full-disclosure - RE: Browzar Footprints

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 1 Sep 2006 17:03:11 +0200
From: "Steven Scheffler" <steven@...wardslash.com>
To: "Brian Porter" <bkporter@...il.com>,
	"Juha-Matti Laurio" <juha-matti.laurio@...ti.fi>
Cc: full-disclosure@...ts.grok.org.uk
Subject: RE: Browzar Footprints

It does use the ms browser (same as IE) with CLSID
8856F961-340A-11D0-A96B-00C04FD705A2 implemented as CWebBrowser2 and
shows the usual "Internet Explorer_Server". bummer.

Right-click is disabled, but if you press the Windows keyboard
'righ-click' button then the usual IE context menu shows up :)

Also if you put in the address bar: res://shdoclc.dll/pagerror.gif
you'll see that IE windows display the resource :)

All urls are hardcoded into the exe:

http://www.browzar.com/search?q=    
http://www.browzar.com/start    
http://www.browzar.com/faq?v=
http://www.browzar.com/update?v=
http://www.browzar.com/problem?v=   
http://www.browzar.com/help?v=   
http://www.browzar.com/search?SPID=2&q= 
http://www.browzar.com/tryagain?u=  

Changing them it's pretty easy

They should at least implement a skin engine, which dynamically changes
the skin, and you don't have to download a black or silver version :)

I didn't find anything special about this app.

-----Original Message-----
From: full-disclosure-bounces@...ts.grok.org.uk
[mailto:full-disclosure-bounces@...ts.grok.org.uk] On Behalf Of Brian
Porter
Sent: Friday, September 01, 2006 3:43 PM
To: Juha-Matti Laurio
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: [Full-disclosure] Browzar Footprints

Browzar apparently wraps IE - so the User Agent will be the same as
your IE installation.

Anyone else think this is less about privacy and more about the
default sponsored search/home page coded into the browser (which
apparently can't be changed?

-Brian Porter

On 9/1/06, Juha-Matti Laurio <juha-matti.laurio@...ti.fi> wrote:
> Browzar.com is up and working now.
>
> BTW: The Browzar sends the following UA:
> Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1
>
> There is no anything about Browzar name mentioned (when compared to
Maxthon etc.).
>
> - Juha-Matti
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
This e-mail message is confidential and intended solely for the person to whom or the entity to which it is addressed. All the contents and any attachments remain the property of VR Services (Pty) Ltd unless so stated by contract.
If you are not the intended recipient, you are prohibited from reading, copying, using or disclosing this message to others. 
If you received this message in error, please notify the sender immediately by replying to this e-mail or by telephoning +27 21 528 9300 and thereafter delete the message. VR Services (Pty) Ltd does not accept liability for any personal views expressed in this message.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/