Hasta La Gadget!

This article was written on July 23, 2007 by CyberNet.

We’ve shown you how easy it can be to retrieve passwords stored in your browser, provided that someone has access to your computer. Well, that’s not the only way for a hacker to gain access to some of the information stored in the Firefox Password Manager. A new flaw that was just revealed late last week can retrieve some of your passwords using a very small amount of JavaScript.

How does it work? Here’s a quick example of what could happen:

1. User visits a site such as their own blog hosted on a popular network (something like Blogger).
2. They login, and have Firefox remember their username/password.
3. They visit someone else’s blog on the same domain, and a username/password form appears on the site. As expected Firefox autofills the information for the user (both the username and password) so that they can just hit enter to login.
4. The site is able to use some JavaScript to store the username and password without the user even hitting the Submit button. This is done by having the JavaScript go and retrieve the values located in the text box (document.<form>.<field>.value).

This flaw can only be used to expose the username and password that is entered into a form, and Firefox automatically does this for people who have stored a password. That means your information could be surrendered without you even realizing it.

If you want to try this out yourself, Heise has setup a demo site where you makeup a username/password, and then have Firefox store it. Then when you go to the “evil” page, Firefox will automatically fill out the form and a popup will reveal the username and password you stored.

To get around this happening, it is recommended that you either don’t store passwords in Firefox or you disable JavaScript. Of course, this is really only an issue on a “network” of sites that all have the same domain. The reason for that is because Firefox will not, for example, fill in your bank’s username and password here on CyberNet. So just be aware of what passwords you have stored, and you can always have Firefox prompt you for a master password before it autofills any information.

An alternative that xpgeek pointed out in the forum is to install the Secure Login extension to prevent Firefox from automatically filling in password forms.

Note: This vulnerability also affects the Safari browser.

– What’s the Most Secure Browser? –

I decided to lookup on Secunia, who tracks vulnerabilities for more than 14,000 applications, to see which browser is currently the most secure. Here’s what I came up with:

• Opera 9.x has had 8 advisories, all of which have been patched. [source]
• Firefox 2.0.x has had 13 advisories, and there are 6 that have not been patched. [source]
• Internet Explorer 7.x has had 14 advisories, and there are 8 that have not been patched. [source]

You can take that information for what it’s worth, but it goes to show that most browsers constantly have security-related flaws.

Source: Heise Security [via Slashdot]

Copyright © 2011 CyberNetNews.com

Related Posts:

Microsoft Password CheckerGoogle Chrome Master Password Still Non-Existent?Tip for Saving Passwords in Internet Explorer or FirefoxTop 10 Most Common PasswordsGiveaway: RoboForm Pro Password & Form Filler

Console modder Ben Heck sweeps the Xbox into a ’70s time warp. Haul this mutant Xbox/Atari laptop to your next gaming gathering and listen to your friends weep with envy.

We noted Firefox 3’s spectacular eight million downloads in a day when discussing the recent launch of IE9, and that mark shall live on as a record for another day. Firefox 4 looks to have a had a thoroughly successful debut, going past the five million milestone within the first 24 hours of its release, but it hasn’t quite been able to overshadow its predecessor. And before you go comparing its numbers to the latest Internet Explorer, do be cognizant that FF4 released on a wider set of platforms, rendering direct stat comparisons a little dicey. That’s not stopping StatCounter, however, who notes that the latest Firefox already has a 1.95 percent share of the browser market, almost exactly double what IE9 can claim so far. Better get working on that XP compatibility, eh Microsoft?

Continue reading Firefox 4 clocks up 5 million downloads within first 24 hours, fails to beat Firefox 3 download record

Firefox 4 clocks up 5 million downloads within first 24 hours, fails to beat Firefox 3 download record originally appeared on Engadget on Wed, 23 Mar 2011 08:57:00 EDT. Please see our terms for use of feeds.

Permalink   |  Mozilla  | Email this | Comments

Bertrand Serlet, the guy who led the development of Mac OS X since the beginning, is leaving Apple. He was one of the heavyweights and a legendary figure at the company, even while he wasn’t well known by the general public. But why is he leaving? More »

Crime, it just doesn’t pay. Well, actually it does, to the tune of £53,612, but then you get caught and you have to work off that salary with two years at Her Majesty’s pleasure. One Ashley Mitchell, an enterprising 29-year old from Devon, England, managed to break into Farmville maker Zynga‘s mainframe, hijack the identities of two of its staffers, and procure for himself a cool £7 million ($11.4m) in virtual poker chips. He then proceeded to sell about a third of them for the above sum, while consuming a big chunk of the rest in satisfying his own gambling habit. Ashley already had a history of digital malfeasance, having previously hacked into the systems of Torbay Council, his former employer, and is now on the receiving end of a two-year prison term for his current crime plus the activation of a 30-week suspended sentence. There’s a warning in this tale of woe for us all, however — Monsieur Mitchell piggybacked on his neighbors’ unsecured WiFi networks in order to do his dastardly deeds. Slap a password on that router, won’t you?

Hacker nets two years in jail after pilfering £7 million in virtual poker chips originally appeared on Engadget on Wed, 23 Mar 2011 08:09:00 EDT. Please see our terms for use of feeds.

Permalink The Inquirer  |  Guardian  | Email this | Comments