full-disclosure - Is FFSpy a hoax?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Sat, 30 May 2009 12:31:03 +0530
From: FFSpy Buster <ffspybuster@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Is FFSpy a hoax?

Hi,

I have been watching the discussion on FFSpy since the last few weeks.
Duarte Silva, the author first posted it here: http://myf00.net/?p=18

He also believes that the addon mechanism of all software is flawed from
security standpoint. He says that while it is not much of a nuisance in
other software, it is very much a nuisance in Firefox. The discussion can be
found here: http://myf00.net/?p=97 (See comments)

He suggests that Firefox must do something to notify the user when an addon
has been compromised by a remote attacker. He agrees that the remote
attacker has to gain physical or local access of the system by remotely
logging in or something. Let us say the attacker ssh-ed or telnet-ed into
the user's PC and modified an addon. What measures can Firefox take to
notify the user of the modification?

I can't imagine of any because if it is digital signature or checksum based,
the attacker can very well modify the public key or the checksum in
Firefox's store. So, this whole FFSpy thing sounds like a hoax to me, an
unnecessary panic being created by Duarte Silva. Please correct me, if I am
wrong.

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/