Phishing For Bank Info Without Any Pesky Malware 232
Emb3rz writes "DarkReading.com brings us news of a new approach to phishing that targets online banking sites. Here's the novel part of it: it doesn't involve any of the typical attack vectors we all know and love. Instead, it uses JavaScript from a remote page to detect if you have a banking site open, and prompts you for info via popup if you do."
The Best Defense is Offense (Score:4, Insightful)
This is real scary. And it goes to prove that bad guys always come up with new ways to steal. I don't believe there is a technical solution to this arms race.
Instead, I'd love to see our law enforcement friends be more pro-active and setup traps. Pose as a fake victim. Go out and seek those phishing sites. When the thieves come after your money thinking they just ripped off a stupid Internet newbie, then you can trace their activity and catch them.
That's the best way I can think of scaring the bad guys: when they never know if their next victim might be a cop.
--
FairSoftware.net [fairsoftware.net] -- work where geeks are their own boss
Re: (Score:2, Informative)
I've heard of something like this before.
Though there's this magical thing called noscript.
If people would stop putting law before them to prevent them from making stupid choices then we might have a more informed society.
(I ironically didn't read TFA.)
Re:The Best Defense is Offense (Score:5, Interesting)
Problem is with no-script you still have to decide if you trust or not-trust the site and if that level of trust you have is worth what the site is offering.
If the site offers a useful service which requires scripts you have to decide if it is worth the risk.
While in most cases it is easy to tell and block only those sites you trust. Those that you don't block may also allow third party scripts to be run such as in ads on the site.
paranoia-plus... (Score:5, Insightful)
Looks like I was right about the monsters behind the sofa after all.
Re:paranoia-plus... (Score:5, Insightful)
My paranoia has led me into a practice of doing my banking in a single browser session, clearing cookies, cache and history before and after, and closing/restarting the browser when finished.
My paranoia has led me into a practice of doing my banking by going to the bank.
Re: (Score:2, Insightful)
Also, I have never heard of anyone dieing in a digital bank robbery.
Re: (Score:3, Funny)
dieing indeed....
OT: great nick! (Score:2)
Re: (Score:3, Funny)
My paranoia has led me into a practice of doing my banking by going to the bank.
You insensitive clod. How do you get there - in your gasoline powered, carbon-emitting, smog-making car? /.er would stay in his basement and do his banking on the internet and not risk having to interact with other humans.......
A real
You must be new here.
Re: (Score:2)
Re:The Best Defense is Offense (Score:5, Informative)
Problem is with no-script you still have to decide if you trust or not-trust the site and if that level of trust you have is worth what the site is offering.
That slightly over-simplifies the protection that NoScript offers. For example, even when you allow script to run NoScript still provides protection against certain types of XSS, you can use it to force cookies to be exchanged over https for certain domains, it can block some plug-in types (Java, Flash, Silverlight), it features click-jacking protection, and just a couple of days ago it even added protection against attacks on twitter [hackademix.net].
So yes, you do have to make that trade-off, but even when you click "allow" you're potentially better off with NoScript installed than without it.
Noscript Is Pretty Much Geek-Only (Score:4, Insightful)
Noscript requires a level of knowledge about attacks, protocols, etc., that precludes it from being adopted outside the geek community.
A tool intended for widespread use needs to have two buttons: Safe and Unsafe.
Re: (Score:2)
[...]While in most cases it is easy to tell and block only those sites you trust. Those that you don't block may also allow third party scripts to be run such as in ads on the site.
as far as I know, from using noscript on firefox, I can enable java on my bank's page and it still blocks Ads and java scripts if they come from other sources. from noscript home:"The NoScript Firefox extension provides extra protection for Firefox, Flock, Seamonkey and other mozilla-based browsers: this free, open source add-on allows JavaScript, Java, Flash and other plugins to be executed only by trusted web sites of your choice (e.g. your online bank), and provides the most powerful Anti-XSS protecti
Re: (Score:2, Informative)
Re: (Score:2, Interesting)
Re: (Score:2)
Re: (Score:2)
Duh, it's where the American tubes are joined to the Elbonian tubes
Re: (Score:3, Funny)
Elbonia uses trenches as we cannot afford your extravagant tubes.
Re:The Best Defense is Offense (Score:4, Insightful)
Well, the nature of an arms race is such that it has technological approaches.
In this case, for example, there most certainly is a technological approach. JavaScript in one loaded tab in your browser should have no shared knowledge with other tabs in your browser. Data separation needs to be enforced at a finer level. You should also know, if you have two tabs open to different sites, which one of the two a popup is associated with.
Re: (Score:2)
AFAIK tabs are really just windows. The difference is how they're displayed by the GUI. But from a Javascript POV the tab is just another window. So if we start limiting the knowledge that javascript has over other windows then we prevent a lot of useful, legitimate things that can be done with other windows. For example: I have a few web-apps that use pop-up windows in a non-annoying way (ie: you click something to open the window that actually performs a useful task).
At first glance I like the idea of pre
Re: (Score:3, Informative)
When you're currently visiting one site, and open a new tab and go to a different site, those two open tabs should have no capacity to share information -- they should function as if they were separate browser sessions. (Obviously this isn't the same as if you clicked on something in a tab that causes another tab or window to open, as they may need to share knowledge. But then, the fact that those two tabs/windows are tied to the same context should be made apparent to the user.)
popups (Score:2)
Re: (Score:3, Interesting)
Re:The Best Defense is Offense (Score:4, Funny)
4. Find out that the phisers are using a proxy to bounce off of.
5. Find that proxy is some poor schmuck who got hacked.
6. Realize poor schmuck is you.
7. Boom.
Re:The Best Defense is Offense (Score:5, Funny)
There's a simple technical solution to this:
1. trace the phishing to their location
2. send a missile to that location
3. problem solved
I don't get it. Then the bad guys would have a missile. That is worse, not better.
Re: (Score:2)
Well, I guess if you do that enough times, you've solved the botnet problem.
Do you have enough missiles, though?
Re:Schools! (Score:2)
Thats's awesome!
So some Terrorist could live inside a locked school broom closet for years hosting hacking stuff! Who'd ever accuse a school of Not Thinking Of Children??
Of course there is a technical solution (Score:2)
I believe there is a technical solution to this attack and to other attacks. But if a technical solution does not exist, then online banking is inherently insecure and should not be used by anybody.
In this particular case: (a) block Javascript in different tabs from seeing what sites you are visiting, and (b) all popups should be clearly labelled by the browser with what site they came from. If it's an SSL site with an extended-validation certificate, then show the company name in large writing at the top
Re: (Score:2)
This is precisely the sort of evolutionary cat-and-mouse game that is likely to lead to the first true artificial intelligence. It won't be some well-meaning altrustic researcher in some AI lab, it will evolve out of this cyber-warfare.
Re:AI (Score:2)
Both.
With semi-apologies to certain TV shows,
"My mother was a prototype from an AI lab and gained all the lexical parsing rules and dictionaries. My father was a real-time self modifying system born out of the cyber wars. It's the unification of both that made me possible."
Re: (Score:2)
This is real scary. And it goes to prove that bad guys always come up with new ways to steal. I don't believe there is a technical solution to this arms race.
A good start would be for banking sites to work with Javascript turned off, and, maybe, even suggest you turn off Javascript while using online banking.
Requiring you to turn it _ON_ is insane, but extremely common.
Tim.
Re:The Best Defense is Offense (Score:5, Interesting)
How about this one-
I got a letter in the mail (usps snailmail) from Bank of America asking for a lot of personal information that was missing from my account, and that if I didn't supply that information they'd have to report me to the IRS.
The letter was spelled correctly, had proper grammar and even had the BofA logo printed in full color. The return address was a PO box in Dallas. Nothing fishy at all.
Problem is, I don't have a BofA account. But I'm sure a LOT of other people do.
Phishing - it's not just an on-line phenomenon.
Re:The Best Defense is Offense (Score:5, Insightful)
Re: (Score:2, Troll)
The solution is to make the bad guys "disappear," not to seek out "justice."
Why the hell would Elbonia care if some local scumbags show up dead in a gutter somewhere?
Re:The Best Defense is Offense (Score:4, Insightful)
Some of us like to believe that the Constitution, as well as all other laws and treaties the government operates under, restricts the government's actions everywhere that it operates, not just on American soil, and that it also precludes the government from encouraging other nations to do what it itself is prohibited from doing. I don't see how we can call ourselves a just nation if we simply outsource acts that we would find deplorable if our own government were carrying them out.
I don't deny that our government has had something of a bad history of clandestinely encouraging foreign powers to "disappear" people we find troublesome, but that doesn't make it right or legal, and it certainly doesn't mean we should encourage it to happen more often.
Re: (Score:2)
No but we can request that they be extradited or, failing that, tried there, for the crimes that are illegal in their own country.
Re: (Score:2)
I've got a question. Where did the parent say anything about "disappearing" anybody? Instead I thought that was a good approach to finding and prosecuting phishers of this variety.
Re: (Score:2)
No idiot. The Constitutions defines the US Government and therein always binds the US Government when it acts, no matter what, where, or when. At least that's the theory.
Just because the government is acting outside of state boundaries, doesn't give it the means to do whatever the hell it pleases.
Re:The Best Defense is Offense (Score:5, Insightful)
Re: (Score:2, Funny)
Of course we would then have to send someone to Elbonia to disappear the disappearers.
In fact we could lay traps for them by disappearing people in a country where that is illegal and then see who comes after them.
Re: (Score:2)
Those damn lefties!
Simple solution, take the job as an Elbonian diplomat and then do what you want!
Re: (Score:2)
There is no money coming to arrest real criminals.
Re: (Score:2)
Is that what interpol is supposed to be doing but if I recall right they are doing alot of work on getting fans to stop downloading music why dont they arrest the real criminals :(
Interpol doesn't really work like that.
Each member country has an NCB (basically a central office) staffed by their own agents that can escalate issues through Interpol. So if Interpol is looking at piracy, then that started within a member nation's NCB, was escalated, and was deemed a valid cause by enough other member nations t
XSS (Score:5, Informative)
A cross-site scripting attack sounds like a pretty typical attack vector to me. Javascript should not be able to "detect" if they have a banking site open. Pure and simple.
Re:XSS (Score:5, Insightful)
BTW, for those of you who are curious about this attack (and are too lazy to RTFA), this basically uses a common image set behind a protected login. e.g.
If you ping the blasted thing for long enough, you will be able to detect the user logging in. One pop-up later and you've stolen their info.
Now protecting against this sort of issue is an interesting question. Ideally static resources should never be behind closed doors. But that answer is a bit of a cop-out. The next best thing is to ensure that session cookies are maintained inside the login tab ONLY and that persistent cookies are not used for auto-login.
(Interesting question: I wonder if Chrome is vulnerable? With process isolation, this trick would require that the main Chrome process delegate the handling of session cookies. Which seems like a bad idea anyway, so I would hope they implemented the browser in a more secure manner.)
Re: (Score:2)
Re: (Score:2)
Re:XSS (Score:4, Interesting)
so wait..
as you explain it, I guess the idea is that once the user logs into the secure site, the malware script can magically access the lock.gif because the site and browser tell them that.. yup.. the user is logged in and thus should have access.
however.. presumably, the script is not from a page that's actually -on- https://www.mybank.com/ [mybank.com].. if it was, you and the bank probably have bigger problems.
So let's say that instead it's on http://www.malware.lol/ [malware.lol] - why would a script on a page from malware.lol be allowed access to a resource - in this case 'pinging' the 'lock.gif' - *on* https://www.mybank.com/ [mybank.com] ?
Is there any valid purpose for allowing something like that? I can understand it for non-secure sites.. from inlining content that's hosted on another domain to allowing local applications to grab data off of e.g. websites that do not provide a nice API. But for secure sites? I'm baffled.
Re:XSS (Score:5, Interesting)
There's a great deal of internet history behind this one. Originally, there were no barriers what so ever. Anyone could link anything from any page. Of course, as Javascript entered the scene and grew in sophistication, this was soon realized to be a problem. In result, most browsers adopted security behaviors for the really powerful stuff like XMLHttpRequest and locked out scripting across frames.
However, that still leaves a hole like this one. And it's not an easy hole to plug. Quite a few sites are actually structured around the idea of cross-site linking. (e.g. The HTML may be www.mainsite.com while the images come from the web server media.mainsite.com.) Interestingly, this sort of structure is actually a solution to the problem posed. So it's difficult to dispose of it out of hand.
Some of the web standards are moving toward highly restrictive models for HTTPS sites. e.g. HTTPS resources can only be accessed by pages whose origin is the same HTTPS site. More likely though, I expect to see more explicit security configurations along the lines of what Flash does. Flash uses a crossdomain.xml file on the target site to broadcast if a resource can be accessed or not. This scheme allows for situations like a media server separate from the primary site, but it also allows for those cross domain accesses to be tightly restricted.
Of course, the scheme is not without its problems. Nothing prevents an attacker from transmitting information he may have collected TO a server that he has configured with a permissive policy file. If he finds a vulnerability that allows him to collect the information in the first place, he's going to be able to make off with the info scott-free.
In result, web security is an ongoing area of research. It's incredibly complex due to the nature and history of the web, but standards bodies are working hard to find more reliable solutions that don't negatively impact existing sites and current usage.
Re: (Score:3, Insightful)
Well that's the thing - why not? They are superspecial to my browser already.. doing its certificate check and throwing a big fat "passport check" image at me (FireFox 3) if it think something's not quite up to snuff. I don't see why a page on anything other than https://www.mybank.com/ [mybank.com] shouldn'
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
Re: (Score:2)
Has anyone else noticed that pretty much every piece of nasty coming down the pipe uses JavaScript?
No, we haven't, because we don't have your confirmation bias.
How can Chrome be affected by this? (Score:2)
I noticed that Chrome 2.0 isn't affected by this however I have to ask the question..
How can Chrome be affected by this in the first place? Isn't the whole point of Chrome that it's sand boxed in and unable to get information from other tabs.
If this isn't the case then I see no point in using Chrome. It means all that Chrome marketing was just fluff.
Simple Solution... (Score:5, Informative)
Don't have multiple tabs/windows open while you're doing your online banking!!!
Oh, and use NoScript! [noscript.net]
Re: (Score:2)
This, like most phishing attempts, targets users who don't know about NoScript or basic internet safety practices.
Yelling "Install NoScript you n00bs!!1!" won't register noobs... because they're newbs.
Re:Simple Solution... (Score:5, Insightful)
Once more, Darwin extends into the internet.
Computers are tools. They do what they are told without question. The internet is made of computers. By extension, it is a tool that does exactly what it is told.
Kind of like a handgun, and you don't (usually) let people run around with those without some kind of training.
Also like a handgun, most tools don't care who is issuing the instructions - they just do it. That tablesaw doesn't care if it's a 2x4 or your forearm, it saws anyways.
Yes, I'm an elitist bastard sometimes.
Re:Simple Solution... (Score:5, Informative)
Yelling "Install NoScript you n00bs!!!" won't register noobs... because they're newbs.
Well, I wouldn't call them n00bs firstly... and secondly, most of the technically-savvy geeks/nerds I know read Slashdot and find out new and interesting stuff from here.
;)
One of the best things about Slashdot is if you write something on here, ALOT of people will take notice. So if by providing solutions/information that people can read and take away to tell other non-technically-savvy individuals helps protect at least one person from being scammed, I'm more than happy to yell on Slashdot about it
Re: (Score:2)
HOW CAN I INSTALLS NOSCRIPTS ON MY WINDOWS MICROSOFT EXPLORER VISTA? KTHANKSBYE!
Sarcasm aside, that's not going to cut it. We may be in an arms race, but we do need to try to keep up. The internet should not just be for technogeeks any more than medicine should be only for doctors. But I guess you can argue that this is like a doctor telling you to eat well, excercise regularly, and lose Windows--erm, weight.
Re: (Score:2)
thus making the web suck ass (Score:2)
Half my desktop or more is web. These days you
can use the web for spreadsheets, word processing,
email, chat, and so on.
Closing all those windows would suck ass.
The browser damn well ought to isolate the
web sites 100% from each other. WTF?
Instead, the damn thing frustrates any attempt
at manual isolation. If I try to start a second
instance, that one does some retarded RPC thing
to have my other browser instance spawn the new
window -- and then that second instance exits!
It's not even fail safe. Crash in one win
Re: (Score:2)
Are you suggesting I shouldn't be able to cut a link from one window and paste it into another? What about legitimate cross-site scripting, like using your Facebook account to comment on Gawker Media blogs? It's not nearly so black-and-white.
Re: (Score:2)
Also, proper security for online banking should never require kludges like Java Applets or client-side "security checkers", as I have seen in my country's banking.
A login page should be a very normal login page, followed by a One Time Pad requ
Re: (Score:3, Interesting)
Oh, and use NoScript! [noscript.net]
Another simple change is to set dom.disable_window_open_feature.location [mozillazine.org] to true. That should make it pretty obvious when a popup comes from source different than what it's claiming.
Re: (Score:2)
Thanks for the tip. At least for Firefox 3 on Linux, this is set to true by default.
And it's been there all of these years (Score:2)
Things to learn from this. (Score:5, Insightful)
more fixes for the security model (Score:4, Insightful)
Any browser window containing content from more
than one security context must NOT display any
sort of lock icon, and must display a warning
banner.
"more than one" would include an https site that
uses some http images. It's not secure if it's
a mix.
Re: (Score:2)
Oddly enough, this is something IE7 did (by displaying a very annoying mixed-content warning) but which Firefox 2 did not by default (though you could turn it on). I'm not sure about Firefox 3.
Re:Things to learn from this. (Score:5, Interesting)
Perhaps it is time to have a dedicated banking browser? One that does not use cookies/cache data/allow more that one tab etc etc
Re: (Score:2)
Does Google's Chrome browser do something to this effect? I recall something about Chrome each webpage in an independent process, not as independent threads.
Re: (Score:3, Interesting)
I try and shy away from online-Banking as much as I can. Never mind separate browser. I use a Live Linux DVD and load up my bank site from there. When I do this its boot, bank website, print if necessary, shutdown and back to Windows.
Re:Things to learn from this. (Score:4, Interesting)
I, for one, have a dedicated VMWare virtual machine with Ubuntu installed, and Firefox. Firefox has NoScript installed, is set to saving no user story, and I use it only for banking. I find the setup a bit unwieldy sometimes, but is sure safer.
Re: (Score:3, Insightful)
It would be cool to have firefox "mode" doing exactly this. Press an "online-banking" button and a new isolated firefox session would be started with all needed restrictions and settings.
Re: (Score:2, Interesting)
I'd bet this is something that could be created in GreaseMonkey or otherwise developed as an add-on for Firefox. It would certainly be an effort I would contribute to as this discussion is making me paranoid.
Re: (Score:3, Interesting)
Or you should get a one time key generator.
My key changes every 60 seconds. Could they exploit this within that time frame. (Especially if I'm already logged on and the bank does not allow a second simultaneous login)
Re: (Score:2)
If the cracker is technical enough, yes they can. Again, you would have to have a dodgy site on one site, banking on the other (porn & banking, a good combination) then as soon as the JavaScript detects that it has access to the other page, it can start 'clicking' stuff from the other website and while you're logged in transfer $ from your account elsewhere or just request the page that has your account numbers on it and send it to a server somewhere.
Use a separate Firefox profile for banking (Score:2, Interesting)
This is why I use a separate Firefox profile for banking and bill paying. And I only have one tab open at a time.
The article doesn't describe the actual exploit (Score:4, Interesting)
The only way I can imagine that js on one site can detect if a user is logged into another (assuming the other site is secure and I cannot post js to it) would work like this:
Use an Asynchronous request to "curl" out to a well known page of that site and then "grep" the response for typical "you are not logged in" text. If it is not found, commence shenanigans.
BTW, this comment kind of made me roll my eyes:
"Klein says placing a low-profile piece of malicious JavaScript on a high-profile Website isn't difficult to do, and the malware is basically invisible to the user."
"Klein" makes it sound like this is a walk in the park. I don't know. After the myspace worm a few years back, I think validation and filtering on those sites has gotten pretty good. Low-profile sites? Sure. High-profile sites? Not so much. I'm not saying it's not possible, but "not difficult"... maybe Klein is just conceited.
Re: (Score:2)
Re: (Score:3, Informative)
I agree. Most XSS attacks would require the banking site to have a vulnerability. This article implies that all one needs is a vulnerability on the first (high-profile) site.
Re: (Score:2)
It's true. There's been quite a bit of research into it, mostly at Google. While you might not be able to pick a particular high-profile site and sneak JavaScript onto it, getting your JS onto "high-profile sites" in general is not difficult.
Re: (Score:2)
What if the cookie of the target site is against a host name such as
http://094ec182f4a74bc1382206407.bank.com/ [bank.com]
The attacker would not waste their time trying to guess the (randomly generated) 094ec182f4a74bc1382206407 part.
So when you login your logging in with a host name with a token.
Stephan
Re: (Score:2)
Interesting, but hardly to be considered comprehensive.
It's easy enough to parse just the root domain and other telling parts of the URL for sites that attempt to use 'security' of that sort.
Not common yet.....? (Score:2)
From the friendly article: although he and his research team have not spotted full-blown attacks like this in the wild as yet
I'm sure they will now after this.
Already dedicate browser sessions to banking only (Score:2)
I already make sure that if I'm going to visit my bank, I close my browser, start a new one, do the banking thing, then close the browser before I do anything else. While banking I don't browse other sites.
I figured an attack like this was possible but had no idea there was a way to check other sites you are visiting via JavaScript. That seems like a very obvious security flaw. Anyone know how that is possible? Is it via standard JavaScript, or does it require a bizarre hack that happens to work on t
Re:Already dedicate browser sessions to banking on (Score:5, Informative)
It's explained in a few comments above. You just reference a resource (usually an image) that requires you to be logged in at the target site in order to access. If your attempt fails, the user isn't logged in at that site. If it succeeds, you know the user is currently logged in.
Is Chrome vulnerable? (Score:2)
maybe being obsessive pays off (Score:2)
Often, I also delete all the cookies too, just because I am a neat freak, not due to paranoia. Maybe I get more secure sessions as a side effect.
Anyhow, keeping your kitchen neat and clean is healthy. Maybe keeping your computer neat and c
Re: (Score:2)
I have a dual core cpu with gigs of ram, so it's not a hardware issue. Running another profile (with few bookmarks) on the same PC doesn't exhibit the same problem, and I can only assume it's the browser rechecking links, favicons or something else every time I start it up.
you don't use web email (Score:2)
You might have an account, but you certainly
aren't depending on it and getting lots of
email through it.
New ways to steal. (Score:2, Offtopic)
Are you kidding? Internet security clowns have a very limited imagination. They go nuts on securing one aspect beyond usability while completely ignoring other areas.
Here in NZ there is a problem with ATM machine skimmers. Criminals equip the ATM machine with camera and fake card reader and collect card and pin codes from unsuspecting users after which they raid their bank accounts.
So everyone is worried about this now. Yet, the most popular form of electronic payment in shops in NZ is the user of a bank ca
Re: (Score:2, Informative)
http://www.telegraph.co.uk/news/newstopics/politics/lawandorder/3173346/Chip-and-pin-scam-has-netted-millions-from-British-shoppers.html [telegraph.co.uk]
The article makes it sound so simple... (Score:2)
I don't see how any well-designed high-profile site wouldn't account for the possibility it might get hacked, let alone not have an automated method for undoing the damage... A simple approach would be to generate an MD5 checksum from each file (i.e. ASP, JPG, flash) and compare it to the MD5 checksums of what they're "supposed" to
Re:The article makes it sound so simple... (Score:5, Insightful)
You don't need to hack a high-profile site to put malicious JavaScript on there. Most high-profile sites, directly or indirectly, load tons of third-party objects.
Advertising, for example, is an excellent JavaScript injection vector.
A 'secure mode' for browsers? (Score:5, Insightful)
That way users can both bank online securely and not have half the web break for them because they've disabled javascript.
Javascript *is* a typical attack vector (Score:2, Insightful)
Anybody who knows the history of security vulnerabilities in browsers knows that Javascript itself is the all-time-best attack vector. If Javascript is enabled in any browser, that browser can be immediately compromised when you visit a compromised website. There are latent epidemics of Javascript zero-day vulnerabilities in all browsers.
Want much better security in your b
No passwords (Score:2, Informative)
Re: (Score:2)
Surely banking would be much safer if there was a public key for the bank and a private key for the card stored on the card. The bank would have the private bank key and public card key.
Then you could use a card reader to create encrypted messages to send to the bank.
Although it doesn't deal with the problem of if the bank's key gets compromised. They'd have to recall all the cards..
Re: (Score:3, Interesting)
Javascript alerts would be fine, as long as they would stay only with their own content and not interrupt other tabs/windows or other programs on the system.
There is a very long-standing bugzilla bug about this for Mozilla, you can read:
https://bugzilla.mozilla.org/show_bug.cgi?id=59314 [mozilla.org]
Bug 59314 - Alerts should be content-modal, not window-modal
(comment #39 describes a security problem that sounds similar to the problem here)
Lots of good ideas in that page about how alerts could be handled differen