Firefox 2 Browser Struck by Password Flaw

minstrel Illustrious Member

Messages:: 15,082

Likes Received:: 1,243

Best Answers:: 0

Trophy Points:: 480

#1

Firefox 2 Browser Struck by Password Flaw

David Garrett, newsfactor.com
Fri Nov 24, 2006

Mozilla's Firefox 2.0 has long been considered a safer Web browser than Microsoft's Internet Explorer, but a new flaw in the Firefox Password Manager, which lets users store usernames and passwords for trusted Web sites, could let hackers steal their login data.

The problem, known as a reverse cross-site request, or RCSR, was first discovered by Robert Chapin, a Microsoft Certified Systems Engineer (MCSE) and I.T, consultant. The RCSR appears on blogs, message boards, or group forums that let users add comments with embedded HTML code.

On sites that allow users to enter code, a hacker can embed a form that tricks the user's browser into sending its username and password information to the hacker's computer. Because the form is embedded on a trusted Web site, the browser's built-in antiphishing protection, which is designed to alert users to fraudulent Web sites, does not detect the problem.

Even worse, hackers can make the deceptive form invisible, meaning users can transmit their private data without even knowing it.

Bug #360493
The Mozilla Foundation, which maintains code for the Firefox browser, has acknowledged the problem and named it bug #360493. Microsoft has also admitted that RCSR attacks can affect Internet Explorer, but most reports indicate that Firefox is the more likely target because of the way it stores usernames and passwords.

Neither Mozilla nor Microsoft has released a patch for the problem, but users can avoid RCSR attacks simply by disabling their browsers' autosave features for usernames and passwords. In Firefox, the feature is found in the "Options" window under the "Tools" menu.

Mozilla has indicated that it plans a fix in Firefox version 2.0.0.1 or 2.0.0.2.

Battle of the Titans
Most experts agree that Firefox is by and large the safer of the two major Web browsers, largely because Microsoft, on account of its size, draws more attention from hackers.

Indeed, the last two years have seen monthly and sometimes weekly reports of new bugs in Internet Explorer, letting hackers do everything from hijack a user's computer to corrupt its private data.

But Microsoft released a new version of IE -- version 7.0 -- in October, and Mozilla quickly followed suit with version 2.0 of Firefox. Both versions boast enhanced security, including antiphishing features that check Web sites against an online database of known frauds. And Internet Exporer 7 also offers much-requested improvements to the interface, such as tabbed browsing.
Click to expand...

minstrel, Nov 24, 2006 IP

007 Well-Known Member

Messages:: 328

Likes Received:: 30

Best Answers:: 0

Trophy Points:: 120

#2

Ahh... Not good.

Thanks for the info though. I wonder how long it will be before they release a fix to this.

007, Nov 25, 2006 IP

mistermix Active Member

Messages:: 2,326

Likes Received:: 85

Best Answers:: 0

Trophy Points:: 90

#3

Oh sh*t. A few days ago I had serious login problems with firefox on adsense and adwords sites. I could login fine with internet explorer.

Hmm? What should I do?

mistermix, Nov 25, 2006 IP

Log in or Sign up

Firefox 2 Browser Struck by Password Flaw

minstrel Illustrious Member

007 Well-Known Member

mistermix Active Member

Useful Searches