full-disclosure - A Popup! In Mozilla!

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <40FDED55.6060906@austarnet.com.au>
From: spamtrap2 at austarnet.com.au (James Woodcock)
Subject: A Popup! In Mozilla!

This might seem like it should be going to a webdev list, but there's a 
possible security implication, so here goes;

http://2-spyware.com/file-cnfrm-exe.html

In Mozilla 1.5 and FireFox 0.9 with the pop-up blocker turned on, I get 
a pop-up! It's purporting to be an important notice from my Network 
Administrator - you'll probably recognise it;

http://2-spyware.com/images/2SPYRR1C.gif

Looking at the source of the page, I see that the pop-up is being 
generated by a <DIV> statement that comes after the closing </html> tag 
  which - I thought - was supposed to indicate the end of the document.

Is a web browser supposed to be able to render code outside the 
<html></html> tags?

Using IE 6.0.2800.1106, on viewing the source, I find that the DIV 
statement that followed the closing </html> tag is now the last 
statement BEFORE the </html> tag. What gives?

James