azurIt
02/03/06, 02:01
Background
----------
Firefox is very popular and secure web browser=2E Until now, it is used=
by
milions of people and thousands of internet clubs=2E One of the great f=
eatures of
Firefox are extensions=2E You can use them to create things inside your=
browser
which are beyond your imagination=2E But everything has an other side=2E=
=2E
Overview
--------
Writting a powerfull extension is extremely simple process=2E Extension=
s are
allowed to do _everything_ with your browser: They can change the skin,=
block
banners on pages or even create network connection and send data throug=
h it to
the internet=2E The worst of all is that _anyone_, who has physical acc=
ess to
your computer, can install extensions into your browser _without_ your
notification=2E
As an example, I created a simple html form sniffer=2E You can download=
it here:
http://azurit=2Egigahosting=2Ecz/ffsniff/
It was tested only with Firefox 1=2E0=2Ex and 1=2E5=2Ex =2E
FFsniFF is a simple Firefox extension, which transforms your browser in=
to the
html form sniffer=2E Everytime the user click on 'Submit' button, FFsni=
FF will try
to find a non-blank password field in the form=2E If it's found, entire=
form (also
with URL) is sent to the specified e-mail address=2E
Solution
--------
I think that the solution for this should be in the ability of locking =
the
installation of extensions with a password=2E Every user will be able t=
o read hash
of the password (so the browser can verify it) and only system administ=
rator
will be allowed to change it (it can be stored for example in registers
[Windows] or somewhere in /etc dir [Linux])=2E
azurIt, azurIt@IRCnet, azurit (at) pobox (dot) sk
----------
Firefox is very popular and secure web browser=2E Until now, it is used=
by
milions of people and thousands of internet clubs=2E One of the great f=
eatures of
Firefox are extensions=2E You can use them to create things inside your=
browser
which are beyond your imagination=2E But everything has an other side=2E=
=2E
Overview
--------
Writting a powerfull extension is extremely simple process=2E Extension=
s are
allowed to do _everything_ with your browser: They can change the skin,=
block
banners on pages or even create network connection and send data throug=
h it to
the internet=2E The worst of all is that _anyone_, who has physical acc=
ess to
your computer, can install extensions into your browser _without_ your
notification=2E
As an example, I created a simple html form sniffer=2E You can download=
it here:
http://azurit=2Egigahosting=2Ecz/ffsniff/
It was tested only with Firefox 1=2E0=2Ex and 1=2E5=2Ex =2E
FFsniFF is a simple Firefox extension, which transforms your browser in=
to the
html form sniffer=2E Everytime the user click on 'Submit' button, FFsni=
FF will try
to find a non-blank password field in the form=2E If it's found, entire=
form (also
with URL) is sent to the specified e-mail address=2E
Solution
--------
I think that the solution for this should be in the ability of locking =
the
installation of extensions with a password=2E Every user will be able t=
o read hash
of the password (so the browser can verify it) and only system administ=
rator
will be allowed to change it (it can be stored for example in registers
[Windows] or somewhere in /etc dir [Linux])=2E
azurIt, azurIt@IRCnet, azurit (at) pobox (dot) sk