azurIt
02/03/06, 02:01
>This is definitely a good idea, although I don't think it should be a
>compulsory feature (optional would be nice)=2E If more people than jus=
t you
>have access to a machine at the end of the day there's no way to guara=
ntee
>security=2E This is just another method of stealing information like a
>keylogger would (although admittedly, more intelligent)=2E
>This isn't so much a bug as it would be user error (in my opinion), yo=
u
I didn't tell it's a bug=2E
>choose what extensions you want to install and if you're foolish enoug=
h to
>install an extension from an untrusted source then you can expect horr=
ible
>things to happen=2E
>
I was primary talking about the internet clubs=2E FFsniFF was tested on=
_one_
computer in local internet club: About 30 sniffed accounts (mostly mail=
and
chat accounts) in two days=2E
There are also another ways how extensions can be installed into your b=
rowser=2E
For example by a some kind of viruses=2E
The only thing which I wanted to say is that there should be a way how =
to disallow
installation of extensions by anyone=2E
>Henri
>henri[at]theplayboymansion[dot]net
>
>> Background
>> ----------
>> Firefox is very popular and secure web browser=2E Until now, it is u=
sed by
>> milions of people and thousands of internet clubs=2E One of the grea=
t
>> features of
>> Firefox are extensions=2E You can use them to create things inside y=
our
>> browser
>> which are beyond your imagination=2E But everything has an other sid=
e=2E=2E
>>
>> Overview
>> --------
>> Writting a powerfull extension is extremely simple process=2E Extens=
ions are
>> allowed to do _everything_ with your browser: They can change the sk=
in,
>> block
>> banners on pages or even create network connection and send data thr=
ough
>> it to
>> the internet=2E The worst of all is that _anyone_, who has physical =
access
>> to
>> your computer, can install extensions into your browser _without_ yo=
ur
>> notification=2E
>>
>> As an example, I created a simple html form sniffer=2E You can downl=
oad it
>> here:
>> http://azurit=2Egigahosting=2Ecz/ffsniff/
>>
>> It was tested only with Firefox 1=2E0=2Ex and 1=2E5=2Ex =2E
>>
>> FFsniFF is a simple Firefox extension, which transforms your browser=
into
>> the
>> html form sniffer=2E Everytime the user click on 'Submit' button, FF=
sniFF
>> will try
>> to find a non-blank password field in the form=2E If it's found, ent=
ire form
>> (also
>> with URL) is sent to the specified e-mail address=2E
>>
>> Solution
>> --------
>> I think that the solution for this should be in the ability of locki=
ng the
>> installation of extensions with a password=2E Every user will be abl=
e to
>> read hash
>> of the password (so the browser can verify it) and only system
>> administrator
>> will be allowed to change it (it can be stored for example in regist=
ers
>> [Windows] or somewhere in /etc dir [Linux])=2E
>>
>>
>> azurIt, azurIt@IRCnet, azurit (at) pobox (dot) sk
>>
>>
>>
>>
>compulsory feature (optional would be nice)=2E If more people than jus=
t you
>have access to a machine at the end of the day there's no way to guara=
ntee
>security=2E This is just another method of stealing information like a
>keylogger would (although admittedly, more intelligent)=2E
>This isn't so much a bug as it would be user error (in my opinion), yo=
u
I didn't tell it's a bug=2E
>choose what extensions you want to install and if you're foolish enoug=
h to
>install an extension from an untrusted source then you can expect horr=
ible
>things to happen=2E
>
I was primary talking about the internet clubs=2E FFsniFF was tested on=
_one_
computer in local internet club: About 30 sniffed accounts (mostly mail=
and
chat accounts) in two days=2E
There are also another ways how extensions can be installed into your b=
rowser=2E
For example by a some kind of viruses=2E
The only thing which I wanted to say is that there should be a way how =
to disallow
installation of extensions by anyone=2E
>Henri
>henri[at]theplayboymansion[dot]net
>
>> Background
>> ----------
>> Firefox is very popular and secure web browser=2E Until now, it is u=
sed by
>> milions of people and thousands of internet clubs=2E One of the grea=
t
>> features of
>> Firefox are extensions=2E You can use them to create things inside y=
our
>> browser
>> which are beyond your imagination=2E But everything has an other sid=
e=2E=2E
>>
>> Overview
>> --------
>> Writting a powerfull extension is extremely simple process=2E Extens=
ions are
>> allowed to do _everything_ with your browser: They can change the sk=
in,
>> block
>> banners on pages or even create network connection and send data thr=
ough
>> it to
>> the internet=2E The worst of all is that _anyone_, who has physical =
access
>> to
>> your computer, can install extensions into your browser _without_ yo=
ur
>> notification=2E
>>
>> As an example, I created a simple html form sniffer=2E You can downl=
oad it
>> here:
>> http://azurit=2Egigahosting=2Ecz/ffsniff/
>>
>> It was tested only with Firefox 1=2E0=2Ex and 1=2E5=2Ex =2E
>>
>> FFsniFF is a simple Firefox extension, which transforms your browser=
into
>> the
>> html form sniffer=2E Everytime the user click on 'Submit' button, FF=
sniFF
>> will try
>> to find a non-blank password field in the form=2E If it's found, ent=
ire form
>> (also
>> with URL) is sent to the specified e-mail address=2E
>>
>> Solution
>> --------
>> I think that the solution for this should be in the ability of locki=
ng the
>> installation of extensions with a password=2E Every user will be abl=
e to
>> read hash
>> of the password (so the browser can verify it) and only system
>> administrator
>> will be allowed to change it (it can be stored for example in regist=
ers
>> [Windows] or somewhere in /etc dir [Linux])=2E
>>
>>
>> azurIt, azurIt@IRCnet, azurit (at) pobox (dot) sk
>>
>>
>>
>>