Forgot your password?
typodupeerror
Security Mozilla The Internet

'Greasemonkey' Malware Targets Firefox 370

Posted by CmdrTaco
from the oh-this-can't-end-well dept.
snydeq writes "Researchers have discovered a new type of malware that collects passwords for banking sites but targets only Firefox. The malware, dubbed 'Trojan.PWS.ChromeInject.A,' sits in Firefox's add-ons folder, registering itself as 'Greasemonkey,' the well-known collection of scripts that add functionality to Web pages rendered by Firefox. The malware uses JavaScript to identify more than 100 financial and money transfer Web sites, including PayPal, collecting logins and passwords, which it forwards to a server in Russia. Trojan infection can occur via drive-by download or download duping."
This discussion has been archived. No new comments can be posted.

'Greasemonkey' Malware Targets Firefox

Comments Filter:
  • I wish (Score:5, Funny)

    by gEvil (beta) (945888) on Thursday December 04, 2008 @12:29PM (#25990055)
    I wish I could use this as an excuse for all the money disappearing from my PayPal and bank accounts, but sadly I can't....
    • Re: (Score:3, Insightful)

      by maxwell demon (590494)

      I wish I could use this as an excuse for all the money disappearing from my PayPal and bank accounts, but sadly I can't....

      See? With Firefox, you wouldn't have that problem! :-)

    • Re:I wish (Score:4, Funny)

      by Hoi Polloi (522990) on Thursday December 04, 2008 @12:37PM (#25990219) Journal

      Now you can ask for a government bailout!

    • Re:I wish (Score:5, Informative)

      by Lumpy (12016) on Thursday December 04, 2008 @02:39PM (#25992241) Homepage

      I give out my paypal password all the time.

      It's Fire98-myFun.

      it will do you no good without my keyfob and it's current 6 digit number. My bank, paypal, ebay, and 2 of my credit cards use the same keyfob because they use verisign and it defeats every single one of these trojans, keyloggers, and scammers. Why they are not common place I'll never understand.

      • Re:I wish (Score:4, Interesting)

        by cayenne8 (626475) on Thursday December 04, 2008 @02:45PM (#25992351) Homepage Journal
        "it will do you no good without my keyfob and it's current 6 digit number. My bank, paypal, ebay, and 2 of my credit cards use the same keyfob because they use verisign and it defeats every single one of these trojans, keyloggers, and scammers. Why they are not common place I'll never understand."

        Interesting...I'd not heard of such and option being available for PP, eBay or banks.

        What bank is that with?

        Do you have links on how to set this up with PP and eB? Is it one fob that does it for them all or one for each?

      • Re: (Score:3, Interesting)

        by aonaran (15651)

        well, I've been trying for a year to get Paypal to send me one, I even offered to PAY them for it. Nno go. I'm in Canada, and despite the fact that I use the same PayPal.com as all the US customers and they are constantly advertising it to me they refuse to send me one.

        • Re: (Score:3, Interesting)

          by aonaran (15651)

          I take back my complaint, I just tried it again and the charged me $5 CAD and said it'll be arriving in the mail shortly. I was logged in with my business account this time though, maybe that makes a difference.

          Yay! I'm finally getting a PayPal RSA token. I can feel safer knowing my PayPal has equivalent security (on the authentication level anyway) as my Work VPN has had for years.

      • Re: (Score:3, Interesting)

        by Lord Ender (156273)

        You are so wrong it's not funny.

        One-Time-Password devices do little to protect against man-in-the-middle, man-in-the-browser, session hijacking, or CSRF attacks.

        They are useful against some sorts of attacks, but not when the attacker is already in your browser. He just has to wait for you to log in normally, then he does what he wants with your session.

  • Yes, it is not good that there is malware targeting Firefox, but it shows that Firefox is on it's way to be a market leader/dominator. Much like the recommendation of using antivirus on Macs, this shows that there is enough of a market penetration for Firefox that it has garnered the attention of malware writers.
    • Re: (Score:3, Insightful)

      by Madball (1319269)
      Yay! We're safe because mac/linux/firefox is secure by design. Oops. Yay! We're safe because no one bothers with attacks on us. Oops. Yay! We're being attacked and thus might finally be important?
      ----
      Note: Actually a fanboy, but a realistic one.
      • Gah... (Score:4, Informative)

        by msimm (580077) on Thursday December 04, 2008 @02:19PM (#25991923) Homepage
        Read.article. Most of your 'insightful' comment applies to Windows and piggy-backing on a Windows exploit. The other OS's you mention (ie: not Windows) would be exploited by ignoring the FF warning dialog about installing untrusted add-ons and installing it anyway (not so much an exploit).

        That said, if you're done being cheeky: software is complicated. Bugs are a simple reality and inevitably lead to some kind of exploitability. But Linux and Mac (along with FF and numerous other open tools) get a bit of credit for implementing basic controls (accounts with privilege separation in the OS's) and responding quickly and proactively.

        Windows is only now trying it, but their implementation is so cumbersome it's defeating it's own purpose.

        Any Vista user out there that haven't already tried it there are several open source sudo [sourceforge.net] for Windows [sourceforge.net] implementations that make using non-privileged accounts more viable. I think I use Sudowin [sourceforge.net] which seemed to work the best for me, but I'm not on my home computer.
    • by thtrgremlin (1158085) on Thursday December 04, 2008 @01:29PM (#25991085) Homepage Journal
      I think an important thing to note here is that this is not using a Firefox exploit. It is using existing malware to manually install a plugin into Firefox. There is no proof of concept here at all, but point taken.
  • by Hari Kant (1124085) on Thursday December 04, 2008 @12:35PM (#25990173)
    I would suggest that DO-NOT "Remember Passwords" and Login ids in any Browser where Sensitive Information will be sent ultimately.
    • by maxwell demon (590494) on Thursday December 04, 2008 @12:41PM (#25990297) Journal

      I guess the malware remenmbered those passwords itself, so not storing them in the password manager wouldn't help.

      IMHO the fact that you can use plugins with Firefox means that there should be an extra security barrier inside Firefox that disallows extensions to get passwords (e.g. when accessing the password lines, it would just get the stars which are also displayed on the screen).

      • That's a really good point. How do I know that the latest update to Forecastfox isn't now ready my browsing history or passwords and uploading that information to a third party. Many addons do not need access to the web page being rendered, so I wonder why there isn't some additional layer of security there.

        • Re: (Score:3, Insightful)

          How do I know that the latest update to Forecastfox isn't now ready my browsing history or passwords and uploading that information to a third party. Many addons do not need access to the web page being rendered, so I wonder why there isn't some additional layer of security there.

          You don't. You are trusting solely that the developers are honest and/or that an interested third party reviews their code to ensure it does not do this. But this isn't any different than closed-source; When you install Windows, you're trusting that Microsoft hasn't trojaned their software either. Really, what people fail to understand is that all security is based on trust.

          What's mind-blowing though, is that people overwhelmingly are honest.

      • by clone53421 (1310749) on Thursday December 04, 2008 @01:04PM (#25990715) Journal

        Javascript is already capable of getting the value of a password field, and even if it wasn't they could just redirect the form action and get the password that way.

        Try this: go to Paypal.com (any page with a password field, really), type in something arbitrary into the password field, and then paste this into the address bar:

        javascript:for(var a=document.getElementsByTagName("input"),i=0;i<a.length;i++)if(a[i].type=="password"){alert(a[i].value);i=a.length;}void(0);

        • Re: (Score:3, Interesting)

          by moreati (119629)

          Given that javascript can be injected into a page in various ways, and as you show it can access the contents of input fields. Would there be any milage in blocking access to the contents of password fields from javascript. Would that break many sites?

          IIRC the file upload element works this way, to avpid revealing the file path to the website.

    • Um, all they'd have to do is gather the username/password from the form when you submitted it. Considering that add-ons can dynamically rewrite the HTML of the page you're on (AdBlock, for example), that wouldn't be hard. Send the login credentials to their server using Ajax before the form submits, and you'll never know it happened.

    • by girlintraining (1395911) on Thursday December 04, 2008 @01:00PM (#25990635)

      I would suggest that DO-NOT "Remember Passwords" and Login ids in any Browser where Sensitive Information will be sent ultimately.,/quote>

      Well, that'll stop the really stupid malware authors that sit down at your PC and copy the file that stores your passwords. But it won't stop the one who left a key logger, the other who is doing control scrapes, the guy looking over your shoulder, the in-memory debugger that waits for a POST submission and copies everything in the data struct, or the FBI (who knows about those magazines under your bed too).

      If you want to offer some advice to people that'll result in a real increase in security, tell them to install NoScript, or not to download executables and run them without scanning them. Tell them to install Spybot, or AdAware, or AVG Free. But don't ask them to turn off a convenient feature because it will stop the .1% of attackers too stupid to figure out a better way of getting that information.

  • by girlintraining (1395911) on Thursday December 04, 2008 @12:35PM (#25990179)

    Well, this just proves that it's easier to develop for Firefox than IE. ^_^ Of course, it's a very backhanded compliment.

  • by Vellmont (569020) on Thursday December 04, 2008 @12:38PM (#25990243)

    It's just part of the mounting evidence that username/password combinations for banks is inherently flawed. "Somthing you know" can always easily be known by someone else. Bank security should (IMO) be also based on "something you have", like an ATM card.

    If banks really wanted two-way authentication to work properly, they'd use a hardware device (USB-key) that had to be present in the machine to login to your account. The hardware device would be implemented in such a way to make it impossible to copy the functionality of it without physical access to it.

    • by qoncept (599709)
      The hardware device would be implemented in such a way to make it impossible to copy the functionality of it without physical access to it.

      That should be simple enough. Seriously, though, if a key like that were introduced, it would just be one more layer these people would have to overcome.

      It's just part of the mounting evidence that username/password combinations for banks is inherently flawed. "Somthing you know" can always easily be known by someone else. Bank security should (IMO) be also based
    • Re: (Score:2, Informative)

      Some banks already do this (at least in the UK). They send out a card reader that you use for a challenge/response when you put your bank card and PIN in. It's only required for making payments to new people, so you can your view balance and make payments to people or organisations you've made at least one payment to before. It's not perfect but it goes some way towards improving security. More here [natwest.com]
    • Re: (Score:2, Interesting)

      Seems to vary from country to country, in some (like Sweden I believe, UK banks seem to have more of a PRNG device, at least that's what Barclays gave me) all banks provide a Challenge-Response system for logging into your account, similar to the RSA fob I am sure many here have used for secure logon.
    • I'm not sure this is what you're referring to but in either case your post got me thinking:

      Wouldn't an effective phishing defense (but not MITM) be for the RSA key fobs to have two numbers displayed instad of one, such that when you log in with the first number displayed on your fob, the bank replys with the 2nd number. If they don't match its likely a bogus site.

      I'm sure there are tehcnical issues to resolve to decouple the two keys to avoid a snooper / phisher from being able to guess the banks response

    • The problem with USB keys is that you have to install a client to handle the PKCS #11 with the browser. No bank wants to get in the business of telling customers to install software (and all the help desk problems that come with it).

      OTP tokens have been the preferred method for consumer strong authentication, but only consumers in Europe have seem to taken to them. I don't really see people lining up to get the paypal OTP token.

      • Re: (Score:3, Insightful)

        by Mex (191941)

        Every bank in Mexico uses OTP authentication with a small physical device that generates a random key.

        When will the US catch up with the rest of the world in terms of technology? ;)

  • Yet another attempt at a classic type of malware designed to harvest web passwords has been detected...

    There, fixed it for ya.

    I don't think it is really fair to call it 'new' just because you havn't reported on this particular incident yet today. It is a little misleading. Glad I could help.

  • Firefox was written so all addons had to come from addons.mozilla.org. How is such a drive by download even possible?
    • Re: (Score:3, Informative)

      by Thelasko (1196535)
      Here's the important part:

      is intended to be delivered onto a compromised computer system by other malware for subsequent download into Mozilla Firefox's Plugin folder. Once installed it gets to work every time Firefox is started.

      Apparently Firefox has protections so plugins can only be downloaded from addons.mozilla.org, but if they are downloaded by another program, and placed in the appropriate folder, Firefox will use them.

      There are two things to know about this:
      1) Another piece of malware has to be

    • by Todd Knarr (15451)

      This thing isn't installed via Firefox's add-on process, or even by Firefox at all. It's installed by other malware that's already infected your system. Not hard, just write a few files into Firefox's add-on directory and then edit Firefox's configuration files to register the new add-on by hand. Any competent programmer with some experience with XML processing could code that up in an afternoon.

  • Users could be infected with the Trojan either from a drive-by download, which can infect a PC by exploiting a vulnerability in a browser, or by being duped into downloading it, Canja said.

    It is not clear whether Firefox actually has a vulnerability that allows such a drive by downloads, or if IE or other browsers with a vulnerability might allow a drive by download that attacks FireFox. Anyway if the user downloads bits from the net and executes it voluntarily, there is nothing one can do to protect s

  • by circletimessquare (444983) <circletimessquare&gmail,com> on Thursday December 04, 2008 @01:03PM (#25990689) Homepage Journal

    and i've always been derided as a microsoft fanboy. when i think its just common sense:

    the amount of hacks and viruses and malware on an os/ browser has absolutely nothing to do with anything other than marketshare

    you can try to make something as secure as possible, but if the incentive is high, hackers can always pay attention to security way more than you do, and find holes you did not anticipate, no matte rhow subtle

    if something is full of security holes, it won't be hacked, if its market share is tiny

    meanwhile if something is ironclad, it will still be hacked, if its maker share is huge. the incentive to find holes is so high, the most esoteric avenues of investigation are explored

    • by Sounder40 (243087) * on Thursday December 04, 2008 @01:43PM (#25991345)

      The reason Windows is targeted is because it's model of sharing everything was so wide open to so many exploits. And don't forget the numerous buffer-overflow vulnerabilities. Top that off with the fact that it is so pervasive, and you have the deadly combination we have now.

      Linux/Unix, on the other hand, was written with clear lines of delineation between the user and kernel spaces. And attention was paid to avoid buffer overflow vulnerabilities.

      Not saying that there aren't exploits available in Linux and Unix... There are. It's just designed from the ground up to be more secure than Windows.

      So part of what you said is correct: The pervasiveness of Windows is a major reason why it is targeted. But you can't avoid the poor security design of Windows as a cause as well.

    • You might think it's common sense that marketshare is all that matters, but we hammered this out years ago when comparing attack rates on IIS vs Apache.

      Obviously marketshare is a factor. Ease of infiltration is another factor. A more popular platform will be attacked less if the chance of success is lower, because at the end of the day going after the weaker but less popular platform can still net you more compromised systems. If you only look at desktop browsers and OSes, you might not think this is the

  • by xiao_haozi (668360) on Thursday December 04, 2008 @01:03PM (#25990691) Homepage Journal
    That's it....I'm switching to IE!
  • According to the description, you have to get infected with some other malware first which would then stuff this thing into Firefox's folders and hook it in by manipulating the configuration. So my first thought is that the primary risk is (yet again) Windows users. They're the ones who'll be the targets of the initial malware. Even if you're a Windows user, if you aren't already having a problem with being regularly infected by malware you aren't at great risk. And if you are currently being regularly infe

  • Would this attack style apply to any Firefox platform - Linux, Mac, Windows? As I understand it, FF plugins are mostly written in Javascript. Even on more secure platforms like Mac and Linux, each user has access to his own FF plugins directory, so if any malicious code were to be executed as him, it could presumably write this "plugin" into that user's FF settings directory.

  • FireFox matters. (Score:3, Interesting)

    by wvmarle (1070040) on Thursday December 04, 2008 @01:21PM (#25990973)

    Not sure whether this should be considered a compliment, but to me it indicates that FF matters. It has enough market share for criminals to target.

    Unfortunately not many details on this exploit: is it really an exploit in FF (for the drive-by download)? Or is it more like a trojan (for the download duping)?

  • by rs232 (849320) on Thursday December 04, 2008 @01:31PM (#25991137)
    "This latest e-threat - called Trojan.PWS.ChromeInject.A - is intended to be delivered onto a compromised computer [bitdefender.co.uk] system by other malware"

    SYMPTOMS: Presence of the: "%ProgramFiles%\Mozilla Firefox\plugins\npbasic.dll"

    TECHNICAL DESCRIPTION: It drops an executable file (which is a Firefox 3 plugin)

    Does that mean it's Windows only ?
    • Re: (Score:3, Interesting)

      by gabrieltss (64078)

      Oh good I'm safe then, it's firefox 3 plugin - won't work in my Firefox 1.5.x. Another good reason not to upgrade - securtiy is worse in the new version.

  • by Bazman (4849) on Thursday December 04, 2008 @01:32PM (#25991173) Journal

    Can we now blitz the collecting server with millions of bogus account records? Enough to make it not worthwhile trying them to find the good ones?

  • by gavron (1300111) on Thursday December 04, 2008 @01:34PM (#25991201)
    It doesn't "target Firefox", it targets "Firefox on Windows 32 systems" This does not affect Linux, Mac, or other systems. Ehud
  • Fix (Score:5, Funny)

    by Frankie70 (803801) on Thursday December 04, 2008 @02:00PM (#25991617)

    You can download a fix for it here [microsoft.com].

  • by argent (18001) <peter@slashdot.2 ... m ['nga' in gap]> on Thursday December 04, 2008 @02:00PM (#25991619) Homepage Journal

    This is not an exploit, this is a payload like a rootkit that targets Firefox... after your computer has already been compromised.

    I would be surprised if there ISN'T a similar payload targeting IE delivered by the same malware.

  • by The Cisco Kid (31490) on Thursday December 04, 2008 @02:23PM (#25991989)

    if they had identified the server that it tried to contact, either by hostname or IP address, so that those with the capability to do so, could block connectivity to it from their network(s) and/or customers. ISP's could add a simple ACL to a router, home users might put a 127.0.0.1 entry in /etc/hosts, etc.

    Of course one thing they completely left out was if this 'plugin' ran only on Windows Firefox or if other platforms were susceptible as well.

    And quite frankly, if that host was providing some legitimate service that doing this ended up blocking, well, oh fucking well. Keep the thieves off your network and you can avoid that type of problem.

    Another option of course, (for individuals and private/company networks, but probably not so for commercial ISP's) would be to just null-route the entirety of Russia (using blackholes.us), and then selective override individual address spaces as and if needed.

  • by rickst29 (553930) on Thursday December 04, 2008 @04:26PM (#25993807)
    "Trojan.PWS.ChromeInject.B" is definitely only effective in Windows, because it installs and executes these files: "%ProgramFiles%\Mozilla Firefox\plugins\npbasic.dll" "%ProgramFiles%\Mozilla Firefox\chrome\chrome\content\browser.js" browser.js calls the The dll file, which can't run in Linux, etc. unless you're running a WINDOZE Firefox via crossover (which would be insanely stupid). Also, since it's installed into the program directory (rather than the user's profile), VISTA will almost certainly make you click for "administrator confirmation" before writing the files. (I don't know for sure, because I don't have VISTA.) - - - - - When I enter the URL for http://www.bitdefender.com/VIRUS-1000451-en--Trojan.PWS.ChromeInject.A.html# [bitdefender.com], the page content is identical the version for "Trojan.PWS.CHromeInject.B" (even the given name is "Trojan.PWS.ChromeInject.B", they even over-wrote the ChromeInject.A page by accident or, ChromeInject.A isn't spreading in the wild AND has nearly identical characteristcs, perhaps differing only in file sizes.) BitDefender provides the following list of banks their page for this version, http://www.bitdefender.com/VIRUS-1000451-en--Trojan.PWS.ChromeInject.B.html [bitdefender.com]: It filters the URLs within the Mozilla Firefox browser and whenever encounter the following addresses opened in the Firefox browser it captures the login credentials. akbank.com caixasabadell.net credem.it areasegura.banif.es banca.cajaen.es openbank.es poste.it banesto.es carnet.cajarioja.es gruposantander.es intelvia.cajamurcia.es net.kutxa.net bancopastor.es bancamarch.es caixamanlleu.es elmonte.es ibercajadirecto.com bancopopular.es bancogallego.es bancajaproximaempresas.com caixa*.es caja*.es ccm.es bancoherrero.com bankoa.es bbvanetoffice.com bgnetplus.com bv-i.bancodevalencia.es clavenet.net fibancmediolanum.es sabadellatlantico.com arquia.es banking.*.de westpac.com.au adelaidebank.com.au pncs.com.au nationet.com online.hbs.net.au www.qccu.com.au boq.com.au banksa.com anz.com suncorpmetway.com.au quiubi.it cariparma.it bancaintesa.it popso.it fmbcc.bcc.it secservizi.it bancamediolanum.it csebanking.it fineco.it gbw2.it gruppocarige.it in-biz.it isideonline.it iwbank.it bancaeuro.it bancagenerali.it bcp.it unibanking.it uno-e.com unipolbanca.it carifvg.com cariparo.it carisbo.it islamic-bank.com banking.first-direct.com natwestibanking.com itibank.co.uk co-operativebank.co.uk lloydstsb.co.uk mybankoffshore.alil.co.im abbeynational.co.uk mybusinessbank.co.uk barclays.com online.co.uk my.if.com anbusiness.com hsbc.co anbusiness.com co-operativebankonline.co.uk halifax-online.co.uk ibank.cahoot.com smile.co.uk caterallenonline.co.uk tdcanadatrust.com schwab.com wachovia.com bankofamerica kfhonline.com wamu.com wellsfargo.com procreditbank.bg chase.com 53.com citizensbankonline.com e-gold.com paypal.com usbank.com suntrust.com banquepopulaire.fr onlinebanking.nationalcity.com

There are running jobs. Why don't you go chase them?

Working...