full-disclosure - Re: FFSpy, a firefox malware PoC

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <8358ff290905252328v20487ea7x47d976fe62cfeb4b@mail.gmail.com>
Date: Tue, 26 May 2009 11:58:47 +0530
From: Shell Code <technobuster@...il.com>
To: saphex <saphex@...il.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: FFSpy, a firefox malware PoC

On Wed, May 20, 2009 at 6:12 AM, saphex <saphex@...il.com> wrote:
> I think this is interesting, http://myf00.net/?p=18
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

I fail to understand what is new or interesting in this POC. If a
person with malicious intent gains so much access to a system that he
can put his files or firefox plugins, modify existing files, etc. then
he can do anything he wants anyway. This is nothing new. It was well
known always that Firefox plugins can also be made to do malicious
things such as steal passwords, sniff data before it gets encrypted in
SSL, etc. Absolutely nothing new.

The same holds true for a user downloading malicious software on his
own and running it on his system. It is true that most users don't
verify the source code before running. But this is not anything
specific to Firefox. This holds true for any open source or closed
source software users download. So, again FFSpy sniffing data is
nothing new.

>>From the POC it seems that somehow the attacker has to gain physical
access to the system or do some social engineering attack to fool the
user in installing or modifying his existing plugins. The PoC does not
explain how this is done. This is like claiming, "I have found an
interesting attack which involves modifying XYZ program or DLL or
script on the system that would sniff data and send it to a remote
server. I name it ComputerSPY". This is very lame. Of course if you
have access to modify or create stuff in the system, you can do
anything. Nothing new at all.

What is the point of the POC? What is the PoC trying to achieve? Is
the POC trying to tell us something that we already don't know?

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/