Slashdot Mirror
Firefox Spoofing Bug Puts Passwords At Risk
hairyfeet writes "Aviv Raff, an Israeli researcher known for his work in hunting browser bugs, has revealed a Firefox spoofing vulnerability which could allow identity thieves to dupe users into giving up their password. According to Mr. Raff Firefox fails to sanitize single quotes and spaces in the 'Realm' value of an authentication header. Raff was quoted as saying 'This makes it possible for an attacker to create a specially crafted Realm value which will look as if the authentication dialog came from a trusted site.' This vulnerability was shown to be in the latest Firefox, version 2.0.0.11 and until Mozilla fixes this vulnerability Mr. Raff recommends in his blog 'not to provide username and password to Web sites which show this dialog.'"
Hope the Firefox guys can get to it quickly, but it doesn't sound too serious. In the mean time, people need to practice the whole watching where you browse idea.
"Thanks for all the money you paid to us. We've used it to buy off ISO among other things" -Microsoft
Too bad he doesn't want to show an online demo of this, I was kind of getting used to being able to try out these kinds of exploits in my own browser. Call me masochistic.
Ugh, This is basically just another form of phishing. Who follows links to websites that require a username / password anymore anwyay? If I want to go to gmail, my bank, whatever, I'm definitely not going to follow a link from some random website or e-mail. I'm going to type in the URL and login. Don't get me wrong, it'll be good to see this patched - But basically this vulnerability only matters if you're the same kind of person that falls for phishing.
You are using English. Please learn the difference between loose and lose; they're, there, and their; your and you're.
What's really to stop someone from popping up a screen that says "Please enter your PayPal username and password below:" anyway? I mean all they gotta do is set up some simple html page that kinda looks official and you can be sure that you'll get more than a handful of dummies who'll actually put it in. I have to wonder when things stop being considered the fault of the program and start being the fault of the user.
Youtube video mentioned in the article:
http://youtube.com/watch?v=NaCPw1s3GFw
Dependency hell? =>
Who pays attention to realm, anyway?
I've always interpreted the realm as an advisory comment for the dialog box, and used the URL of the website to indicate whether or not I want to give up a password.
Sam
blog.sam.liddicott.com
More problems come from giving the user an identical page hosted on some evil server, in that case the user expects to see the login form.Then again, a bug is still a bug, and the only good bug is a dead one.
A spanish website with screenshoots of how this is handled by IE6, Firefox, Opera and Konqueror: http://www.kriptopolis.org/falsificando-dialogos-firefox
exp(i*pi)+1=0
It must have worked, I've got Excellent Karma!
Post-rock/Ambient/Drone and other noise.
All of them. No wait, let me check...
Yep, all of them!
Please stop stalking me, bro.
I'm having a hard time calling this a *bug*. I would rather call it a presentation problem.
Then again, what's the problem?
The standard Firefox HTTP auth dialog says "Please enter the username and password for $REALM at $URL". Note the included URL to prevent phishing.
Now what Mr Raff does is basically set up $REALM as "Google Checkout (https://www.google.com) for more details see my page at" and $URL as the domain name he controls. The whole thing looks like: Please enter the username and password for Google Checkout (https://www.google.com) for more details see my page at http://avivraff.com/".
So no, I haven't looked at the HTTP RFC, but I am not sure that forbiding spaces and quotes in HTTP auth realms is the answer.
What Firefox actually needs is just a better, more fail-safe presentation of the data on this dialog.
Just my 2 AC cents (too lazy to create an account for just that)
As with all FOSS, the first course of action needs to be very vocal denials. It's always worked in the past... after all, would anyone be using Firefox if we were honest from the start about all the gaping security holes, buffer overflows, and the over 300 memory leaks? Not likely, especially since IE7 is both more stable and secure... and most people already have it on their computers! Also, now IE8 is coming down the pipe, we won't be able to use the "itz notz teh stadtards komplient!!11!!1!" whine. IE8 could very well be the final nail in our coffin... unless we keep lying and spinning to increase Firefox's market share (or at least not lose too much).
So really, we have to deny early and often. And hey, this is FOSS: fixing problems is really secondary. If they don't like it, let them go buy something, the cheap bastages. You get what you pay for.
http://aviv.raffon.net/2008/01/02/YetAnotherDialogSpoofingFirefoxBasicAuthentication.aspx
and
http://www.kriptopolis.org/falsificando-dialogos-firefox (Spanish)
The power of voodoo, duh.
I am one of many. My idea is not unique, nor do I expect my voice alone to sway you. I speak in a chorus of opinion.
> Here is the real question: How do you really know that your browser is safe at all?
Well first thing is to make sure you are using the latest version. E.g. not using FF 1.5, which doesn't anymore get security updates at all.
That is pretty much all you need to do if you are a normal user. If you need superiour security, then you run the browser in a sandbox.
All my passwords are hunter2 anyway.
All your passwords are what? I just see a bunch of asterisks.
Don't put advice in your sig.