Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Firefox Spoofing Bug Puts Passwords At Risk

Posted by Zonk on Fri Jan 04, 2008 09:52 AM
from the please-keep-the-fox-in-the-pen dept.
Mozilla Security The Internet
hairyfeet writes "Aviv Raff, an Israeli researcher known for his work in hunting browser bugs, has revealed a Firefox spoofing vulnerability which could allow identity thieves to dupe users into giving up their password. According to Mr. Raff Firefox fails to sanitize single quotes and spaces in the 'Realm' value of an authentication header. Raff was quoted as saying 'This makes it possible for an attacker to create a specially crafted Realm value which will look as if the authentication dialog came from a trusted site.' This vulnerability was shown to be in the latest Firefox, version 2.0.0.11 and until Mozilla fixes this vulnerability Mr. Raff recommends in his blog 'not to provide username and password to Web sites which show this dialog.'"
+ -
story

Related Stories

Submission: Firefox spoofing bug puts your passwords at risk by hairyfeet (841228)
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

Firefox Spoofing Bug Puts Passwords At Risk 50 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.

  • An honest Security Bug (Score:5, Informative)

    by pembo13 (770295) on Friday January 04 2008, @09:56AM (#21909112) Homepage
    Hope the Firefox guys can get to it quickly, but it doesn't sound too serious. In the mean time, people need to practice the whole watching where you browse idea.

    • Denial is the best option (Score:3, Funny)

      by Anonymous Coward
      As with all FOSS, the first course of action needs to be very vocal denials. It's always worked in the past... after all, would anyone be using Firefox if we were honest from the start about all the gaping security holes, buffer overflows, and the over 300 memory leaks? Not likely, especially since IE7 is both more stable and secure... and most people already have it on their computers! Also, now IE8 is coming down the pipe, we won't be able to use the "itz notz teh stadtards komplient!!11!!1!" whine. I

  • Show me the demo!! (Score:5, Funny)

    by Prairiewest (719875) on Friday January 04 2008, @09:58AM (#21909142) Homepage
    Too bad he doesn't want to show an online demo of this, I was kind of getting used to being able to try out these kinds of exploits in my own browser. Call me masochistic.

  • Phishing (Score:5, Insightful)

    by JCSoRocks (1142053) on Friday January 04 2008, @09:58AM (#21909146)
    Ugh, This is basically just another form of phishing. Who follows links to websites that require a username / password anymore anwyay? If I want to go to gmail, my bank, whatever, I'm definitely not going to follow a link from some random website or e-mail. I'm going to type in the URL and login. Don't get me wrong, it'll be good to see this patched - But basically this vulnerability only matters if you're the same kind of person that falls for phishing.

    • Re:Phishing (Score:4, Insightful)

      by jlarocco (851450) on Friday January 04 2008, @10:06AM (#21909228) Homepage

      But basically this vulnerability only matters if you're the same kind of person that falls for phishing.

      Haven't Firefox zealots been pushing Firefox to the "kind of person that falls for phishing"? I was under the impression that "being secure" was one of their big selling points that they liked to talk about.

      Given that, they should fix this immediately.

      • FireFox is definitely marketed as being more secure. However, there are certain things that people just shouldn't do. Taking the time to read and respond to all the spam they get, for example. Following links to trusted sites is another one. Do you download gobs of awesome free screen savers and clocks and smiley face making programs? no. Why? because you know they're full of crapware. Same thing.

        I said that it should be patched in my original post, but my point was that this is just a way to do a phishi
        • They're taking advice from nerds. If this doesn't show a lack of common sense, I don't know what does.

          (Sticking a tie in an electric hand mixer - while wearing the tie - runs a close second)
          • I dunno, if the RIAA took advice from nerds and embraced digital downloads rather than fighting tooth and nail against them, then they'd be doing a lot better for themselves.
          • Taking advice from nerds on topics in which the nerds are experts shows a great deal of common sense.

            Taking advice from nerds (or anyone else) on topics in which they are not experts is the problem. That's why I have a problem with politics because most of the things being advised by politicians are being advised by people who have little or no expertise in the subject at hand. Seeking foreign policy advice from Senator Obama or Governor Huckabee, for instance, shows a lack of common sense. Seeking advic

    • Re: (Score:3, Informative)

      by cheater512 (783349)
      This only works on the actual HTTP authentication stuff, not web forms.
      No mainstream site uses it so they'll probably get confused rather than enter in their password.

      • Re: (Score:3, Interesting)

        by fmobus (831767)

        And also because HTTP authentication dialogs are quite "spoofable" anyway. You can make a phony dialog, whose style matches the system you're targeting. Of course, you can't make it modal like the real one, but most users can't really tell the difference.

        Just like the "lock" on older versions of Internet Explorer. People were taught to look for the "lock" icon on the status bar to assure they are safe. However, if the status bar is disabled (IIRC, it is the bloody DEFAULT), you could fake a status bar wit

    • Rats, I thought something was fishy, them ditching SSL and all.

      Don't laugh, Datek (now Ameritrade) used basic HTTP auth until about 2001 or so. Yikes!
      • Oh curse you AC! You are indeed right. that's what I get for trying to be close to having the first post. :)

  • Please enter your credentials here: (Score:5, Insightful)

    by PrescriptionWarning (932687) on Friday January 04 2008, @10:01AM (#21909176)
    What's really to stop someone from popping up a screen that says "Please enter your PayPal username and password below:" anyway? I mean all they gotta do is set up some simple html page that kinda looks official and you can be sure that you'll get more than a handful of dummies who'll actually put it in. I have to wonder when things stop being considered the fault of the program and start being the fault of the user.

    • Re: (Score:2, Insightful)

      by hotrodent (1017236)
      Agreed, and heck, I'm a big Firefox advocate. But would you react the same way if the fault had been found in IE instead? A bug is a bug and needs to be fixed. Users will ALWAYS be users - that'll never change.

    • Re: (Score:3, Informative)

      by Basje (26968)
      Because the realm is the identifying element of authentication. The username/password combo automaticly resent if the realm matches.

      So if you first logon to paypal and afterwards to another page on the same realm, you don't need to retype the username/password.

      If another site mimics the exact realm, the username/password is sent to that site as well.

      Details here: http://httpd.apache.org/docs/1.3/howto/auth.html#basicworks [apache.org]

      • That doesn't sound right to me, but I'm not going to test it because I'd rather to go to bed.

        The realm is not a trusted string in any way, shape, or form, and if a browser did automatically hand out your username and password to any site claiming the same "Realm" it should cause quite a stir in the security community. Reasonably, I'd expect browsers to follow the specs you linked to in the Apache docs but only within the same domain.

        On the other hand, Basic authentication isn't widely used, so I guess m

    • Re: (Score:3, Insightful)

      by Bearhouse (1034238)
      Indeed. Slightly offtopic, but the really bad thing is that eBay and Paypal do just this, (popup screens across sites). The first time I was asked to verify my Paypal details when trying to pay for something on eBay, I spent a long time noting the different pieces of info, then backed out and rechecked, before submitting any more sensitive info, (Paypal ID and CC numbers).

      Yes, browser faults are serious and should be fixed, but a bigger problem is sloppy coding of sites that get people into bad "submit th

  • Youtube video (Score:5, Informative)

    by sucker_muts (776572) <sucker_pvn@nOspAm.hotmail.com> on Friday January 04 2008, @10:03AM (#21909210) Homepage Journal
    Youtube video mentioned in the article:

    http://youtube.com/watch?v=NaCPw1s3GFw [youtube.com]

     
  • OMG...

    What's this mean for all those who's answer to vulnerability was to block Flash and use Firefox!!!

    • It means don't give your f*ing password out to people who come to you. I have a password on my bank account, and whenever I go to my bank I have to give them my password, but I would never _ever_ give my password if someone from my bank contacted me (which actually happened once).

  • Who pays attention to realm, anyway? (Score:4, Insightful)

    by samjam (256347) on Friday January 04 2008, @10:12AM (#21909304) Homepage Journal
    Who pays attention to realm, anyway?

    I've always interpreted the realm as an advisory comment for the dialog box, and used the URL of the website to indicate whether or not I want to give up a password.

    Sam
  • AFAIK the passwords sent like this are still plain text, no encryption whatsoever. So the question rises : What site still uses this kind of primitive login?! No commercial sites, I guess. Another problem that makes this attack unlikely is that the user doesn't expect a dialog to appear, he wants the web_site_standard_login_form.

    More problems come from giving the user an identical page hosted on some evil server, in that case the user expects to see the login form.Then again, a bug is still a bug, and the

  • A spanish website with screenshoots of how this is handled by IE6, Firefox, Opera and Konqueror: http://www.kriptopolis.org/falsificando-dialogos-firefox [kriptopolis.org]

  • Sorry, but I'm calling BS (Score:3, Insightful)

    by Anonymous Coward on Friday January 04 2008, @10:25AM (#21909454)
    I'm having a hard time calling this a *bug*. I would rather call it a presentation problem.

    Then again, what's the problem?

    The standard Firefox HTTP auth dialog says "Please enter the username and password for $REALM at $URL". Note the included URL to prevent phishing.

    Now what Mr Raff does is basically set up $REALM as "Google Checkout (https://www.google.com) for more details see my page at" and $URL as the domain name he controls. The whole thing looks like: Please enter the username and password for Google Checkout (https://www.google.com) for more details see my page at http://avivraff.com/ [avivraff.com]".

    So no, I haven't looked at the HTTP RFC, but I am not sure that forbiding spaces and quotes in HTTP auth realms is the answer.
    What Firefox actually needs is just a better, more fail-safe presentation of the data on this dialog.

    Just my 2 AC cents (too lazy to create an account for just that)
    • Mod parent up. This is exactly what the fault is. Firefox needs to present the details better, that's all.
  • I am still with 1.5, it's a memory hog and doesn't do everything that the latest version does and I am not even sure that it doesn't have the same vulnerability, but I am just not interested in FF2 and/or FF3 for now. The versions switch too fast all in the name of more functionality but the basic security and memory questions are still unanswered.

    Here is the real question: How do you really know that your browser is safe at all? You can download the code and read it, but I believe it is not just about co

    • Re:FF1.5 (Score:4, Insightful)

      by dvice_null (981029) on Friday January 04 2008, @11:05AM (#21909934)
      > Here is the real question: How do you really know that your browser is safe at all?

      Well first thing is to make sure you are using the latest version. E.g. not using FF 1.5, which doesn't anymore get security updates at all.

      That is pretty much all you need to do if you are a normal user. If you need superiour security, then you run the browser in a sandbox.
      • My browser has no plugins, no flash, the js is disabled. I use it only for reading text basically, so it doesn't matter much which version it is.
      • True, but that's where the design really has to be refined to the point of being proven mathematically. It has to be proven that the reporting is done in a way, which prevents spoofing from happenning no matter what.
      • Here's a better one: the CIA wants you to wear tinfoil hats because such hats act as an antenna to focus mind-control rays on your head, so they started the rumor that tinfoil hats protect you.
    • This is not an injection bug per se, but more a string parsing bug. Parsing needs to be done as long as not all content is implicitly structured. One point in using XML for anything is to avoid doing any parsing on your own. But, think about it, would you like an e-mail address, URL or file path to be a structued list or XML snippet? And could we be sure that the structure is always the right one, so there will be no need to flatten it and reparse it and get into the same old bugs?

      Finite state machines wit

      • According to Mr. Raff Firefox fails to sanitize...
        Read like "Mr. Raff Firefox", because of a missing comma. Should be:

        According to Mr. Raff, Firefox fails to sanitize...
      • Mr. Raff Firefox. Calling him Mr. Raff made me chuckle, like Mr. Ed or Mr. Larry. Not quite sure on the Aviv prefix, other than an ear of corn in the spring. Maybe it means he's a farmer/researcher.

    • I always use my own bookmarks or type the url of the site i wish to visit

      Say you're trying to buy something online. One typical use case is the following:

      1. The seller's web site directs the buyer to a third-party payment processor such as PayPal, WorldPay, Amazon, or Google. Seller gives the seller's identity, a summary of the order, and an amount to the payment processor, and redirects the buyer to the payment processor.
      2. The buyer authenticates to the payment processor, commonly using a password over TLS.
      3. The buyer inspects the seller's identity claims, the order summary, and

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.