bugtraq - Re: New possible scam method : forged websites using XUL (Firefox)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <410FE310.5000308@cisco.com>
Date: Tue, 03 Aug 2004 12:10:08 -0700
From: Michael Reilly <michaelr@...co.com>
To: "Peter J. Holzer" <hjp@....ac.at>
Cc: bugtraq@...urityfocus.com
Subject: Re: New possible scam method : forged websites using XUL (Firefox)

Along the same lines I took a look at the spoof using my customized firefox 
and it was an obvious fake -

1.  The font is wrong
2.  The window size is wrong (it is twice the width of my browser window and
     almost 50% longer)
3.  The fake toolbar was below my toolbar so both were viable
4.  The address bar was also in the wrong place so I had two.
5.  I also had two status bars

Isn't a possible solution to disable any overlaying of existing elements 
(toolbar, status bar, address bar, etc.) once they are loaded from the 
browser's and user's on disk config?  Lock them even before opening a socket 
to connect to a site.

Of course if there is an exploit to modify the on disk files then this won't 
work.

michael
Peter J. Holzer wrote:
> On 2004-08-02 11:59:17 +0200, Peter J. Holzer wrote:
> 
>>* add a UI to the "allow javascript only from trusted sites" feature. 
>>  (few people know that mozilla can do that, and even for those, editing
>>  user.js is tedious).
> 
> 
> More on the lines of "few people know that Mozilla can do that":
> 
> Daniel Veditz wrote in
> <URL:http://bugzilla.mozilla.org/show_bug.cgi?id=22183#c97>:
> 
> | Or we could just force the location bar to be on using the existing
> | pref, but obviously there must be some reluctance to that or it'd be
> | done already.
> 
> So I started to look for the "existing pref", and sure enough, if you
> write
> 
> user_pref("dom.disable_window_open_feature.location", true);
> 
> in your prefs.js, the spoof looks much less convincing.
> (You can also set this preference via "about:config".)
> 
> 	hp
> 

-- 
---- ---- ----
Michael Reilly    michaelr@...co.com
     Cisco Systems,  California