to be done as long as not all content is implicitly structured. One point in using XML for anything is to avoid doing any parsing on your own. But, think about it, would you like an e-mail address, URL or file path to be a structued list or XML snippet? And could we be sure that the structure is always the right one, so there will be no need to flatten it and reparse it and get into the same old bugs?''
I am not going to answer that, because it is beside the point. XML is parsed, too. What I meant in my original post is that you can create and pass everything in data structures, rather than marshalling and unmarshalling it.
If you _do_ marshal and unmarshal your data structures, of course it makes sense to do so using a robust marshaller and unmarshaller. And a proper API. If, in PHP, you do "SELECT FROM Table WHERE field = $value", you're asking for trouble. Of course, what Firefox does is going to be different at least in the language they use, but the principle along which all these vulnerabilities come in existence is the same: composing data in a way that doesn't preserve structure, and then assuming the structure has been preserved.
Please correct me if I got my facts wrong.
Probably shopping smart: "S" Mart!
Oh no, the Israeli's are stealing our passwords! Quick, someone tell Dear Leader so he can launch a pre-emptive strike.
I hate when I click on a goatse.cx link and it turns out to be a crap link that loads an ad-infested page on the same site that you're on:
[banner]
[popup]
[banner]
SHOP for assholes!
RATE your asshole!
RECOMMEND your asshole to friends!
Read REVIEWS of assholes!
FIND assholes in your area!
COMPARE PRICES for assholes!
Find DEFINITIONS and SYNONYMS for asshole!
100%-free asshole SCREEN SAVERS!
[banner]
[banner]
Sponsored Links:
Looking for FREE ASSHOLES in your area? Click HERE
Assholes repaired at low prices, 100% safe, guaranteed
Need credit? Pull equity out of your asshole today!
[banner]
[popunder]
And you, Wikipedia, you're another one- when I'm in a hurry, I'd like a visual hint that I might see this:
"This article is a stub. You assholes can help Wikipedia by expanding it."
The biggest factor that determines the likelihood for success of any attempt to defraud people is this: How similar is the fraudulent thing to the real thing? After reading TFA and watching the demonstration, this particular exploit would allow a person to modify the text content of an authentication dialog box to fool people into thinking it comes from a trusted source.
To be honest, I can't remember the last time a website I use for personal purposes required a browser authentication dialog for login (including banking, investing, buying stuff with my debit or credit card, etc.). I'm going to speculate wildly here, and assert that most secure logins for personal use occur in HTML forms, and that this exploit doesn't approximate the login activity of most websites, used my most people. Now, some people when confronted with this weird, never-before-seen login "thing" will give it their login and password, but others won't because either they're tech-savvy enough to realize that something's wrong, or because their untrained interweb-spidey-sense goes off. Point is, it's at least an individually-significant issue until the info gets out to enough people.
But the really dangerous potential of this exploit isn't to get somebody's bank login info, or PayPal, or Amazon, or eBay login, or whatever. Think about all the logins that *do* normally use a browser authentication dialog box, like corporate, government, and defense portal sites. This exploit actually more closely approximates a legitimate login identity challenge to systems that impact not just one person, but *lots* of people. Imagine that you're corporate-drone #637, and you've been working on a super-serial secret something-or-other and you get an email from "your IT folks" asking you to log in to the VPN. Oh, they also included a helpful link to do so, and oh, you also happen to be using Firefox.
I think that's the real problem with this exploit.
Fastest, most secure and best features.
He's talking about the standard HTTP Auth dialog. (Good luck refusing to enter your password in any HTTP Auth dialogs -- it's still the most ubiquitous authentication mechanism on the Web.)
SIERRA TANGO FOXTROT UNIFORM
Seen it already, but forgot the website...then I read about this interesting spoof. hahahahaha! Like I am going to put my password in some strange account, but the link that took me there was in a major trusted site.
Firefox Password Manager fell victim to an attack in late 2006.
There, fixed the link (I hit Ctrl-V twice).
Uhhh, you do? (Duh?)
New punctuation update "~" (no quotes) at the end of a line to indicate sarcasm. ~
Thanks for the useful link. It occurs to me that this would throw a flag for most Mac users, who are used to their dialogs descending down from the title bar of the window in an animated sheet. A webpage shouldn't be able to modify chrome, and thus a fully convincing exploit shouldn't be possible for Mac.
Score one for gratuitous eye candy as security feature.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
Mod parent up!
Very insightful indeed. A gem in this forest of blahblah.
The Apache docs, though mostly sufficient for a decent httpd.conf, are not very helpful in discussion like this one.
Aphorisms don't fix code. (Bart Smaalders)
Uhhh, you do? (Duh?)
Do what?
Do what?
your mom
your mum is a better fuck than your sister
(I'm sorry Slashdot, I couldn't let this one go.)
"It does not do to leave a live dragon out of your calculations, if you live near him." - Tolkien