New Firefox iFrame Bug Bypasses URL Protections

Trailrunner7 writes "There is a newly discovered vulnerability in Mozilla's flagship Firefox browser that could enable an attacker to trick a user into providing his login credentials for a given site by using an obfuscated URL. In most cases, Firefox will display an alert when a URL has been obfuscated, but by using an iFrame, an attacker can evade this layer of protection, possibly leading to a compromise of the user's sensitive information."

Comments

Remembering passwords

[Anonymous Coward]

My theory is that in general (unless you're using a public PC) it's safer to get the browser to remember your passwords for you. It's smarter than you in that it matches by the exact real URL of a form page and so won't insert your credentials into a bogus page. However, by that point you'll be used to the browser typing in your credentials for you, and will be jarred out of complacency when you notice that it hasn't.

Re:Remembering passwords

[natehoy]

Good start, but I'd go one step further. In fact, I do.

Have your browser remember your passwords for you, but for any important passwords make the stored username and password invalid (or an incomplete one that you can enter the rest of, then just remember not to click on the "update" button that comes up). Even just dropping one character off the username and password is enough.

That way, if you are fooled into an iframed URL, you'll see the symptom you describe, but if some future bug makes the password list vulnerable to attack, any potential attacker only gets (at most) only part of each password, not all of it.

Also, always allow the bogus username/password to present once before you enter the real one. If you see a "login failed" screen that looks legit, you're probably good to go, and you can enter your real username and password. If you see anything that looks like it's trying to pretend to be your bank, you know something was wrong but you also know your account credentials didn't get disclosed.

When I'm in the mood, I'll also sometimes whip up a quick temporary guest account on my computer to click on a few of the provided links in things that are obviously bogus and enter clearly ridiculous credentials into the resulting page a few times. Even the least attentive bank IT department would probably look askance at 10 failed login attempts for user "I_AM_A_HACKER" and want to consider tracing out their IP address. I'll probably never get any actual hackers caught, but it feels as good as ripping up all the junk mail I get and returning it in the little postage-paid envelopes they so thoughtfully provide. :)