Re: New possible scam method : forged websites using XUL (Firefox)

[Marc]

The latest version of Firefox is 0.9.2.

> The developers of Mozilla are currently looking into various
> methods to make a fake user interface more obvious. The most
> likely solution will be to force the status bar to always be
> visible, as Microsoft will do with IE6 SP2.

This appears to be the case with 0.9.2.
The spoofed PayPal site (from
http://www.nd.edu/~jsmith30/xul/test/spoof.html) cannot hide FireFox's
status bar - so you get 2 status bars displayed.

Even so, the site is incredibly convincing, and I suspect the average user
would be understandably fooled.

Since the CERT recommendation, Mozilla browsers are gaining ground. Firefox
is now the browser of choice throughout the company I work for.

I suspect the best defence will be to block all xul on the proxy.

Marc Deglos.


----- Original Message -----
From: "David Ahmad" <da@securityfocus.com>
To: <bugtraq@securityfocus.com>
Sent: Friday, July 30, 2004 10:05 PM
Subject: Fwd: New possible scam method : forged websites using XUL (Firefox)

[Peter J. Holzer]

--nVMJ2NtxeReIH9PS
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On 2004-07-31 12:15:46 +0100, Marc wrote:
> The latest version of Firefox is 0.9.2.
>=20
> > The developers of Mozilla are currently looking into various
> > methods to make a fake user interface more obvious. The most
> > likely solution will be to force the status bar to always be
> > visible, as Microsoft will do with IE6 SP2.
>=20
> This appears to be the case with 0.9.2.
> The spoofed PayPal site (from
> http://www.nd.edu/~jsmith30/xul/test/spoof.html) cannot hide FireFox's
> status bar - so you get 2 status bars displayed.

On my system (Linux with fvwm2 window manager) the window has just the
right size to show the fake status bar but hide the real status bar. The
missing bottom window border is the only indication that there may be
something wrong (and that's not a big indication, since windows that
don't fit entirely on the screen aren't that uncommon).

A quote from <URL:http://bugzilla.mozilla.org/show_bug.cgi?id=3D22183#c77>:

| Anyway, we already put a dark inset border around untrusted chrome, we
| already say [Javascript Application] on alerts, we already allow the
| user to disable the disabling of the status bar, and so forth. Without
| making ourselves the laughing stock of the Web browser implementer
| community, there is little more we can do.

It looks like firefox doesn't "put a dark inset border around untrusted
chrome". Is there a similar exploit for Mozilla 1.7, to see whetehr that
border would be noticable (the URLs in the bug don't work).

Anyway, there are a few more things that Mozilla (suite or firefox)
could do:

* allow user to disable hiding of chrome (like disabling popups, etc.)

* add a UI to the "allow javascript only from trusted sites" feature.=20
(few people know that mozilla can do that, and even for those, editing
user.js is tedious).

hp

--=20
_ | Peter J. Holzer | Shooting the users in the foot is bad.=20
|_|_) | Sysadmin WSR / LUGA | Giving them a gun isn't.
| | | hjp@wsr.ac.at | -- Gordon Schumacher,
__/ | http://www.hjp.at/ | mozilla bug #84128

--nVMJ2NtxeReIH9PS
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iQDQAwUBQQ4QdVLjemazOuKpAQFgYgXUCxQuieqWOlMOfZ9Eeh 4yCVo3SIuQebiv
DkfsdZIYYolTIA5oRVOpWNm6nXZZjiuVYwOs197ORdg3m0kA7Y pSj8ABMVpmlmSK
1adPaLcq5vsE2IFQObck0M6tk7YPbxyJ1fx2Kf36k7XW/ewEmgcuqTLnWy7r+H7n
k6iqeP+q85w+82CPOlSYldR8iSQ+NUc2c9xz7U/z/jzOPbMbjelg1wPOl+MQGUzt
QG+pOuHFDqKJq9TblnQgoEjQLg==
=NJS2
-----END PGP SIGNATURE-----

--nVMJ2NtxeReIH9PS--

[Thomas T. Evans, III]

I have added SpoofStick (http://www.corestreet.com/spoofstick/) to both =
IE
and Firefox. With the Firefox spoof shown on the cited page, SpoofStick =
gets
moved and shows blank for "You're On". Not an outstanding warning, but
useful if you are watching.


Thomas T. Evans, III CCNA
Senior Network Manager
Hawk Corporation
ttevans@hawkcorp.net
216-267-7787 Ext. 500
Cell: 440-669-2526
Fax: 917-464-7241
President, MFG/Pro Midwest User Group

"The difference between genius and stupidity is that genius has limits"
--Albert Einstein
=A0



-----Original Message-----
From: Marc [mailto:md@nomensa.com]=20
Sent: Saturday, July 31, 2004 7:16 AM
To: bugtraq@securityfocus.com
Subject: Re: New possible scam method : forged websites using XUL =
(Firefox)

The latest version of Firefox is 0.9.2.

> The developers of Mozilla are currently looking into various
> methods to make a fake user interface more obvious. The most
> likely solution will be to force the status bar to always be
> visible, as Microsoft will do with IE6 SP2.

This appears to be the case with 0.9.2.
The spoofed PayPal site (from
http://www.nd.edu/~jsmith30/xul/test/spoof.html) cannot hide FireFox's
status bar - so you get 2 status bars displayed.

Even so, the site is incredibly convincing, and I suspect the average =
user
would be understandably fooled.

Since the CERT recommendation, Mozilla browsers are gaining ground. =
Firefox
is now the browser of choice throughout the company I work for.

I suspect the best defence will be to block all xul on the proxy.

Marc Deglos.


----- Original Message -----
From: "David Ahmad" <da@securityfocus.com>
To: <bugtraq@securityfocus.com>
Sent: Friday, July 30, 2004 10:05 PM
Subject: Fwd: New possible scam method : forged websites using XUL =
(Firefox)

[Marc]

'Tis true - the "Hide the status bar" is unchecked....and checking it DOES
allow the status bar to be hidden on the spoof site.

The "Hide the status bar" option is unchecked with a *default* installation
of Firefox 0.9.2.

Marc.


----- Original Message -----
From: "Nicholas Knight" <nknight@runawaynet.com>
To: <bugtraq@securityfocus.com>
Sent: Sunday, August 01, 2004 8:43 PM
Subject: Re: New possible scam method : forged websites using XUL (Firefox)


> Marc wrote:
>
> > The latest version of Firefox is 0.9.2.
> >
> >
> >>The developers of Mozilla are currently looking into various
> >>methods to make a fake user interface more obvious. The most
> >>likely solution will be to force the status bar to always be
> >>visible, as Microsoft will do with IE6 SP2.
> >
> >
> > This appears to be the case with 0.9.2.
>
> Tools -> Options -> Web Features -> Advanced button by Java/Javascript
> check boxes. I'll bet you have "Hide the status bar" unchecked.
>
> This caught me for a moment, too, then I remembered I always disable
> everything in the Advanced JavaScript Options box, and that's one of
> them. So users actually have a defence right now, but they have to
> specifically set it themselves.
>

[Nicholas Knight]

Marc wrote:

> The latest version of Firefox is 0.9.2.
>
>
>>The developers of Mozilla are currently looking into various
>>methods to make a fake user interface more obvious. The most
>>likely solution will be to force the status bar to always be
>>visible, as Microsoft will do with IE6 SP2.
>
>
> This appears to be the case with 0.9.2.

Tools -> Options -> Web Features -> Advanced button by Java/Javascript
check boxes. I'll bet you have "Hide the status bar" unchecked.

This caught me for a moment, too, then I remembered I always disable
everything in the Advanced JavaScript Options box, and that's one of
them. So users actually have a defence right now, but they have to
specifically set it themselves.