Slashdot Mirror

← Back to Stories (view on slashdot.org)

Firefox Spoofing Bug Puts Passwords At Risk

Posted by Zonk on from the please-keep-the-fox-in-the-pen dept.

hairyfeet writes "Aviv Raff, an Israeli researcher known for his work in hunting browser bugs, has revealed a Firefox spoofing vulnerability which could allow identity thieves to dupe users into giving up their password. According to Mr. Raff Firefox fails to sanitize single quotes and spaces in the 'Realm' value of an authentication header. Raff was quoted as saying 'This makes it possible for an attacker to create a specially crafted Realm value which will look as if the authentication dialog came from a trusted site.' This vulnerability was shown to be in the latest Firefox, version 2.0.0.11 and until Mozilla fixes this vulnerability Mr. Raff recommends in his blog 'not to provide username and password to Web sites which show this dialog.'"

19 of 157 comments (clear)

  1. An honest Security Bug by pembo13 · · Score: 4, Informative

    Hope the Firefox guys can get to it quickly, but it doesn't sound too serious. In the mean time, people need to practice the whole watching where you browse idea.

    --
    "Thanks for all the money you paid to us. We've used it to buy off ISO among other things" -Microsoft
    1. Re:An honest Security Bug by mhall119 · · Score: 5, Insightful

      Look at the type of bugs, not just the number. One spoofing vulnerability does not compare to one remote code execution vulnerability.

      It's like saying there are 10 ways a thief can trick a Toyota user into handing over their car keys, but only 1 way a thief can remotely start your Lexus and drive it wherever they want without you even realizing they've done so. Therefore Toyota's are less secure. Or, conversely, it's like saying paper is more dangerous than dynamite, because more people get paper cuts than blow themselves up.

      --
      http://www.mhall119.com
    2. Re:An honest Security Bug by snoyberg · · Score: 3, Funny

      You have to listen to him, he made a car analogy. ... I'm just joking, it really was a good analogy.

      --
      Thank God for evolution.
    3. Re:An honest Security Bug by KlaymenDK · · Score: 4, Funny

      I liked the paper/dynamite analogy way better. New, graphic, and even explosive. That's the kind of analogies we should promote! :-D

      --
      "Good news, everyone!"
  2. Show me the demo!! by Prairiewest · · Score: 5, Funny

    Too bad he doesn't want to show an online demo of this, I was kind of getting used to being able to try out these kinds of exploits in my own browser. Call me masochistic.

    1. Re:Show me the demo!! by gEvil+(beta) · · Score: 3, Insightful

      Well, he apparently has a demo video up on YouTube (hey, videos are better than nothing). Unfortunately, PCWorld would much rather give me links to searches on their own site instead of a USEFUL link to the actual video...

      --
      This guy's the limit!
    2. Re:Show me the demo!! by Kijori · · Score: 4, Informative

      Here it is: http://youtube.com/watch?v=NaCPw1s3GFw I made the same mistake of clicking on the PCWorld link expecting it to go to the actual video... how naive of me...

  3. Phishing by JCSoRocks · · Score: 5, Insightful

    Ugh, This is basically just another form of phishing. Who follows links to websites that require a username / password anymore anwyay? If I want to go to gmail, my bank, whatever, I'm definitely not going to follow a link from some random website or e-mail. I'm going to type in the URL and login. Don't get me wrong, it'll be good to see this patched - But basically this vulnerability only matters if you're the same kind of person that falls for phishing.

    --
    You are using English. Please learn the difference between loose and lose; they're, there, and their; your and you're.
    1. Re:Phishing by jlarocco · · Score: 3, Insightful

      But basically this vulnerability only matters if you're the same kind of person that falls for phishing.

      Haven't Firefox zealots been pushing Firefox to the "kind of person that falls for phishing"? I was under the impression that "being secure" was one of their big selling points that they liked to talk about.

      Given that, they should fix this immediately.

      --
      Maybe not
  4. Please enter your credentials here: by PrescriptionWarning · · Score: 5, Insightful

    What's really to stop someone from popping up a screen that says "Please enter your PayPal username and password below:" anyway? I mean all they gotta do is set up some simple html page that kinda looks official and you can be sure that you'll get more than a handful of dummies who'll actually put it in. I have to wonder when things stop being considered the fault of the program and start being the fault of the user.

  5. Youtube video by sucker_muts · · Score: 4, Informative

    Youtube video mentioned in the article:

    http://youtube.com/watch?v=NaCPw1s3GFw

    --
    Dependency hell? => /bin/there/done/that
  6. Who pays attention to realm, anyway? by samjam · · Score: 3, Insightful

    Who pays attention to realm, anyway?

    I've always interpreted the realm as an advisory comment for the dialog box, and used the URL of the website to indicate whether or not I want to give up a password.

    Sam

    --
    blog.sam.liddicott.com
  7. Not to get too technical, but... by thegnu · · Score: 5, Funny

    I wonder how many bugs have not been discovered yet.

    All of them. No wait, let me check...

    Yep, all of them!
    --
    Please stop stalking me, bro.
    1. Re:Not to get too technical, but... by blackjackshellac · · Score: 4, Funny

      Reminds me of this joke,

      We were traveling by plane at half the speed of smell and got passed by a kite.
      Then one of the two engines failed. And the guy sitting next to me went nuts
      and asked how far the other engine would take us. All the way to the scene of the
      crash, I told him. But we'll beat the paramedics by 35 minutes.
      -- Ron White

      --
      Salut,

      Jacques

  8. Sorry, but I'm calling BS by Anonymous Coward · · Score: 3, Insightful

    I'm having a hard time calling this a *bug*. I would rather call it a presentation problem.

    Then again, what's the problem?

    The standard Firefox HTTP auth dialog says "Please enter the username and password for $REALM at $URL". Note the included URL to prevent phishing.

    Now what Mr Raff does is basically set up $REALM as "Google Checkout (https://www.google.com) for more details see my page at" and $URL as the domain name he controls. The whole thing looks like: Please enter the username and password for Google Checkout (https://www.google.com) for more details see my page at http://avivraff.com/".

    So no, I haven't looked at the HTTP RFC, but I am not sure that forbiding spaces and quotes in HTTP auth realms is the answer.
    What Firefox actually needs is just a better, more fail-safe presentation of the data on this dialog.

    Just my 2 AC cents (too lazy to create an account for just that)

  9. Denial is the best option by Anonymous Coward · · Score: 3, Funny

    As with all FOSS, the first course of action needs to be very vocal denials. It's always worked in the past... after all, would anyone be using Firefox if we were honest from the start about all the gaping security holes, buffer overflows, and the over 300 memory leaks? Not likely, especially since IE7 is both more stable and secure... and most people already have it on their computers! Also, now IE8 is coming down the pipe, we won't be able to use the "itz notz teh stadtards komplient!!11!!1!" whine. IE8 could very well be the final nail in our coffin... unless we keep lying and spinning to increase Firefox's market share (or at least not lose too much).

    So really, we have to deny early and often. And hey, this is FOSS: fixing problems is really secondary. If they don't like it, let them go buy something, the cheap bastages. You get what you pay for.

  10. Some much more informative links by Anonymous Coward · · Score: 3, Informative

    http://aviv.raffon.net/2008/01/02/YetAnotherDialogSpoofingFirefoxBasicAuthentication.aspx

    and

    http://www.kriptopolis.org/falsificando-dialogos-firefox (Spanish)

  11. Re:FF1.5 by dvice_null · · Score: 3, Insightful

    > Here is the real question: How do you really know that your browser is safe at all?

    Well first thing is to make sure you are using the latest version. E.g. not using FF 1.5, which doesn't anymore get security updates at all.

    That is pretty much all you need to do if you are a normal user. If you need superiour security, then you run the browser in a sandbox.

  12. Re:pssst by zsouthboy · · Score: 4, Funny

    All my passwords are hunter2 anyway.