Slashdot Mirror
Firefox Spoofing Bug Puts Passwords At Risk
hairyfeet writes "Aviv Raff, an Israeli researcher known for his work in hunting browser bugs, has revealed a Firefox spoofing vulnerability which could allow identity thieves to dupe users into giving up their password. According to Mr. Raff Firefox fails to sanitize single quotes and spaces in the 'Realm' value of an authentication header. Raff was quoted as saying 'This makes it possible for an attacker to create a specially crafted Realm value which will look as if the authentication dialog came from a trusted site.' This vulnerability was shown to be in the latest Firefox, version 2.0.0.11 and until Mozilla fixes this vulnerability Mr. Raff recommends in his blog 'not to provide username and password to Web sites which show this dialog.'"
open source is so secure this could never happen, mein fuhrer!
Hope the Firefox guys can get to it quickly, but it doesn't sound too serious. In the mean time, people need to practice the whole watching where you browse idea.
"Thanks for all the money you paid to us. We've used it to buy off ISO among other things" -Microsoft
Too bad he doesn't want to show an online demo of this, I was kind of getting used to being able to try out these kinds of exploits in my own browser. Call me masochistic.
Ugh, This is basically just another form of phishing. Who follows links to websites that require a username / password anymore anwyay? If I want to go to gmail, my bank, whatever, I'm definitely not going to follow a link from some random website or e-mail. I'm going to type in the URL and login. Don't get me wrong, it'll be good to see this patched - But basically this vulnerability only matters if you're the same kind of person that falls for phishing.
You are using English. Please learn the difference between loose and lose; they're, there, and their; your and you're.
Read more about this at the ContactLog Blog
What's really to stop someone from popping up a screen that says "Please enter your PayPal username and password below:" anyway? I mean all they gotta do is set up some simple html page that kinda looks official and you can be sure that you'll get more than a handful of dummies who'll actually put it in. I have to wonder when things stop being considered the fault of the program and start being the fault of the user.
A software is never safer than: * the number of people/resources trying to bring it down * Its popularity With the raise of both options, the number of found vulnerabilities will definitly increase.
It's time to realise that Abble's products are the biggest abomination these days. Just say NO to the dumb iAbble way!!
Youtube video mentioned in the article:
http://youtube.com/watch?v=NaCPw1s3GFw
Dependency hell? =>
If you post a message in slashdot containing your username in the first line, your password in the second and three blank lines below, "PWND" without the quotes in the subject line, and post it using Extrans you will get loads of karma. It worked for me.
Welcome to Totalitarianism in the 21st Century!
Fight the power!!!
The new Mitt Romney campaign ad is a total hoot:
http://www.youtube.com/watch?v=Af1OxkFOK18
OMG...
What's this mean for all those who's answer to vulnerability was to block Flash and use Firefox!!!
Who pays attention to realm, anyway?
I've always interpreted the realm as an advisory comment for the dialog box, and used the URL of the website to indicate whether or not I want to give up a password.
Sam
blog.sam.liddicott.com
More problems come from giving the user an identical page hosted on some evil server, in that case the user expects to see the login form.Then again, a bug is still a bug, and the only good bug is a dead one.
your username
your password
Post-rock/Ambient/Drone and other noise.
A spanish website with screenshoots of how this is handled by IE6, Firefox, Opera and Konqueror: http://www.kriptopolis.org/falsificando-dialogos-firefox
exp(i*pi)+1=0
What..!? Passwords aren't secure... :-0 ! Who'd have thunk it...
...
In other news, Slashdot memes are old, and Anonymous Cowards never get comments approved...
What a coincidence that the security researcher's last name is the same as the browser he is testing!
All of them. No wait, let me check...
Yep, all of them!
Please stop stalking me, bro.
I'm having a hard time calling this a *bug*. I would rather call it a presentation problem.
Then again, what's the problem?
The standard Firefox HTTP auth dialog says "Please enter the username and password for $REALM at $URL". Note the included URL to prevent phishing.
Now what Mr Raff does is basically set up $REALM as "Google Checkout (https://www.google.com) for more details see my page at" and $URL as the domain name he controls. The whole thing looks like: Please enter the username and password for Google Checkout (https://www.google.com) for more details see my page at http://avivraff.com/".
So no, I haven't looked at the HTTP RFC, but I am not sure that forbiding spaces and quotes in HTTP auth realms is the answer.
What Firefox actually needs is just a better, more fail-safe presentation of the data on this dialog.
Just my 2 AC cents (too lazy to create an account for just that)
You can get it here
I'll just stop logging in on web sites until they fix this gaping security hole. Right.
As with all FOSS, the first course of action needs to be very vocal denials. It's always worked in the past... after all, would anyone be using Firefox if we were honest from the start about all the gaping security holes, buffer overflows, and the over 300 memory leaks? Not likely, especially since IE7 is both more stable and secure... and most people already have it on their computers! Also, now IE8 is coming down the pipe, we won't be able to use the "itz notz teh stadtards komplient!!11!!1!" whine. IE8 could very well be the final nail in our coffin... unless we keep lying and spinning to increase Firefox's market share (or at least not lose too much).
So really, we have to deny early and often. And hey, this is FOSS: fixing problems is really secondary. If they don't like it, let them go buy something, the cheap bastages. You get what you pay for.
I am still with 1.5, it's a memory hog and doesn't do everything that the latest version does and I am not even sure that it doesn't have the same vulnerability, but I am just not interested in FF2 and/or FF3 for now. The versions switch too fast all in the name of more functionality but the basic security and memory questions are still unanswered.
Here is the real question: How do you really know that your browser is safe at all? You can download the code and read it, but I believe it is not just about code, but mostly it is about the design. I am thinking a browser should allow me to have some sort of an instrumentation bar, where the information pertaining to security/memory/cpu usage is displayed in useful form. Something like a debug window for communications and various internal functions (extensions / plugins) that shows details of what is happening. I know this is not useful for a normal user, but if this was an option, then the powerusers could monitor the activity of their browser while using it and the vulnerabilities could be found faster. A poweruser could then mark something that is happening in the browser as suspicious and this info could be loaded into the developer site. If the same behaviour is marked as suspicious multiple times, it should then get a priority review.
This could be used to detect problems by more people than are interested in looking at the source code.
You can't handle the truth.
I always use my own bookmarks or type the url of the site i wish to visit & of course I never save any user/passwords in my browsers, I always reccomend to my clients to use password storage software to save passwords never the browser & always use bookmarks, theres so many dogey sites out there now, sometimes i find my clients are afriad to click links on sites after i inform them of all the nastyness out there. just my 2 cents worth.
http://www.lagosportugal.info My favorite website in lagos algarve portugal
Sometimes, injection vulnerabilities make me laugh. I mean, how difficult can it be to just put a string in another string?
Not very difficult, obviously.
And, honestly, it _isn't_ very difficult. It's only when you then go and interpret the resulting string as code that weird things start to happen. The solution is simple: don't treat strings as code. In Lisp, for example, the more natural way to compose the code would be to use list construction instead of string concatenation. That way, you can put whatever you want in the string, but it will never be excuted as code.
But then, of course, everybody loathes Lisp. And smug Lisp weenies. So I'll get modded down. On the other hand, I said I would get modded down, so I'll probably get modded up.
Please correct me if I got my facts wrong.
http://aviv.raffon.net/2008/01/02/YetAnotherDialogSpoofingFirefoxBasicAuthentication.aspx
and
http://www.kriptopolis.org/falsificando-dialogos-firefox (Spanish)
what power?
The power of voodoo, duh.
I am one of many. My idea is not unique, nor do I expect my voice alone to sway you. I speak in a chorus of opinion.
the 'problems' as presented by the 'mainstream' mediahhaha, are homeowners, banks, energy consumption/waste, & now declining employment. none of this connects to the billions per day of maintaining the 'wars', & fudging the weather?
we know there's been a huge cost of life & limb. the rest of it must be 'on the house'.
of course there's some notion that numerous billionerrors are profiting handsomely, no mention of that debacle either.
talk about being bushwhacked, & kept in the dark?
if thinking about such things frustrates you, you might consider signing up for fuddle's patentdead anti-frustration devise, or just continue following the corepirate nazi hypenosys story LIEn. anything of relevance is replaced almost instantly with pr ?firm? scriptdead mindphuking propaganda or 'celebrity' trivia 'foam'. meanwhile;
http://news.yahoo.com/s/ap/20071229/ap_on_sc/ye_climate_records;_ylt=A0WTcVgednZHP2gB9wms0NUE
http://www.nytimes.com/2007/12/31/opinion/31mon1.html?em&ex=1199336400&en=c4b5414371631707&ei=5087%0A
is it time to get real yet? A LOT of energy is being squandered in attempts to keep US in the dark. in the end (give or take a few 1000 years), the creators will prevail (world without end, etc...), as it has always been. the process of gaining yOUR release from the current hostage situation may not be what you might think it is. butt of course, most of US don't know, or care what a precarious/fatal situation we're in. for example; the insidious attempts by the felonious corepirate nazi execrable to block the suns' light, interfering with a requirement (sunlight) for us to stay healthy/alive. it's likely not good for yOUR health/memories 'else they'd be bragging about it? we're intending for the whoreabully deceptive (they'll do ANYTHING for a bit more monIE/power) felons to give up/fail even further, in attempting to control the 'weather', as well as a # of other things/events.
http://video.google.com/videosearch?hl=en&q=video+cloud+spraying
dictator style micro management has never worked (for very long). it's an illness. tie that with life0cidal aggression & softwar gangster style bullying, & what do we have? a greed/fear/ego based recipe for disaster. meanwhile, you can help to stop the bleeding (loss of life & limb);
http://www.cnn.com/2007/POLITICS/12/28/vermont.banning.bush.ap/index.html
the bleeding must be stopped before any healing can begin. jailing a couple of corepirate nazi hired goons would send a clear message to the rest of the world from US. any truthful look at the 'scorecard' would reveal that we are a society in decline/deep doo-doo, despite all of the scriptdead pr ?firm? generated drum beating & flag waving propaganda that we are constantly bombarded with. is it time to get real yet? please consider carefully ALL of yOUR other 'options'. the creators will prevail. as it has always been.
corepirate nazi execrable costs outweigh benefits
(Score:-)mynuts won, the king is a fink)
by ourselves on everyday 24/7
as there are no benefits, just more&more death/debt & disruption. fortunately there's an 'army' of light bringers, coming yOUR way. the little ones/innocents must/will be protected. after the big flash, ALL of yOUR imaginary 'borders' may blur a bit? for each of the creators' innocents harmed in any way, there is a debt that must/will be repaid by you/us, as the perpetrators/minions of unprecedented evile, will not be available. 'vote' with (what's left in) yOUR wallet, & by your behaviors. help bring an end to unprecedented evile's manifestat
No, the bug in IE will get fixed in the service pack that comes after Microsoft finds and acknowledges the bug.
The power of voodoo, duh.
Who do?
- The seller's web site directs the buyer to a third-party payment processor such as PayPal, WorldPay, Amazon, or Google. Seller gives the seller's identity, a summary of the order, and an amount to the payment processor, and redirects the buyer to the payment processor.
- The buyer authenticates to the payment processor, commonly using a password over TLS.
- The buyer inspects the seller's identity claims, the order summary, and the amount, and approves the payment.
- The payment processor deducts the amount from the buyer's account, adds it to the seller's account, notifies the seller of the order number and the amount paid, and presents a receipt to the buyer.
- Buyer is redirected to the seller's web site.
If you always use a bookmark to https://www.paypal.com/ to visit PayPal, how will PayPal know the seller, the order number, or the amount?... in 3 .... 2 ....
Rats, I thought something was fishy, them ditching SSL and all.
Don't laugh, Datek (now Ameritrade) used basic HTTP auth until about 2001 or so. Yikes!
Give a man a fish and you have fed him for today. Teach a man to fish, and he'll say "WHERE'S MY FISH, YOU IDIOT?"
Maybe add a warning to the basic authentication dialog box that the username/password is send unencrypted (base-64 encoded).
Oh no, the Israeli's are stealing our passwords! Quick, someone tell Dear Leader so he can launch a pre-emptive strike.
I hate when I click on a goatse.cx link and it turns out to be a crap link that loads an ad-infested page on the same site that you're on:
[banner]
[popup]
[banner]
SHOP for assholes!
RATE your asshole!
RECOMMEND your asshole to friends!
Read REVIEWS of assholes!
FIND assholes in your area!
COMPARE PRICES for assholes!
Find DEFINITIONS and SYNONYMS for asshole!
100%-free asshole SCREEN SAVERS!
[banner]
[banner]
Sponsored Links:
Looking for FREE ASSHOLES in your area? Click HERE
Assholes repaired at low prices, 100% safe, guaranteed
Need credit? Pull equity out of your asshole today!
[banner]
[popunder]
And you, Wikipedia, you're another one- when I'm in a hurry, I'd like a visual hint that I might see this:
"This article is a stub. You assholes can help Wikipedia by expanding it."
The biggest factor that determines the likelihood for success of any attempt to defraud people is this: How similar is the fraudulent thing to the real thing? After reading TFA and watching the demonstration, this particular exploit would allow a person to modify the text content of an authentication dialog box to fool people into thinking it comes from a trusted source.
To be honest, I can't remember the last time a website I use for personal purposes required a browser authentication dialog for login (including banking, investing, buying stuff with my debit or credit card, etc.). I'm going to speculate wildly here, and assert that most secure logins for personal use occur in HTML forms, and that this exploit doesn't approximate the login activity of most websites, used my most people. Now, some people when confronted with this weird, never-before-seen login "thing" will give it their login and password, but others won't because either they're tech-savvy enough to realize that something's wrong, or because their untrained interweb-spidey-sense goes off. Point is, it's at least an individually-significant issue until the info gets out to enough people.
But the really dangerous potential of this exploit isn't to get somebody's bank login info, or PayPal, or Amazon, or eBay login, or whatever. Think about all the logins that *do* normally use a browser authentication dialog box, like corporate, government, and defense portal sites. This exploit actually more closely approximates a legitimate login identity challenge to systems that impact not just one person, but *lots* of people. Imagine that you're corporate-drone #637, and you've been working on a super-serial secret something-or-other and you get an email from "your IT folks" asking you to log in to the VPN. Oh, they also included a helpful link to do so, and oh, you also happen to be using Firefox.
I think that's the real problem with this exploit.
Fastest, most secure and best features.
He's talking about the standard HTTP Auth dialog. (Good luck refusing to enter your password in any HTTP Auth dialogs -- it's still the most ubiquitous authentication mechanism on the Web.)
SIERRA TANGO FOXTROT UNIFORM
Seen it already, but forgot the website...then I read about this interesting spoof. hahahahaha! Like I am going to put my password in some strange account, but the link that took me there was in a major trusted site.
Firefox Password Manager fell victim to an attack in late 2006.
There, fixed the link (I hit Ctrl-V twice).
Uhhh, you do? (Duh?)
New punctuation update "~" (no quotes) at the end of a line to indicate sarcasm. ~
Thanks for the useful link. It occurs to me that this would throw a flag for most Mac users, who are used to their dialogs descending down from the title bar of the window in an animated sheet. A webpage shouldn't be able to modify chrome, and thus a fully convincing exploit shouldn't be possible for Mac.
Score one for gratuitous eye candy as security feature.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
Mod parent up!
Very insightful indeed. A gem in this forest of blahblah.
The Apache docs, though mostly sufficient for a decent httpd.conf, are not very helpful in discussion like this one.
Aphorisms don't fix code. (Bart Smaalders)
Uhhh, you do? (Duh?)
Do what?
Do what?
your mom
your mum is a better fuck than your sister
(I'm sorry Slashdot, I couldn't let this one go.)
"It does not do to leave a live dragon out of your calculations, if you live near him." - Tolkien