full-disclosure - abnormal behavior Gmail logon

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Tue May 30 20:30:05 2006
From: oscar.fajardo at atosorigin.com (Oscar Fajardo Sanchez)
Subject: abnormal behavior Gmail logon


  Take a look at:
 
   HKEY_CURRENT_USER\Software\Classes\.htm

  You will see "FirefoxHTML" **if firefox is your default browser**. The server is just sending a html file, which, according to the registry of the client machine, has to be rendered by "firefox.exe" (HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FirefoxHTML\shell\open\command). The guy installed firefox, then made it the default browser, and then he uninstalled firefox. But the registry setting is there. 

  As far as I can see there is nothing bad here but the incorrect uninstall process of Firefox.

  Regards.

------------------------------------------------------------------
This e-mail and the documents attached are confidential and intended solely
for the addressee; it may also be privileged. If you receive this e-mail
in error, please notify the sender immediately and destroy it.
As its integrity cannot be secured on the Internet, the Atos Origin group
liability cannot be triggered for the message content. Although the
sender endeavours to maintain a computer virus-free network, the sender does
not warrant that this transmission is virus-free and will not be liable for
any damages resulting from any virus transmitted.

Este mensaje y los ficheros adjuntos pueden contener informacion
confidencial destinada solamente a la(s) persona(s) mencionadas
anteriormente. Pueden estar protegidos por secreto profesional Si usted
recibe este correo electronico por error, gracias de informar inmediatamente
al remitente y destruir el mensaje.
Al no estar asegurada la integridad de este mensaje sobre la red, Atos
Origin no se hace responsable por su contenido. Su contenido no constituye
ningun compromiso para el grupo Atos Origin, salvo ratificacion escrita por
ambas partes.
Aunque se esfuerza al maximo por mantener su red libre de virus, el emisor
no puede garantizar nada al respecto y no sera responsable de cualesquiera
danos que puedan resultar de una transmision de virus
------------------------------------------------------------------
-------------- next part --------------
On Tue, 30 May 2006 20:22:59 +0200, Oscar Fajardo Sanchez said:

>   "FIREFOXHTML" is the *filetype*, the file name is "loading.html".

> So Internet Explorer now is trying to open the html file whith the program
> firefox.exe, which is not there. So IE prompts the user for action.

Yes yes and all that.  The point is - why did Gmail (presumably) look at
the User-Agent: string that was sent, and serve up a Firefox file rather
than the IE it probably should have?

IE is Doing The Right Thing by asking.  Gmail is misbehaving by serving
up something that IE feels the need to ask the user about.

*THAT* is the odd behavior.