New Vulnerability Affects All Browsers

Jimmy writes "Secunia is reported about a new vulnerability, which affects all browsers. It allows a malicious web site to "hi-jack" pop-up windows, which could have been opened by e.g. a your bank or an online shop. Here is a demonstration of the vulnerability"

Not quite hijacking

[fembots]

I opened Secunia [secunia.com], Then open another browser window to Citibank [citibank.com] via Ctrl+N, and click on Citybank's Consumer Alert button, nothing happened.

But if I used the link from Secunia [secunia.com] to access Citybank, the Popup is then hijacked.

So it seems like you need to access (click on a link to) your trusted site via an untrusted site to get hijacked?

Re:Sniff, our little browser's all grown up...

[Anonymous Coward]

Firefox has already had several vulnerabilities, like the fake chrome site problem [virus.org] that let a misbehaved person fake an entire browser window (including all the security controls) using XUL. In that particular case, the reporter grew frustrated that his bug reports went unheeded for years in Bugzilla; he only got his way by making front-page news.

Mozilla, being an organization that develops an application collectively, falls prey to committee thinking. If enough people can shout you down on Bugzilla, your opinions don't matter and you get disillusioned.

The only worse part is that IE eliminates the middle man: bug reports to Microsoft are almost always met with silence instead of Mozilla's "Marked as DUPLICATE of a WONTFIX bug" responses.

Re:no problem here...

[Otter]

Same here -- the popup was hijacked in Mozilla 1.6 but my rather ancient Safari 1.0.3 put up the correct Citibank window.

We haven't heard from any Konqueror users yet (and the modem in my Linux box is broken so I can't check it myself). Is the immunity a khtml thing or was it Apple?

It's the cookies

[oddman]

Using Firefox 1.0.

I followed the appropriate links allowing cookies to be placed by citibank. The window was indeed hijacked.

I then followed the same links but this time not allowing citibank to place any cookies. The window was not hi-jacked.

Be aware of what/who is placing cookies on your machine!

Re:Sniff, our little browser's all grown up...

[deathazre]

I had a popup about a week ago.
on firefox.
in gentoo.
going between pages on slashdot.

wtf?

Does this affect secure browser sessions?

[Anonymous Coward]

https sessions are encrypted, right? What happens if a third party tries to hijack an encrypted pop-up? Would it just come out as garbage?

If they can hijack encrypted windows, then it's a big problem. If they can't, it's no big deal. Anybody can intercept an unencrypted session; this exploit is just one more method to do so.

Firefox 1.0

[pugugly]

Just an interesting note - if I left click on secunia's test page, and secunia opens citibank in a new tab, the exploit works.

If I middleclick on the test page and *force* firefox to open the site in a new tab, the exploit fails.

I don't know enough to now if this is a limitation in the exploit or in how they've written the exploit, but it's odd and interesting

Re:Firefox 1.0 seems fine

[Trillan]

I think it affects everyone who has javascript on and follows the instructions *exactly.* It's a very fragile one.

Re:UPDATE: Slackware 10, Konqueror, Mozilla 1.7.3

[crazyphilman]

OK, I've read through a bunch of Slashdot posts, and I've considered my experience with this thing, and here's my web developer's opinion of this "vulnerability":

In Javascript, if (and only if) your web page opens a new window, it "owns" that window. In other words, you have access to the whole DOM in that window. You can step through the document object, alter things, and so forth. This is how things are supposed to work; it's what enables us to open new windows and interact with the user. For example, maybe you want to pop up a window, ask a couple of questions, get the results, and close the window. Something I did recently at work was code an informational popup this way, because we had to kind of shock the user a little, to prevent them from just clicking "OK" to close all the alerts we were sending them. We made the popup very pretty and noticeable. OK?

So, the guys at Secunia decided that was a vulnerability and they set up this little test to scare everybody. So...

IF you went to a crooked website, and IF you clicked a link to pop up a site like Citibanks FROM THE CROOKED WEBSITE, and IF you went about your business on Citibank's site and clicked their crooked CSS overlay or popup (or whatever, you can probably do it in a couple of ways) THEN and ONLY THEN would you be sent to a crooked popup window with which they could phish you.

In other words, in order to really make use of this, a phisher would have to:

1. Get his code onto an actual commercial website so that people would find it and unsuspectingly click a banking link;

2. Evade capture for long enough to collect a bunch of credit card numbers (or whatever), with the commercial site's security team coming after him with knives sharpened;

3. Avoid having the crooked popup's web URL or IP address traced back to him by the FBI or Interpol within a day or so;

4. Figure out a way around the bank (or whatever) putting a huge banner on their site saying in bright red flashing letters "DO NOT APPROACH THIS SITE VIA A WEB LINK! TYPE THE SITE ADDRESS IN YOU SCHMUCK!" (or just putting a parent.close(); line of code in their existing Javascript, plus some code to refresh the page from the bank's server, clearing out anything from the crooked site -- would this work? I haven't tested it yet -- but I'm sure there are other ways to do it and the bank's developers are smarter than phishers, generally).

BUT, even if the phisher DOES figure all this out, it won't do him any good, because

WHEN PEOPLE GO TO THEIR BANK'S WEBSITE, THEY USUALLY JUST TYPE IN THE URL OR USE A BOOKMARK!

So, in short, I think this is nothing much to worry about.

Discuss! ;)

in my opinion there is a simple fix for this

[Pr0xY]

I think there is an easy fix for this. Basically the exploit is based on the fact that you can use javascript to open a window with the target the same as another window and overwrite the other ones content.

Well, why not make a new rule in javascript that would disallow any javascript code to access any popups that aren't a direct child of the current instance of the browser.

Basically what i mean is to have each window in it's own namespace and have the child window share said namespace. (I think one would have to not allow grandparents to access it either though).

so basically if two seperate windows open a window with target="name" then 2 windows are opened one for each instance and they have nothing to do with each other.

proxy

Vulnerability? For dyslexic octopii, maybe

[Cervantes]

Seriously, a 'vulnerability' in the 'oh shit!' sense of the phrase is "an opening by which an innocent user could get fscked by no fault of their own".

This strikes me as about as dangerous as the post-SP2 "Warning! If you copy and paste shit files from the net and click a few boxes, YOU COULD GET SPYWARE!".

For the record, I just nuked and reinstalled XP-Sp2 + hotfixes a few days ago (for once, not because it was fucked up, but my new raid0 array), so I have cherry IE6 and unextensioned-FireFox 1.

I tried several variations of the convoluted instructions, and could get no explicitly dangerous behavior. Mozilla didn't bat an eye, and IE once popped up a box saying "The script is trying to close this window, do you want to let it?" If I let it, then it opened the Citibank site in the window again.

Oooh, scary.

I'm sure there may be some actual, dangerous vulnerability here somewhere. But I've gotten better instructions from the japanese ASUS site, translated through google.

just say no to javascript

[0111 1110]

Javascript is the work of the devil. Leave it off unless you have a damn good reason to turn it on. Why give anyone that much control over your computer just to surf the web?

For firefox or opera just turn it on when you absolutely need it and never forget to turn it off right away when you are done. For IE make use of the security zones to implement javascript whitelisting. That's what I do because with firefox and opera I often don't remember to turn it off again until I start getting annoying popups or worse.

Seems like more than half of these vulnerabilities that keep popping up make use of javascript. That last one with the online banking passwords was pretty scary and made me very glad that I browse with javascript off.

Re:This sounds scary

[Curtman]

It didn't even work in Firefox here. It says "You are vulnerable, if a pop-up window opened and showed text from Secunia and not from CitiBank.". All I got was a bar at the top of the Secunia page that said:

"Firefox prevented this site from openning 619 popup windows. Click here for options"

Is this Windows only or something?

Re:Doesn't work for me

[Anonymous Coward]

Is pop-up blocking enabled on your Mozilla?

It appears to not work under Firefox 1.0 if the default pop-up blocking is enabled (even if you do the one designed to work with pop-up blocking). This is probably because the hijacking pop-up of Securnia is blocked from opening and replacing the Citibank pop-up.

Allowing pop-ups from Securnia allows this hijack to work in Firefox.

Smile (online bank) doesnt trust popups

[cliffski]

A month or two ago smile.co.uk swapepd their system from using a popup to using the current browser window. Thbey have won numerous awards for security (not to mention customer service) in the UK. They told customers this change was to ensure greater security. Looks like they are one step ahead of such vulnerabilities again, unlike citibank or many others.
just another reason to switch to http://www.smile.co.uk/ [smile.co.uk]
I dont work there, just a very happy customer.

ALL browsers? I think not!

[erc]

I tested this on both Firefox 1.0PR and IE 6.0.2900 running on Windows XP SP2 - neither one exhibited the vulnerability.

Re:Sniff, our little browser's all grown up...

[fubar1971]

What are you talking about? Firefox has always had bugs, why do you think we get security updates? The difference, as we will soon see, is that the Firefox will have a patch weeks, or perhaps months before IE.

Take a look at the source of the demonstration page. This is not a bug in Firefox/IE/Mozilla/etc. This is a vulnerability due to Java being able to hijack a window if the name is known. That is why it effects all browsers. I don't see how any browser maker can fix this. If I was to bet money, I would probably say that they won't. However There is a simple fix, disable java scripts in your browser of choice. No java scripts running, no exploit.

Re:I think I've solved it.

[mrogers]

Probably because if you open the window in a new tab it's a child of the main window, while the exploit is looking for a top-level window. BUT THAT DOESN'T MEAN YOU'RE SAFE! A better-written version of the exploit could search all open windows and their children until it found a window or tab with the right name.