Firefox ID Theft

[W1nTry]

ID Theft Vulnerability Haunts Firefox


firefox_security_vulnerability.png Israeli security researcher Aviv Raff has issued a warning for a fairly serious browser vulnerability that exposes Firefox users to identity theft attacks.

Raff, a well-respected hacker who regularly reports security problems in software products, discovered a way to use a browser bug to lure Firefox users into entering login credentials into a maliciously rigged dialog box.


The technical details:

    Mozilla Firefox displays an authentication dialog, whenever the visited web server returns 401 status code, and the "WWW-Authenticate" header. In order to specify basic authentication, the "WWW-Authenticate" header should have the value [Basic realm="XXX"] (without the brackets). The Realm value, which in this case is XXX, will be displayed in the authentication dialog window.

    While Firefox does not display the characters in the "WWW-Authenticate" header Realm value after the last double-quotes ("), it fails to sanitize single-quotes (') and spaces. This makes it possible for an attacker to create a specially crafted Realm value which will look as if the authentication dialog came from a trusted Web site.

Raff posted a (.wmv file) to demonstrate an attack scenario but declined to publish proof-of-concept code.

He did provide me with a private demo of the issue, which also works if a Firefox user attempts to load an RSS feed into Google Reader or iGoogle.

Raff's discovery highlights a very serious design deficiency that affects all modern Web browsers -- the use of hard-to-comprehend dialog boxes to handle trust between user and Web site.

I know Firefox is working on a better way to display trust to end users in Firefox 3, but, in this day and age, the average mom-and-pop will never understand certificate dialogs filled with techy jargon. They are the big target for these kinds of attacks.

[choxlate_saltfish]

what is the best way to protect yourself from such attack? im a strong firefox user and have my full confidence in it.

[W1nTry]

Well it would be to not trust any and every site. Its been said that most internet users only visit around 8 pages if that much. If you are browsing to new sites or 'questionable' sites, always be aware that sites trying to install software, prompt for credentials or incite purchases or any other divulgence of information no matter how small COULD be a malicious site. Also be careful with even Certificate or SSL based websites. Keep in mind that many browser vulnerabilities don't even require user intervention but rather use known windows exploits, thus keeping your machine up to date in terms of patches (if you're using windoz) and using a firewall of SOME KIND even if its the built in windows firewall is better than nothing. Also keep your anti-virus definition files up to date and regularly use a anti-spam program to check for problems. If I continue this thread will no long be just about firefox XD but I guess I already past that...

[Saxito Pau]

well a program call SiteAdvisor can help in that regard. I usually install it on my customers' PCs

www.siteadvisor.com

[daniboy79]

well a program call SiteAdvisor can help in that regard. I usually install it on my customers' PCs

www.siteadvisor.com

i second that Sax! i've been using Siteadvisor for about 2 years now, and it's a brilliant add-on.

and talkin about add-ons, i've found this sweet add-on called 'Cooliris' check it out to find out more!

[mailman166]

I use no script in firefox ...