New Firefox iFrame Bug Bypasses URL Protections 118
Trailrunner7 writes "There is a newly discovered vulnerability in Mozilla's flagship Firefox browser that could enable an attacker to trick a user into providing his login credentials for a given site by using an obfuscated URL. In most cases, Firefox will display an alert when a URL has been obfuscated, but by using an iFrame, an attacker can evade this layer of protection, possibly leading to a compromise of the user's sensitive information."
iFrame? (Score:3, Insightful)
"iFrame"? Seriously? Of all the possible choices of camelCasing you could have picked from, "iFrame" is the only one that describes an Apple video format for the iPhone.
When referencing the inline frame HTML element, it's a lot clearer to use "iframe", "IFRAME", or even "IFrame".
Re: (Score:2, Insightful)
Re: (Score:2)
At least they got a license for the name iOS. I don't think Cisco would take Apple stealing two of their trademarks lying down.
Re: (Score:2)
Re: (Score:2)
Re: (Score:1, Troll)
(Score:-1, Just Plain Bollocks)
Since when does apple have a video format called iFrame. Last I checked apple had no video codecs, and only one video container format called mov, and as far as supporting other people's codecs and containers supported only MPEG4, h264 and mp4 other than their own mov.
Given that nothing factual in your post is correct, the only thing I can assume is that you're simply taking the opportunity to yell "oh my god, someone made me think of apple, now I've lost 'the game'". There'
Re: (Score:3, Informative)
(Score: +5, Troll)
Since when? 2009.
You couldn't even be bothered to google the nonsense you're spouting before claiming I'm the troll?
http://support.apple.com/kb/HT3905 [apple.com]
http://us.sanyo.com/News/SANYO-Dual-Cameras-are-World-s-First-with-iFrame-Video-Format [sanyo.com]
http://en.wikipedia.org/wiki/iFrame_(video_format) [wikipedia.org]
Given that nothing factual in your post is correct, the only thing I can assume is that you're the troll, and that I'm feeding you. Congrats on a well-played hand of stupidity!
Re:iFrame? (Score:4, Funny)
Re: (Score:1, Funny)
iFrames are commonly used to iNfect websites.
And you don't have to be an iNstein to discover that.
Re: (Score:2)
How about "14 million people effected by floods in Pakistan"...
I want to hear more about this. How did the floods create 14 million people?
Once again, kids (Score:5, Insightful)
Never click on a URL within an email to take you to a website...always go directly to the website yourself.
Also, use some common sense. You're the 30,000th person today who has been told they are the one millionth visitor...ignore the temptation to smack that bear (or whatever flash ads are doing nowadays)
Re:Once again, kids (Score:4, Funny)
...ignore the temptation to smack that bear (or whatever flash ads are doing nowadays)
I think the expression that you are looking for is spank that monkey.
Re: (Score:1)
Re: (Score:1, Funny)
30,000th person today who has been told they are the one millionth visitor
Hmmmm ... I like those odds.
Re:Once again, kids (Score:5, Funny)
Cool! What do I win?!?
Re: (Score:1, Insightful)
http://www.xkcd.com/570/ [xkcd.com]
Re: (Score:2)
Cool! What do I win?!?
You used to win a trip to the tropics but due to cutbacks they just skip straight to giving you a virus.
Re: (Score:2)
The keylogger is free, and account compromise is guaranteed or no money back.
Re: (Score:2)
The keylogger is free, and account compromise is guaranteed or no money back.
The cheese in a mousetrap is always free.
Re: (Score:2)
Shoot the Duck
Punch the Monkey
Kick the Tiger
Poke the Pig
Lick the Walrus
Slap the Parrot
Rub the Eel
Squeeze the Cat
Flick the Fish
Squish the Worm
Take your Pick
Re: (Score:2)
Personally, I like "squishing the worm" or "rubbing the eel" - at least for now... till I manage to find a date. But that's just me. ;-)
Sigh... (Score:2, Funny)
When will people finally migrate away from Windows, IE and all the security flaws?
Wait a sec...
Re: (Score:1)
Re: (Score:2, Informative)
From Using Lynx in a Graphical WWW [pacific.net.sg]:
When Lynx encounters an inline (or floating) frame, it will display IFRAME: [Name_of_Source / Name_of_File]. The name of the source or file will be hyperlinked to the source file, allowing you go there.
That is why. Now stop disagreeing with people in order to look insightful. It takes 3 seconds to Google that shit.
Re: (Score:2)
Yes, because static, unchanging, unchangeable pages provide such a useful, engaging wealth of information, and provide an effective direct line to commerce.
Bemoaning 15 year old decisions embraced by the rest of the world is f'ing useless. Here's the key piece of information your ego refuses to acknowledge: it doesn't matter what you thought 15 years ago. Without you, HTML evolved anyway; browsers have evolved, consumers have evolved, and content providers have evolved. So get over your whiny self and st
Re: (Score:2)
Right, text mode is safe because PHP is so secure? Not following the train of your thought on that one...
I'm missing something (Score:2)
Re:I'm missing something (Score:4, Informative)
You can update the status bar to indicate something else, you can use the legitimate site as a username for a non-legitimate site (i.e. www.google.com@www.malwaresite.com), or you can just make the URL look as official as possible (i.e. ebay-secure.com) and hope people believe it's authentic.
You can also access the site numerically (e.g. http://1208929379/ [1208929379] is Google) but that's more for fun than evil.
Re: (Score:2)
Right - is any of that a browser bug or is that merely people failing at phishing detection?
Re: (Score:2)
Right - is any of that a browser bug or is that merely people failing at phishing detection?
Those are just a few examples of what URL obfuscation looks like, which was the question I was answering. You could stick the two middle examples into an iframe if you wanted though.
Re: (Score:2)
Right - is any of that a browser bug or is that merely people failing at phishing detection?
The two are pretty much the same these days. Half the populace can't tell the difference between the internet and their browser, and those people will never understand security attacks like phishing or malicious redirection. But some of them at least can be taught that a warning box is a scary thing that you should click "no" on.
Re: (Score:2)
Re: (Score:3, Insightful)
So - this isn't a bug, and the article is just attention-grabbing. It's a fundamental limitation of links.
Re: (Score:1, Insightful)
So - this isn't a bug, and the article is just attention-grabbing. It's a fundamental limitation of links.
When a URL is obfuscated, Firefox warns you that things might not be what they appear to be. When that obfuscated URL is in an IFRAME, Firefox does not warn you that things might not be what they appear to be. Firefox's intended behaviour is to provide that warning. The intended behaviour does not match the actual behaviour. Therefore, this is a bug in Firefox.
The overall threat is a fundamental limitation of links. Firefox's attempt to mitigate that threat contains a bug.
Re:I'm missing something (Score:5, Informative)
http://blog.armorize.com/2010/08/iframes-and-url-stringency-mozilla.html [armorize.com]
(Yea, their typing skills don't impress me either.)
That in turn links to a BugZilla entry [mozilla.org], though it's locked down at the moment.
Re: (Score:2)
Re: (Score:2)
The Bugzilla entry [mozilla.org] is now public.
Oh Please ... (Score:2, Informative)
Remember kids, 'Free Software' != 'Bug Free Software'.
Re:Oh Please ... (Score:5, Informative)
It's not even a security issue as far as I'm concerned. It's just one of their bonus services not detecting bad sites properly. There is no vulnerability in the browser itself, it's the user.
Re: (Score:2, Insightful)
Re: (Score:2)
Re:Oh Please ... (Score:5, Informative)
I work for Mozilla on Firefox and I just wanted to respond to some of the claims being made here. We've opened up the bug so that others can take a look (bug 570658), but there is not much to see, here. The bug says that:
1) if you visit a page that uses an iframe
2) and that iframe's src attribute uses a deceptive url (e.g. "http://safe.com@evil.com")
3) then we don't pop up a warning that the url is deceptive
What's odd about the bug is that there is very little value to step 2 - only someone examining the page's source would notice the iframe's src attribute, so it's not clear to me where the deception is supposed to come in. A genuinely malicious page would source their attack iframes directly, unless they thought that this deceptive url might fool our phishing/malware protection. It won't.
If someone thinks we're overlooking an attack vector here, we're really interested to hear it, but as described the attack feels pretty weak.
If you think we're missing something critical, please do comment in the bug or get in touch with our security group ( http://www.mozilla.org/security/ [mozilla.org] ).
Johnathan
That's why you don't rely on the bells & whist (Score:5, Informative)
If you rely on some alert or some fancy feature for protection, you really aren't being as proactive as you could. Regardless of what any alerts might or might not say, if the URL doesn't look right, err on the side of caution. While there are always exceptions, if you don't know what a "good" URL looks like, take the time to educate yourself.
Re: (Score:2)
It doesn't matter. If I am going to type in important information, I backspace out the scheme and url and type in what I know it should be. Everybody else should too.
Re: (Score:2)
Even better is if one uses double-byte characters and drops in Cyrillic characters. That domain may say one thing, but in reality, it might lead to a completely different rabbit hole.
Combine that with CAs who have been mentioned on /. as untrustworthy, and people may get a perfectly secure HTTPS connection to something that looks exactly like their bank's URL, but in reality is nowhere near.
Re: (Score:2)
True, but hovering over the URLs shows them in a clean font in the status bar of Firefox, so it's obvious which one is which.
But your point is taken. No one can know everything. but that's why we need to educate those who are prone to get stung by this stuff. My mantra to my parents and friends is, "If the link you are clicking on is unfamiliar or sent to you by someone you don't know, then just don't click it. Otherwise, proceed with caution." Sure, it isn't perfect, but it has significantly reduced the ca
Re: (Score:3, Insightful)
if you don't know what a "good" URL looks like, take the time to educate yourself.
That is good pragmatic advice. But it points to a fundamental failing in the current architecture.
It basically means that every person must become proficient in parsing URLs themselves. They have to understand what the "http" means, what the resolution order is (why "facebook.com" is very different from "facebook.com.evil.uk"), to know about fonts (to differentiate ".com" and ".corn" or ".COM" from ".C0M"), to understand what character sets and encodings are (to notice other character substitutions), and
Re: (Score:2)
I think you're grossly over-complicating it. They don't need to know what http means. For people for whom that is too difficult a task, they should just know that it (or https) should be there. And even then I'm not really sure what kind of attack you could pull off by changing the prot
Re: (Score:3, Interesting)
if you don't know what a "good" URL looks like
What does the URL of an iframe look like?
This does not affect my Firefox version (Score:5, Funny)
Re:This does not affect my Firefox version (Score:4, Insightful)
What ? Slashdot works on a Safari browser ?
Re: (Score:1)
Who uses Safari on Mac? It's AWFUL! // happily using Chrome, and Firefox for Netflix.
Re: (Score:2)
Slashdot is so buggy that I doubt that it works on anything else than IE and Firefox ;-)
Re: (Score:1)
Actually, Slashdot on Chrome performs reasonably well. For many sites, the performance difference between Firefox and Chrome is hard to detect, but with Slashdot the difference is almost as big as it is between Firefox and IE.
Re: (Score:2, Interesting)
Umm, most Mac users aren't vulnerable to PDF exploits because they use the built-in Preview.app to read PDFs, not Adobe's Reader, and Preview.app doesn't support JavaScript, which is required for any PDF exploit. You also can't disguise an application or shell script or executable binary or disk image by putting .pdf at the end of the filename.
Re: (Score:2, Interesting)
Yes, but the iPhone jailbreak: a PDF vulnerability that lead to arbitrary code execution. Preview.app may not be as safe as you think.
Re: (Score:2)
I have iFrames blocked the same way I have iPhones, iPods, iDicks, iDildos, iPansies, iDemoccrats and iRepublicans blocked.
Re: (Score:1)
You have every right to disagree, but I do not think it was redundant. It wasn't karma whoring e
Remembering passwords (Score:3, Interesting)
My theory is that in general (unless you're using a public PC) it's safer to get the browser to remember your passwords for you. It's smarter than you in that it matches by the exact real URL of a form page and so won't insert your credentials into a bogus page. However, by that point you'll be used to the browser typing in your credentials for you, and will be jarred out of complacency when you notice that it hasn't.
Re:Remembering passwords (Score:4, Interesting)
Good start, but I'd go one step further. In fact, I do.
Have your browser remember your passwords for you, but for any important passwords make the stored username and password invalid (or an incomplete one that you can enter the rest of, then just remember not to click on the "update" button that comes up). Even just dropping one character off the username and password is enough.
That way, if you are fooled into an iframed URL, you'll see the symptom you describe, but if some future bug makes the password list vulnerable to attack, any potential attacker only gets (at most) only part of each password, not all of it.
Also, always allow the bogus username/password to present once before you enter the real one. If you see a "login failed" screen that looks legit, you're probably good to go, and you can enter your real username and password. If you see anything that looks like it's trying to pretend to be your bank, you know something was wrong but you also know your account credentials didn't get disclosed.
When I'm in the mood, I'll also sometimes whip up a quick temporary guest account on my computer to click on a few of the provided links in things that are obviously bogus and enter clearly ridiculous credentials into the resulting page a few times. Even the least attentive bank IT department would probably look askance at 10 failed login attempts for user "I_AM_A_HACKER" and want to consider tracing out their IP address. I'll probably never get any actual hackers caught, but it feels as good as ripping up all the junk mail I get and returning it in the little postage-paid envelopes they so thoughtfully provide. :)
Re: (Score:3, Interesting)
link to a working demo ? (Score:2)
Flagship? (Score:2)
There is a newly discovered vulnerability in Mozilla's flagship Firefox browser
So all of Mozilla's other browsers are okay?
Re: (Score:2)
Block iframes (Score:1)
Alert? (Score:1)
Firefox blows (Score:2)
In a few releases, it will be worse than IE. It's not even in my top three browsers any more.
I would tell give you the list, but they're pretty obscure. You probably haven't heard of them.
Re: (Score:1)
Re: (Score:1)
I would tell give you the list, but they're pretty obscure. You probably haven't heard of them.
obligatory penny arcade:
http://www.penny-arcade.com/comic/2002/7/12/ [penny-arcade.com]
Prohibit cross domain iframes (Score:2)
The solution is very simple: Cross-domain iframes should be prohibited. End of problem.
What?!! (Score:1)
The author's nearly incomprehensible complaint (http://blog.armorize.com/2010/08/iframes-and-url-stringency-mozilla.html [armorize.com]) is essentially that this is allowed to load, while entering http://foo:bar@example.com in the address bar results in a phishing-related warning. The purpose of this warning is to confirm you actually understand the syntax of the URL d
Just for the record... (Score:1)
Re:Step One: Uninstall Windows (Score:4, Insightful)
Or relevant, given the flaw is in Firefox.
Re: (Score:1)
And on Linux.
Indeed, I'm just typing this in a textbox in Firefox running on Linux.
Re: (Score:1)
I'm not running Firefox in Wine. I'm running the native Linux version.
Re: (Score:1)
Well, maybe you look at this page [mozilla-europe.org] especially at the second download link. But maybe you are just trolling, after all.
Re: (Score:2)
Firefox runs on windows.
Firefox also runs on Linux. Now that the argument has come full circle, I suggest you reread Tim C's comment and think a little harder about what he's saying: your OS doesn't matter.