Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Firefox Spoofing Bug Puts Passwords At Risk

Zonk posted more than 6 years ago | from the please-keep-the-fox-in-the-pen dept.

Mozilla 157

hairyfeet writes "Aviv Raff, an Israeli researcher known for his work in hunting browser bugs, has revealed a Firefox spoofing vulnerability which could allow identity thieves to dupe users into giving up their password. According to Mr. Raff Firefox fails to sanitize single quotes and spaces in the 'Realm' value of an authentication header. Raff was quoted as saying 'This makes it possible for an attacker to create a specially crafted Realm value which will look as if the authentication dialog came from a trusted site.' This vulnerability was shown to be in the latest Firefox, version 2.0.0.11 and until Mozilla fixes this vulnerability Mr. Raff recommends in his blog 'not to provide username and password to Web sites which show this dialog.'"

cancel ×

157 comments

Sorry! There are no comments related to the filter you selected.

impossible! (-1, Troll)

Anonymous Coward | more than 6 years ago | (#21909106)

open source is so secure this could never happen, mein fuhrer!

Oh, let us mine furor! (-1, Offtopic)

Anonymous Coward | more than 6 years ago | (#21909284)

The new Mitt Romney campaign ad is a total hoot:
http://www.youtube.com/watch?v=Af1OxkFOK18 [youtube.com]

Re:Oh, let us mine furor! (-1, Offtopic)

Anonymous Coward | more than 6 years ago | (#21910042)

Looks somehow...different...botox?

An honest Security Bug (4, Informative)

pembo13 (770295) | more than 6 years ago | (#21909112)

Hope the Firefox guys can get to it quickly, but it doesn't sound too serious. In the mean time, people need to practice the whole watching where you browse idea.

Re:An honest Security Bug (0, Troll)

bogaboga (793279) | more than 6 years ago | (#21909192)

I am inclined to conclude that Firefox is not as secure as first thought. Of late, I have seen more security related bugs on Firefox than Windows Internet Explorer. I hope I am wrong.

I wonder how many bugs have not been discovered yet.

Re:An honest Security Bug (5, Insightful)

mhall119 (1035984) | more than 6 years ago | (#21909262)

Look at the type of bugs, not just the number. One spoofing vulnerability does not compare to one remote code execution vulnerability.

It's like saying there are 10 ways a thief can trick a Toyota user into handing over their car keys, but only 1 way a thief can remotely start your Lexus and drive it wherever they want without you even realizing they've done so. Therefore Toyota's are less secure. Or, conversely, it's like saying paper is more dangerous than dynamite, because more people get paper cuts than blow themselves up.

Re:An honest Security Bug (3, Funny)

snoyberg (787126) | more than 6 years ago | (#21909740)

You have to listen to him, he made a car analogy. ... I'm just joking, it really was a good analogy.

Re:An honest Security Bug (0, Offtopic)

Anonymous Coward | more than 6 years ago | (#21909842)

Lexuses are Toyotas.

Re:An honest Security Bug (0)

Anonymous Coward | more than 6 years ago | (#21911098)

That word "Lexus" is pronounced "Licks-ass". Just FYI.

Re:An honest Security Bug (4, Funny)

KlaymenDK (713149) | more than 6 years ago | (#21910236)

I liked the paper/dynamite analogy way better. New, graphic, and even explosive. That's the kind of analogies we should promote! :-D

Re:An honest Security Bug (0)

Anonymous Coward | more than 6 years ago | (#21909402)

I wonder how many bugs have not been discovered yet.
and how many IE bugs will NEVER be discovered (except by the people exploiting them) because no one can see the code.
just the fact that this bug has been discovered and can now be fixed is a plus for firefox

Re:An honest Security Bug (0)

Anonymous Coward | more than 6 years ago | (#21910492)

Yea. 'Cos all those eyes looking at the code certainly saw this one. Must've been hiding in the memory_leaker class.

Not to get too technical, but... (5, Funny)

thegnu (557446) | more than 6 years ago | (#21909448)

I wonder how many bugs have not been discovered yet.

All of them. No wait, let me check...

Yep, all of them!

Re:Not to get too technical, but... (1)

Wanado (908085) | more than 6 years ago | (#21910652)

All of them.
Check again. Ever been involved in a project that has bug lists? I'm guessing not. There are many bugs that have been discovered yet remain bugs in the product. It takes time to fix bugs. Some projects are large and bugs aren't instantly corrected the moment they are discovered. They're not all simple typos. Even once a solution has been determined, it may still take even more time to implement the solution. Then even when they're fixed, the bug usually remains in that software version while a new version is rolled out with fixes, so you may want to be aware of existing bugs in the software version that you use.

Re:Not to get too technical, but... (4, Funny)

blackjackshellac (849713) | more than 6 years ago | (#21911244)

Reminds me of this joke,

We were traveling by plane at half the speed of smell and got passed by a kite.
Then one of the two engines failed. And the guy sitting next to me went nuts
and asked how far the other engine would take us. All the way to the scene of the
crash, I told him. But we'll beat the paramedics by 35 minutes.
-- Ron White

Re:An honest Security Bug (0)

Anonymous Coward | more than 6 years ago | (#21910404)

What about all of the bugs that MS fixes that are never even mentioned anywhere? Sure there are bugs in IE that are discovered and announced by someone outside of MS. There are also bugs that MS find and MS's teams of lawyers and marketing/PR people have deemed appropriate to announce to the worlds. There are then the bugs that their lawyers and marketing/PR people have deemed inappropriate to announce to anyone. Most (not all, never all) of those bug fixes eventually get rolled up into a service pack, or if MS's marketing/PR and lawyer teams think it would be good PR to announce a critical bug and fix they do so with a hot fix.

The difference with Firefox/Mozilla/Linux/et al is that they are open and the bugs are not hidden and the bugs are all eventually fixed.

I take all surveys, graphs, charts, studies, etc with a grain of salt. Any bean counter can contort those numbers to mean anything. MS can decide to announce a certain number of bugs to make it appear as if they have had fewer bugs in their software over the last year than competing products. Until MS becomes translucent, never believe the hype that they have fewer bugs than their competition. I'm not saying they don't, I'm just saying, don't believe it. Don't believe anything you cannot verify yourself. The same could be said for politics and government.

Apparently, a fix is already out (0)

Anonymous Coward | more than 6 years ago | (#21909468)

You can get it here [opera.com]

Denial is the best option (3, Funny)

Anonymous Coward | more than 6 years ago | (#21909562)

As with all FOSS, the first course of action needs to be very vocal denials. It's always worked in the past... after all, would anyone be using Firefox if we were honest from the start about all the gaping security holes, buffer overflows, and the over 300 memory leaks? Not likely, especially since IE7 is both more stable and secure... and most people already have it on their computers! Also, now IE8 is coming down the pipe, we won't be able to use the "itz notz teh stadtards komplient!!11!!1!" whine. IE8 could very well be the final nail in our coffin... unless we keep lying and spinning to increase Firefox's market share (or at least not lose too much).

So really, we have to deny early and often. And hey, this is FOSS: fixing problems is really secondary. If they don't like it, let them go buy something, the cheap bastages. You get what you pay for.

Re:An honest Security Bug (0)

Anonymous Coward | more than 6 years ago | (#21910224)

yeah, keep being an open source apologist. we see through all of that.

Show me the demo!! (5, Funny)

Prairiewest (719875) | more than 6 years ago | (#21909142)

Too bad he doesn't want to show an online demo of this, I was kind of getting used to being able to try out these kinds of exploits in my own browser. Call me masochistic.

Re:Show me the demo!! (3, Insightful)

gEvil (beta) (945888) | more than 6 years ago | (#21909172)

Well, he apparently has a demo video up on YouTube (hey, videos are better than nothing). Unfortunately, PCWorld would much rather give me links to searches on their own site instead of a USEFUL link to the actual video...

Re:Show me the demo!! (4, Informative)

Kijori (897770) | more than 6 years ago | (#21910128)

Here it is: http://youtube.com/watch?v=NaCPw1s3GFw [youtube.com] I made the same mistake of clicking on the PCWorld link expecting it to go to the actual video... how naive of me...

Re:Show me the demo!! (2, Insightful)

MMC Monster (602931) | more than 6 years ago | (#21910724)

Especially when the sentence says that a link to the video is provided.

I'm certainly not following any other links from their site. I'd probably end up on goatse.cx or something.

Re:Show me the demo!! (1)

euxneks (516538) | more than 6 years ago | (#21911036)

Mod parent up please, the stupid links to pcworld tag pages are extremely annoying and unhelpful - I think they're doing it for some form of SEO...? Or something, becuase it's not useful to the end user.

Re:Show me the demo!! (1, Informative)

Anonymous Coward | more than 6 years ago | (#21909698)

Phishing (5, Insightful)

JCSoRocks (1142053) | more than 6 years ago | (#21909146)

Ugh, This is basically just another form of phishing. Who follows links to websites that require a username / password anymore anwyay? If I want to go to gmail, my bank, whatever, I'm definitely not going to follow a link from some random website or e-mail. I'm going to type in the URL and login. Don't get me wrong, it'll be good to see this patched - But basically this vulnerability only matters if you're the same kind of person that falls for phishing.

Re:Phishing (3, Insightful)

jlarocco (851450) | more than 6 years ago | (#21909228)

But basically this vulnerability only matters if you're the same kind of person that falls for phishing.

Haven't Firefox zealots been pushing Firefox to the "kind of person that falls for phishing"? I was under the impression that "being secure" was one of their big selling points that they liked to talk about.

Given that, they should fix this immediately.

Re:Phishing (0, Troll)

somersault (912633) | more than 6 years ago | (#21909334)

The kind of person that falls for phishing is screwed in life anyway. Firefox 'zealots' simply recommend an easily-better-than-IE browser to their friends and associates, and a lot of them will just happen to be people with no common sense.

Re:Phishing (1)

B3ryllium (571199) | more than 6 years ago | (#21909974)

They're taking advice from nerds. If this doesn't show a lack of common sense, I don't know what does.

(Sticking a tie in an electric hand mixer - while wearing the tie - runs a close second)

Re:Phishing (1)

somersault (912633) | more than 6 years ago | (#21910432)

I dunno, if the RIAA took advice from nerds and embraced digital downloads rather than fighting tooth and nail against them, then they'd be doing a lot better for themselves.

Re:Phishing (1)

ConceptJunkie (24823) | more than 6 years ago | (#21910626)

Taking advice from nerds on topics in which the nerds are experts shows a great deal of common sense.

Taking advice from nerds (or anyone else) on topics in which they are not experts is the problem. That's why I have a problem with politics because most of the things being advised by politicians are being advised by people who have little or no expertise in the subject at hand. Seeking foreign policy advice from Senator Obama or Governor Huckabee, for instance, shows a lack of common sense. Seeking advice on how to make tons of money hawking doom and destruction from Al Gore is a very good idea. Seeking advise on how to tick off not only your political opponents here and abroad but all the people who elected you in the first place from President Bush is bound to get you the best information on the planet.

If nerds suggest you use Firefox, I think that's a good idea. I'm a nerd and I promote Firefox among my non-techie friends and family, and I know what I'm talking about.

Re:Phishing (1)

JCSoRocks (1142053) | more than 6 years ago | (#21909388)

FireFox is definitely marketed as being more secure. However, there are certain things that people just shouldn't do. Taking the time to read and respond to all the spam they get, for example. Following links to trusted sites is another one. Do you download gobs of awesome free screen savers and clocks and smiley face making programs? no. Why? because you know they're full of crapware. Same thing.

I said that it should be patched in my original post, but my point was that this is just a way to do a phishing scam. It's not like there's a bug in FireFox that lets anyone just sniff your password when you're entering it into a legitimate site.

Payment processors? (1)

tepples (727027) | more than 6 years ago | (#21910112)

However, there are certain things that people just shouldn't do. Taking the time to read and respond to all the spam they get, for example. Following links to trusted sites is another one.
Even if the trusted site is a payment processor such as PayPal, Google, or Amazon, and the link comes from an online store where the user is trying to complete a purchase?

Re:Phishing (0)

Anonymous Coward | more than 6 years ago | (#21909238)

Please - learn how to spell. loose != lose.
Agreed. So please learn that "login" is a noun and "log in" is a verb.

Tip: You don't say, "I loginned to the site" [should be: "logged in"] or "I have logsin for 3 different sites" [should be: "logins"], do you?

Cheers.

Re:Phishing (1)

JCSoRocks (1142053) | more than 6 years ago | (#21909308)

Oh curse you AC! You are indeed right. that's what I get for trying to be close to having the first post. :)

Re:Phishing (1)

morgan_greywolf (835522) | more than 6 years ago | (#21909784)

It has nothing to do with forms-based login pages like GMail or banks use. It has to do with the 'basic auth' dialog like what gets presented to you when you login to your average LinkSys router or the 'control panel' applications that many shared hosting providers use like 'CPanel'.

And such attacks could be used in combination with stuff like DNS spoofing -- take over your ISPs DNS server and myhostingprovider.com goes where the h4x0r wants it to go.

Re:Phishing (2, Informative)

cheater512 (783349) | more than 6 years ago | (#21910188)

This only works on the actual HTTP authentication stuff, not web forms.
No mainstream site uses it so they'll probably get confused rather than enter in their password.

Re:Phishing (2, Interesting)

fmobus (831767) | more than 6 years ago | (#21910612)

And also because HTTP authentication dialogs are quite "spoofable" anyway. You can make a phony dialog, whose style matches the system you're targeting. Of course, you can't make it modal like the real one, but most users can't really tell the difference.

Just like the "lock" on older versions of Internet Explorer. People were taught to look for the "lock" icon on the status bar to assure they are safe. However, if the status bar is disabled (IIRC, it is the bloody DEFAULT), you could fake a status bar with a fake icon.

Fortunately, IE7 moved the icon to the location bar (a sensible approach, probably learned from OSS browsers like firefox). But yeah, they still ship with a status bar that can be disabled. Go figure.

Re:Phishing (1)

Burz (138833) | more than 6 years ago | (#21911034)

Yes, and the status bar is important for checking a link's URL before clicking on it.

Re:Phishing (1)

Odiumjunkie (926074) | more than 6 years ago | (#21911158)

> And also because HTTP authentication dialogs are quite "spoofable" anyway.

This reminds me of something I've been meaning to investigate for a while now.

If you use Firefox to store your passwords for various sites using its password manager, you have the option of setting a "Master Password" - a password that is used to encrypt your stored passwords on disk as a security precaution. Each time you start an instance of firefox, if you browse to a site for which you have a stored password, firefox will ask you for the master password so it can decrypt the stored password for the site and autocomplete it for you.

So, this is my concern - how hard would it be to fake this security dialogue with javascript and store whatever the user entered?

http://img178.imageshack.us/img178/9444/slashdotcu7.png [imageshack.us] -- screencap of the security dialogue

Re:Phishing (1)

fmobus (831767) | more than 6 years ago | (#21911312)

Well, a website could fake this, but the attacker would still need access to the cyphertext containing the other passwords to do something useful. Presumably, this requires filesystem access on computer running that browser (either physically or remotely) and that alone is a much more serious problem. With file system access, one could perform evil instrumentation in a variety of points: replacing firefox executable, replacing DNS entries, or even keylogging.

You mean Paypal didn't switch to basic auth? (1)

wsanders (114993) | more than 6 years ago | (#21910820)

Rats, I thought something was fishy, them ditching SSL and all.

Don't laugh, Datek (now Ameritrade) used basic HTTP auth until about 2001 or so. Yikes!

Re:You mean Paypal didn't switch to basic auth? (0)

Anonymous Coward | more than 6 years ago | (#21911504)

Give a man a fish and you have fed him for today. Teach a man to fish, and
he'll be gone all day.

There, fixed that for you.

Re:Phishing (1)

bl8n8r (649187) | more than 6 years ago | (#21911066)

> If I want to go to gmail, my bank, whatever,
> I'm definitely not going to follow a link from some random website or e-mail.

The bigger picture is coupled with XSS (http://en.wikipedia.org/wiki/Cross-site_scripting) or a writeable web root*, you could be redirected without even knowing it. Malware could also drop a local web page on your computer and redirect you there to offer up the exploit. How about when you purchase things on Ebay and click "Continue to my PayPal account". For every person like yourself who is extra careful, there are 1000 people that are not**. This is why exploits like this are such a big deal.

[*] - http://blogs.zdnet.com/security/?p=15 [zdnet.com]
[**] - http://en.wikipedia.org/wiki/Storm_botnet [wikipedia.org]

For more information (-1, Troll)

Anonymous Coward | more than 6 years ago | (#21909152)

Read more about this at the ContactLog Blog [contactlog.net]

SLASHDOT CENSORSHIP: 1984 IS HERE!!! (0, Troll)

Anonymous Coward | more than 6 years ago | (#21909240)

Slashdot is deleting replies that it deems politically subversive, like this one!

Welcome to Totalitarianism in the 21st Century!

Fight the power!!!

Re:SLASHDOT CENSORSHIP: 1984 IS HERE!!! (1, Insightful)

Anonymous Coward | more than 6 years ago | (#21909738)

what power?

Re:SLASHDOT CENSORSHIP: 1984 IS HERE!!! (2, Informative)

PatrickThomson (712694) | more than 6 years ago | (#21909820)

The power of voodoo, duh.

Re:SLASHDOT CENSORSHIP: 1984 IS HERE!!! (0)

Anonymous Coward | more than 6 years ago | (#21910244)

The power of voodoo, duh.

Who do?

Please enter your credentials here: (5, Insightful)

PrescriptionWarning (932687) | more than 6 years ago | (#21909176)

What's really to stop someone from popping up a screen that says "Please enter your PayPal username and password below:" anyway? I mean all they gotta do is set up some simple html page that kinda looks official and you can be sure that you'll get more than a handful of dummies who'll actually put it in. I have to wonder when things stop being considered the fault of the program and start being the fault of the user.

Re:Please enter your credentials here: (3, Insightful)

hotrodent (1017236) | more than 6 years ago | (#21909250)

Agreed, and heck, I'm a big Firefox advocate. But would you react the same way if the fault had been found in IE instead? A bug is a bug and needs to be fixed. Users will ALWAYS be users - that'll never change.

Re:Please enter your credentials here: (1)

tristian_was_here (865394) | more than 6 years ago | (#21909582)

Yeah but a bug in IE means it will get fixed in the next service pack.

Not Till.... (1)

pentalive (449155) | more than 6 years ago | (#21910002)

No, the bug in IE will get fixed in the service pack that comes after Microsoft finds and acknowledges the bug.

Re:Please enter your credentials here: (1)

X0563511 (793323) | more than 6 years ago | (#21909616)

Users will ALWAYS be users - that'll never change.

Oh, it will change. When the "users" have no money left and are all afraid to touch computers.

Re:Please enter your credentials here: (2, Informative)

Basje (26968) | more than 6 years ago | (#21909422)

Because the realm is the identifying element of authentication. The username/password combo automaticly resent if the realm matches.

So if you first logon to paypal and afterwards to another page on the same realm, you don't need to retype the username/password.

If another site mimics the exact realm, the username/password is sent to that site as well.

Details here: http://httpd.apache.org/docs/1.3/howto/auth.html#basicworks [apache.org]

Re:Please enter your credentials here: (2, Informative)

totally bogus dude (1040246) | more than 6 years ago | (#21909938)

That doesn't sound right to me, but I'm not going to test it because I'd rather to go to bed.

The realm is not a trusted string in any way, shape, or form, and if a browser did automatically hand out your username and password to any site claiming the same "Realm" it should cause quite a stir in the security community. Reasonably, I'd expect browsers to follow the specs you linked to in the Apache docs but only within the same domain.

On the other hand, Basic authentication isn't widely used, so I guess most people wouldn't encounter ill effects of such a "feature", and most browsers only remember passwords based on the domain name anyway. The chances of anyone accessing a legitimate site that uses Basic authentication and then accessing an illegitimate site that happens to use the exact same realm name in the same browser session are pretty remote. Still, it seems a bit too simplistic for the modern web.

I've no idea how old that entry is, but I really do suspect it dates from earlier, simpler times. The server doesn't provide a Last-Modified header and I couldn't see a datestamp anywhere in the file.

Re:Please enter your credentials here: (1)

jon787 (512497) | more than 6 years ago | (#21911414)

Firefox does the sane thing and limits Realm to a hostname. Not sure about any other browser but we use HTTP Auth here and I've accidently switched from partial to fully-qualified domains and had it prompt me again.

Re:Please enter your credentials here: (1)

chrisv (12054) | more than 6 years ago | (#21911296)

The realm is only half of the identifying element - the URL requesting authentication is the other half. For basic authentication (RFC 2617 [ietf.org] , section 2), the realm value is only for the server sending it; if another server (identified typically by [ http/https, hostname, port ]) sends me a WWW-Authenticate header with the same realm name specified, for the purposes of authentication it is a different realm. In digest authentication (section 3), it is possible to have credentials go across multiple servers, but such servers have to be specified in the initial WWW-Authenticate header in a "domain" parameter; otherwise, the authentication is again only available to the server sending the WWW-Authenticate header in the first place.

Ultimately, unless your system, DNS server, proxy server (if you're using one), gateway, or the target server, have been broken into, obtaining the credentials for any given realm is going to be difficult; if your system has been broken into, this is pointless because they could just as easily install a keylogger to capture the authentication information as it's being entered; if your gateway has been broken into, then unless you're performing all authenticated transactions over HTTPS and/or not using HTTP Basic authentication, the information is going across there in cleartext anyway, and tcpdump is all that's needed to extract it. Since the proxy server tends to exist at the gateway level anyway, the same issues apply there. As far as the target server goes - you can either capture the authentication info there, or, since you've got permissions to do anything the webserver is capable of, including generally accessing the authentication DB, just grab the authentication information and be done with it.

So... good luck at attempting to reuse the exact realm of another server - since, for the purposes of comparing authentication realms, the realm name is little more than a token which identifies a given protection space on a single server (or multiple explicitly specified servers in HTTP Digest, but that's still explicit).

Re:Please enter your credentials here: (0, Troll)

Freeside1 (1140901) | more than 6 years ago | (#21909544)

When you spill hot coffee on your gonads while driving, it's not your fault. It's McDonald's. Seems like nowadays personal accountability is dead, though I can't say I remember a time when it wasn't dead...

No news (1)

El Lobo (994537) | more than 6 years ago | (#21909188)

A software is never safer than: * the number of people/resources trying to bring it down * Its popularity With the raise of both options, the number of found vulnerabilities will definitly increase.

pssst (1, Funny)

Anonymous Coward | more than 6 years ago | (#21909230)

If you post a message in slashdot containing your username in the first line, your password in the second and three blank lines below, "PWND" without the quotes in the subject line, and post it using Extrans you will get loads of karma. It worked for me.

PWND (1)

mpathetiq (726625) | more than 6 years ago | (#21909348)

your username
your password

Re:PWND (0)

Anonymous Coward | more than 6 years ago | (#21909400)

Username: Enoxice

Password:
 
...wait a minute, something seems fishy with this login page...

Re:PWND (2, Funny)

mpathetiq (726625) | more than 6 years ago | (#21909438)

It must have worked, I've got Excellent Karma!

Re:pssst (4, Funny)

zsouthboy (1136757) | more than 6 years ago | (#21910480)

All my passwords are hunter2 anyway.

Trawling for Trolls.... (1)

PortHaven (242123) | more than 6 years ago | (#21909286)

OMG...

What's this mean for all those who's answer to vulnerability was to block Flash and use Firefox!!!

Re:Trawling for Trolls.... (1)

mhall119 (1035984) | more than 6 years ago | (#21909352)

It means don't give your f*ing password out to people who come to you. I have a password on my bank account, and whenever I go to my bank I have to give them my password, but I would never _ever_ give my password if someone from my bank contacted me (which actually happened once).

Who pays attention to realm, anyway? (3, Insightful)

samjam (256347) | more than 6 years ago | (#21909304)

Who pays attention to realm, anyway?

I've always interpreted the realm as an advisory comment for the dialog box, and used the URL of the website to indicate whether or not I want to give up a password.

Sam

Just wondering (2, Insightful)

mariuszbi (1113049) | more than 6 years ago | (#21909328)

AFAIK the passwords sent like this are still plain text, no encryption whatsoever. So the question rises : What site still uses this kind of primitive login?! No commercial sites, I guess. Another problem that makes this attack unlikely is that the user doesn't expect a dialog to appear, he wants the web_site_standard_login_form.

More problems come from giving the user an identical page hosted on some evil server, in that case the user expects to see the login form.Then again, a bug is still a bug, and the only good bug is a dead one.

Re:Just wondering (1)

Auz (50055) | more than 6 years ago | (#21909658)

"Another problem that makes this attack unlikely is that the user doesn't expect a dialog to appear, he wants the web_site_standard_login_form."

Well, the more savvy users probably. I can think of several members of my family would probably assume the bank or whatever had just changed a few things.

Re:Just wondering (0)

Anonymous Coward | more than 6 years ago | (#21910672)

I didn't read the article but there is basic (non encrytped) and digest (encrypted) oh, and NTLM (also encrypted). Why would this only apply to basic.

Re:Just wondering (1)

KingMotley (944240) | more than 6 years ago | (#21910938)

It's only unencrypted if you are doing it over HTTP. Switch to HTTPS and it's encrypted. Or use digest, or NTLM security.

Re:Just wondering (1)

Todd Knarr (15451) | more than 6 years ago | (#21911374)

It's only unencrypted if you're doing Basic authentication. HTTP also defines Digest authentication, in which the password is never sent at all, only a digest to prove to the server that the client knows the password.

WHAT!? (-1, Flamebait)

Anonymous Coward | more than 6 years ago | (#21909418)

What..!? Passwords aren't secure... :-0 ! Who'd have thunk it...

In other news, Slashdot memes are old, and Anonymous Cowards never get comments approved... ...

Wow (1)

peipas (809350) | more than 6 years ago | (#21909424)

What a coincidence that the security researcher's last name is the same as the browser he is testing!

Re:Wow (1)

tepples (727027) | more than 6 years ago | (#21910256)

What a coincidence that the security researcher's last name is the same as the browser he is testing!
I see one instance of "Aviv Raff" and two instances of "Mr. Raff" in the summary. Could you explain what you mean by this?

Re:Wow (1)

mhall119 (1035984) | more than 6 years ago | (#21910370)

According to Mr. Raff Firefox fails to sanitize...
Read like "Mr. Raff Firefox", because of a missing comma. Should be:

According to Mr. Raff, Firefox fails to sanitize...

Re:Wow (1)

peipas (809350) | more than 6 years ago | (#21910430)

Mr. Raff Firefox. Calling him Mr. Raff made me chuckle, like Mr. Ed or Mr. Larry. Not quite sure on the Aviv prefix, other than an ear of corn in the spring. Maybe it means he's a farmer/researcher.

Sorry, but I'm calling BS (3, Insightful)

Anonymous Coward | more than 6 years ago | (#21909454)

I'm having a hard time calling this a *bug*. I would rather call it a presentation problem.

Then again, what's the problem?

The standard Firefox HTTP auth dialog says "Please enter the username and password for $REALM at $URL". Note the included URL to prevent phishing.

Now what Mr Raff does is basically set up $REALM as "Google Checkout (https://www.google.com) for more details see my page at" and $URL as the domain name he controls. The whole thing looks like: Please enter the username and password for Google Checkout (https://www.google.com) for more details see my page at http://avivraff.com/ [avivraff.com] ".

So no, I haven't looked at the HTTP RFC, but I am not sure that forbiding spaces and quotes in HTTP auth realms is the answer.
What Firefox actually needs is just a better, more fail-safe presentation of the data on this dialog.

Just my 2 AC cents (too lazy to create an account for just that)

Re:Sorry, but I'm calling BS (1)

stony3k (709718) | more than 6 years ago | (#21910768)

Mod parent up. This is exactly what the fault is. Firefox needs to present the details better, that's all.

Pffffft yeah right (0, Redundant)

marsvin (84268) | more than 6 years ago | (#21909486)

I'll just stop logging in on web sites until they fix this gaping security hole. Right.

FF1.5 (1)

roman_mir (125474) | more than 6 years ago | (#21909566)

I am still with 1.5, it's a memory hog and doesn't do everything that the latest version does and I am not even sure that it doesn't have the same vulnerability, but I am just not interested in FF2 and/or FF3 for now. The versions switch too fast all in the name of more functionality but the basic security and memory questions are still unanswered.

Here is the real question: How do you really know that your browser is safe at all? You can download the code and read it, but I believe it is not just about code, but mostly it is about the design. I am thinking a browser should allow me to have some sort of an instrumentation bar, where the information pertaining to security/memory/cpu usage is displayed in useful form. Something like a debug window for communications and various internal functions (extensions / plugins) that shows details of what is happening. I know this is not useful for a normal user, but if this was an option, then the powerusers could monitor the activity of their browser while using it and the vulnerabilities could be found faster. A poweruser could then mark something that is happening in the browser as suspicious and this info could be loaded into the developer site. If the same behaviour is marked as suspicious multiple times, it should then get a priority review.

This could be used to detect problems by more people than are interested in looking at the source code.

Re:FF1.5 (3, Insightful)

dvice_null (981029) | more than 6 years ago | (#21909934)

> Here is the real question: How do you really know that your browser is safe at all?

Well first thing is to make sure you are using the latest version. E.g. not using FF 1.5, which doesn't anymore get security updates at all.

That is pretty much all you need to do if you are a normal user. If you need superiour security, then you run the browser in a sandbox.

Re:FF1.5 (1)

roman_mir (125474) | more than 6 years ago | (#21909984)

My browser has no plugins, no flash, the js is disabled. I use it only for reading text basically, so it doesn't matter much which version it is.

Re:FF1.5 (1)

IAmGarethAdams (990037) | more than 6 years ago | (#21910194)

The real question is, if that was how it worked, how do you know that the plugin reporting the security information, number of connections, phone-home indicator etc are all telling the truth and not covering up some other kind of reporting?

I'm actually starting to think that my tinfoil hat is letting through some mind-altering brainrays which are convincing me that my tinfoil hat is working fine! How's that for a headfuck?!

Re:FF1.5 (1)

roman_mir (125474) | more than 6 years ago | (#21910310)

True, but that's where the design really has to be refined to the point of being proven mathematically. It has to be proven that the reporting is done in a way, which prevents spoofing from happenning no matter what.

Re:FF1.5 (1)

murdocj (543661) | more than 6 years ago | (#21910618)

Here's a better one: the CIA wants you to wear tinfoil hats because such hats act as an antenna to focus mind-control rays on your head, so they started the rumor that tinfoil hats protect you.

Re:FF1.5 (0)

Anonymous Coward | more than 6 years ago | (#21910824)

Your logic confounds me on so many levels

Still safe for me (1)

LagosPortugal.info (1212514) | more than 6 years ago | (#21909668)

I always use my own bookmarks or type the url of the site i wish to visit & of course I never save any user/passwords in my browsers, I always reccomend to my clients to use password storage software to save passwords never the browser & always use bookmarks, theres so many dogey sites out there now, sometimes i find my clients are afriad to click links on sites after i inform them of all the nastyness out there. just my 2 cents worth.

Payment processors? (1)

tepples (727027) | more than 6 years ago | (#21910424)

I always use my own bookmarks or type the url of the site i wish to visit
Say you're trying to buy something online. One typical use case is the following:
  1. The seller's web site directs the buyer to a third-party payment processor such as PayPal, WorldPay, Amazon, or Google. Seller gives the seller's identity, a summary of the order, and an amount to the payment processor, and redirects the buyer to the payment processor.
  2. The buyer authenticates to the payment processor, commonly using a password over TLS.
  3. The buyer inspects the seller's identity claims, the order summary, and the amount, and approves the payment.
  4. The payment processor deducts the amount from the buyer's account, adds it to the seller's account, notifies the seller of the order number and the amount paid, and presents a receipt to the buyer.
  5. Buyer is redirected to the seller's web site.
If you always use a bookmark to https://www.paypal.com/ [paypal.com] to visit PayPal, how will PayPal know the seller, the order number, or the amount?

Injection Vulnerabilities (-1, Offtopic)

RAMMS+EIN (578166) | more than 6 years ago | (#21909688)

Sometimes, injection vulnerabilities make me laugh. I mean, how difficult can it be to just put a string in another string?

Not very difficult, obviously.

And, honestly, it _isn't_ very difficult. It's only when you then go and interpret the resulting string as code that weird things start to happen. The solution is simple: don't treat strings as code. In Lisp, for example, the more natural way to compose the code would be to use list construction instead of string concatenation. That way, you can put whatever you want in the string, but it will never be excuted as code.

But then, of course, everybody loathes Lisp. And smug Lisp weenies. So I'll get modded down. On the other hand, I said I would get modded down, so I'll probably get modded up.

Re:Injection Vulnerabilities (1)

cnettel (836611) | more than 6 years ago | (#21910118)

This is not an injection bug per se, but more a string parsing bug. Parsing needs to be done as long as not all content is implicitly structured. One point in using XML for anything is to avoid doing any parsing on your own. But, think about it, would you like an e-mail address, URL or file path to be a structued list or XML snippet? And could we be sure that the structure is always the right one, so there will be no need to flatten it and reparse it and get into the same old bugs?

Finite state machines with more than a handful of states are hard (whether implemented explicitly or implicitly). They are harder for some people. We can try to make sure that the reinventing-the-wheel need is limited, but it's oh so surprising how often you want something that's only a bit different (or you find the standard interface to be so clunky that you roll your own *guilty smile*).

Re:Injection Vulnerabilities (1)

RAMMS+EIN (578166) | more than 6 years ago | (#21911416)

``This is not an injection bug per se, but more a string parsing bug.''

By "injection vulnerability", I mean and understand "a possibility to 'break out' of a certain datum and thus inject (part of) it into the surrounding data structure, where this is not desired". Is that not what is happening here?

``Parsing needs to be done as long as not all content is implicitly structured. One point in using XML for anything is to avoid doing any parsing on your own. But, think about it, would you like an e-mail address, URL or file path to be a structued list or XML snippet? And could we be sure that the structure is always the right one, so there will be no need to flatten it and reparse it and get into the same old bugs?''

I am not going to answer that, because it is beside the point. XML is parsed, too. What I meant in my original post is that you can create and pass everything in data structures, rather than marshalling and unmarshalling it.

If you _do_ marshal and unmarshal your data structures, of course it makes sense to do so using a robust marshaller and unmarshaller. And a proper API. If, in PHP, you do "SELECT FROM Table WHERE field = $value", you're asking for trouble. Of course, what Firefox does is going to be different at least in the language they use, but the principle along which all these vulnerabilities come in existence is the same: composing data in a way that doesn't preserve structure, and then assuming the structure has been preserved.

Re:Injection Vulnerabilities (1)

GuldKalle (1065310) | more than 6 years ago | (#21910182)

Damn, i'm confused now. I guess the only right choice would be to reply to your post.

nazi 'spoofing' of inf. puts all of US at risk (-1, Troll)

Anonymous Coward | more than 6 years ago | (#21909894)

the 'problems' as presented by the 'mainstream' mediahhaha, are homeowners, banks, energy consumption/waste, & now declining employment. none of this connects to the billions per day of maintaining the 'wars', & fudging the weather?

we know there's been a huge cost of life & limb. the rest of it must be 'on the house'.

of course there's some notion that numerous billionerrors are profiting handsomely, no mention of that debacle either.

talk about being bushwhacked, & kept in the dark?

if thinking about such things frustrates you, you might consider signing up for fuddle's patentdead anti-frustration devise, or just continue following the corepirate nazi hypenosys story LIEn. anything of relevance is replaced almost instantly with pr ?firm? scriptdead mindphuking propaganda or 'celebrity' trivia 'foam'. meanwhile;

http://news.yahoo.com/s/ap/20071229/ap_on_sc/ye_climate_records;_ylt=A0WTcVgednZHP2gB9wms0NUE [yahoo.com]

http://www.nytimes.com/2007/12/31/opinion/31mon1.html?em&ex=1199336400&en=c4b5414371631707&ei=5087%0A [nytimes.com]

is it time to get real yet? A LOT of energy is being squandered in attempts to keep US in the dark. in the end (give or take a few 1000 years), the creators will prevail (world without end, etc...), as it has always been. the process of gaining yOUR release from the current hostage situation may not be what you might think it is. butt of course, most of US don't know, or care what a precarious/fatal situation we're in. for example; the insidious attempts by the felonious corepirate nazi execrable to block the suns' light, interfering with a requirement (sunlight) for us to stay healthy/alive. it's likely not good for yOUR health/memories 'else they'd be bragging about it? we're intending for the whoreabully deceptive (they'll do ANYTHING for a bit more monIE/power) felons to give up/fail even further, in attempting to control the 'weather', as well as a # of other things/events.

http://video.google.com/videosearch?hl=en&q=video+cloud+spraying [google.com]

dictator style micro management has never worked (for very long). it's an illness. tie that with life0cidal aggression & softwar gangster style bullying, & what do we have? a greed/fear/ego based recipe for disaster. meanwhile, you can help to stop the bleeding (loss of life & limb);

http://www.cnn.com/2007/POLITICS/12/28/vermont.banning.bush.ap/index.html [cnn.com]

the bleeding must be stopped before any healing can begin. jailing a couple of corepirate nazi hired goons would send a clear message to the rest of the world from US. any truthful look at the 'scorecard' would reveal that we are a society in decline/deep doo-doo, despite all of the scriptdead pr ?firm? generated drum beating & flag waving propaganda that we are constantly bombarded with. is it time to get real yet? please consider carefully ALL of yOUR other 'options'. the creators will prevail. as it has always been.

corepirate nazi execrable costs outweigh benefits
(Score:-)mynuts won, the king is a fink)
by ourselves on everyday 24/7

as there are no benefits, just more&more death/debt & disruption. fortunately there's an 'army' of light bringers, coming yOUR way. the little ones/innocents must/will be protected. after the big flash, ALL of yOUR imaginary 'borders' may blur a bit? for each of the creators' innocents harmed in any way, there is a debt that must/will be repaid by you/us, as the perpetrators/minions of unprecedented evile, will not be available. 'vote' with (what's left in) yOUR wallet, & by your behaviors. help bring an end to unprecedented evile's manifestation through yOUR owned felonious corepirate nazi glowbull warmongering execrable. some of US should consider ourselves somewhat fortunate to be among those scheduled to survive after the big flash/implementation of the creators' wwwildly popular planet/population rescue initiative/mandate. it's right in the manual, 'world without end', etc.... as we all ?know?, change is inevitable, & denying/ignoring gravity, logic, morality, etc..., is only possible, on a temporary basis. concern about the course of events that will occur should the life0cidal execrable fail to be intervened upon is in order. 'do not be dismayed' (also from the manual). however, it's ok/recommended, to not attempt to live under/accept, fauxking nazi felon greed/fear/ego based pr ?firm? scriptdead mindphuking hypenosys.

consult with/trust in yOUR creators. providing more than enough of everything for everyone (without any distracting/spiritdead personal gain motives), whilst badtolling unprecedented evile, using an unlimited supply of newclear power, since/until forever. see you there?

"If my people, which are called by my name, shall humble themselves, and pray, and seek my face, and turn from their wicked ways; then will I hear from heaven, and will forgive their sin, and will heal their land."

meanwhile, the life0cidal philistines continue on their path of death, debt, & disruption for most of US. gov. bush denies health care for the little ones;

http://www.cnn.com/2007/POLITICS/10/03/bush.veto/index.html [cnn.com]

whilst demanding/extorting billions to paint more targets on the bigger kids;

http://www.cnn.com/2007/POLITICS/12/12/bush.war.funding/index.html [cnn.com]

& pretending that it isn't happening here;

http://www.timesonline.co.uk/tol/news/world/us_and_americas/article3086937.ece [timesonline.co.uk]
all is not lost/forgotten/forgiven

(yOUR elected) president al gore (deciding not to wait for the much anticipated 'lonesome al answers yOUR questions' interview here on /.) continues to attempt to shed some light on yOUR foibles. talk about reverse polarity;

http://www.timesonline.co.uk/tol/news/environment/article3046116.ece [timesonline.co.uk]

Patch available for download... (-1, Offtopic)

Anonymous Coward | more than 6 years ago | (#21910506)

... in 3 .... 2 ....

While they're at it (0)

Anonymous Coward | more than 6 years ago | (#21910996)

Maybe add a warning to the basic authentication dialog box that the username/password is send unencrypted (base-64 encoded).
Load More Comments
Slashdot Login

Need an Account?

Forgot your password?