Weekly Edition
Return to the Security pageSponsored link
Vyatta –
Linux & Open Source
Alternative to Cisco –
Advanced Routing,
Firewall, VPN, QoS..
Free Download ->
| |||||||||||
Attacks on Firefox
Linux detractors often say that, if and when Linux becomes as popular as
Windows, it will attract just as many attacks - and prove just as
vulnerable. The popularity of Linux exceeds that of Windows in some areas,
but, so far, these attacks have not materialized. It is now beginning to
look like this upsurge in attacks may not target Linux directly. Instead,
the Firefox browser may become the target of choice.
Eric Johanson recently put out an advisory demonstrating how "homograph attacks" can work against Firefox (and Konqueror). These attacks take advantage of international domain names, which can be written in non-ASCII character sets. The problem is that many non-ASCII characters are rendered just like (or very nearly like) characters in the ASCII set; as a result, a visually identical domain name can actually point somewhere unexpected. An example provided by Mr. Johanson is www.pаypal.com, which your browser renders as www.pаypal.com. This technique, clearly, could be used for phishing attacks - especially when one considers that SSL certificates can contain non-ASCII characters too. It is said that a short-term workaround for this problem is to turn off the network.enableIDN parameter in the about:config screen, but this workaround does not work for all users, and it does not persist across sessions. Meanwhile, "mikx" has posted a set of three different Firefox vulnerabilities. "Fireflashing" is a trick that, in conjunction with the Flash plugin, can be used to trick a Firefox user into changing configuration parameters. The "firedragging" vulnerability gets around some restrictions to possibly allow a (Windows) user to put a web-supplied executable file onto the desktop. And "firetabbing" circumvents the isolation between sites when links are dragged to different tabs. All of these vulnerabilities have been acknowledge by the Mozilla Project and fixes have been committed. These attacks are not truly devastating. They make certain kinds of phishing and social engineering attacks easier, but, hopefully, should not fool suitably careful users. But they do show that the level of interest in Firefox vulnerabilities is on the increase. Attacking many parts of a Linux system is hard. Security is generally reasonably good, one hopes, and techniques like privilege minimization, privilege separation and sandboxing help to contain any vulnerabilities which do exist. The sheer variety of deployed Linux systems also works against attackers; an exploit which works on one system may be useless against the next. The role of diversity in ensuring the security of Linux systems should not be underestimated. Firefox, however, is widely deployed and quite similar on all systems. If nothing else, the project's trademark policies tend to ensure that Firefox deployments will not vary much. Firefox contains interpreters which will certainly contain exploits of the "write once, run anywhere" variety. Firefox is directly controlled by users who may have little interest in - or knowledge of - security policies. And, in many (perhaps most) cases, it talks directly to random sites all over the net. So of course Firefox is being eyed as a possible entry point to otherwise secure systems. The Firefox browser is popular for a reason: it is a solid, highly featureful, highly useful program. It is also a huge and complex program. Regardless of the skill of the Mozilla hackers, verifying and maintaining the security of a code base that large is going to be a major challenge. Expect some interesting times over the next few years as the security claims made by the Mozilla Project - and by the free software community in general - are put to the test. (Log in to post comments)
Attacks on Firefox Posted Feb 9, 2005 21:00 UTC (Wed) by hamjudo (guest, #363) [Link] Linux detractors often say that, if and when Linux becomes as popular as Windows, it will attract just as many attacksThat is already wrong, if you measure popularity by number of installed systems. I started using Linux in 1993. In 1994 my Windows using friends were being spoofed by the "GoodTimes" hoax. Real Windows viruses were doing significant damage by 1995. See History of Malware, 1993-1995. There are certainly more Linux systems in use today than there were Windows systems in 1995. There isn't nearly as much malware for Linux today as compared to how the Windows users were suffering even back then. Better researchers than I, can figure out quantitatively how Linux usage today compares with Windows over the last decade, and the historic malware load.
Attacks on Firefox Posted Feb 21, 2005 18:56 UTC (Mon) by turpie (guest, #5219) [Link] The number of installed system of Windows in 1995 vs Linux in 2005 is irrelevant. The scumbags are only interested in their current relative popularity. Windows is currently the most popular, so it currently attracts the most attacks.
Attacks on Firefox Posted Feb 9, 2005 22:44 UTC (Wed) by dkite (guest, #4577) [Link] Am I wrong to suggest that the homograph attacks aren't a flaw in thebrowser? They implement the IDN standard. How is that different from directing people to update their personal Paypal information at mypaypal.com, or palpay.com? Not to suggest that there isn't a danger. It is up to paypal to protect their customers by grabbing the domain names. Derek
Homographic attacks Posted Feb 10, 2005 1:19 UTC (Thu) by eru (subscriber, #2753) [Link] They are a result of a feature in the Unicode character set standard that can strike any browser or other application, not just Firefox. If two characters look the same but are interpreted differently, there is very little the user can do. Probably the internationalized domain name handling should be modified to require that the string is first normalized so that all characters that look the same or even very similar are collapsed to one code point. For example, Latin, Greek and Russian versions of 'o' should all be considered the same for the purpose of looking up addresses.
Attacks on Firefox Posted Feb 10, 2005 1:24 UTC (Thu) by fergal (subscriber, #602) [Link] What about "p"? The greek letter rho might fool some people so with 2 "a"s and 2 "p"s in paypal already that's 15 fake versions. Who knows how many other homographs there are for the letters in "paypal". Leaving it up to each company to buy all the possiblibilities is expensive and error prone. A far more reasonable idea is that it be impossible to register any of the hompographs of already existing domains. Until then, the browsers should should highlight any characters in the domain name that are outside the user's language's script.
Attacks on Firefox Posted Feb 10, 2005 5:47 UTC (Thu) by ekj (subscriber, #1524) [Link] Yeah. You're rigth. It's not really a bug. I mean, if the two letters really do look like that, how is firefox (or any other program) supposed to render them ?The real question is if makes sense for the domain system to allow the registering of visually identical, or very nearly identical names. The problem offcourse is that there's no simple criteria for what is identical (or nearly so) it depends, among other things, on the fonts the user is using. In some fonts l and I are indistinguishable, should we therefore disallow the registeing of paypai.com on the basis that if written with a capital I (DNS is not case-sensitive) then in some fonts www.paypaI.com look indistinguishable from www.paypal.com ? There are no simple answers here...
Attacks on Firefox Posted Feb 10, 2005 9:15 UTC (Thu) by mmarsh (subscriber, #17029) [Link] You could use color to indicate the character set. If all characters are in the same set, they get the default background color (eg, white). Characters from a second set get a different color (eg, red), from a third set yet a different color (eg, green), etc. If you want to mark non-ASCII character sets used consistently, you could optionally color the whole thing red or put a small icon or piece of text indicating that it's a non-ASCII address. I don't know how easy this would be to do, but it would certainly stand out.
Fonts and indentical chars Posted Feb 11, 2005 5:26 UTC (Fri) by eru (subscriber, #2753) [Link] The problem offcourse is that there's no simple criteria for what is identical (or nearly so) it depends, among other things, on the fonts the user is using. In some fonts l and I are indistinguishable, should we therefore disallow the registeing of paypai.com on the basis that if written with a capital I (DNS is not case-sensitive) then in some fonts www.paypaI.com look indistinguishable from www.paypal.com ?There are no simple answers here... A perfect solution is hard or impossible to find, but I think a solution that at least does not make the situation any worse than it is with plain-ASCII names is not at all that hard. Combining characters that in most fonts are identical or practically identical ignoring language (as I proposed above) would achieve that. Having capital-I and lowercase-L look same in some fonts is a problem of the font, really, and smart designers should use maximally legible fonts in the lines that show or input URL:s. I remember that in old days many Telex machines used a font where lowercase-L had a little hook at bottom to ensure it was different from uppercase-I. Might be a good idea to use it in browsers. (Wonder if there is a X11-compatible implementation of this font anywhere?)
Fonts and indentical chars Posted Feb 25, 2005 9:00 UTC (Fri) by QuisUtDeus (guest, #14854) [Link] What about an option (adjustable according to visual accuity) of showing the number of times the browser has followed a link to a given site and/or domain.
For example: a pop-up box that would say [www.paypal.com - 120 visits / *.paypal.com - 150 visits] vs. [www.paypa1.com - 0 visits / *.paypa1.com - 0 visits].
It could be configurable to stop it if there have been so many visits, or if the name is published in a maintained list of common sites/domains.
Attacks on Firefox Posted Feb 11, 2005 5:30 UTC (Fri) by mp (subscriber, #5615) [Link] No, you certainly are not wrong.But IIRC the problem is in some ways old news. I mean, it was being pointed out since the work on IDN started that homographs are there. I guess phishing was not sufficiently popular a few years back.
Attacks on Firefox Posted Feb 13, 2005 8:38 UTC (Sun) by ordonnateur (guest, #6652) [Link] "not a fault in the browser" yes indeed.
As the example of 1 and lower case l (see below) shows this problem can apply to plain ASCII.
Attacks on Firefox Posted Feb 17, 2005 5:36 UTC (Thu) by pdundas (subscriber, #15203) [Link] > (Diffrent colours for different char sets etc is> no help to the colour blind.)
It's a good default display method to show differences.
The more important question is whether all languages can be expected to use a single unicode "charset" (or maybe a subset of related charsets) - if not, it's a less generally useful technique.
> All the proposed technical fixes merely ameliorate
It's called defence in depth. You deploy a range of approaches to reduce the problem. Consider that we make theft illegal AND ALSO lock our front doors.
In this case technological means can help, but it is also a requirement that certifying authorities and registrars NOT REGISTER abusive phishing-style names. How widely enforced that will be is not clear, but a few fines and imprisonments for facilitating fraud may encourage the others.
A full solution requires lots of things to be done. There is no single "right answer".
Attacks on Firefox Posted Feb 13, 2005 17:32 UTC (Sun) by inverter (guest, #19022) [Link] As happened various times in the past, another software failure predicted by DJB: http://cr.yp.to/djbdns/idn.html
Unicode indefensible---Schneier Posted Feb 14, 2005 8:53 UTC (Mon) by Max.Hyre (subscriber, #1054) [Link] I see no one has pointed out that Bruce Schneier was worried about this almost five years ago, and worried about more than just social engineering. In his Crypto-Gram of 15 July 2000, the section titled Security Risks of Unicode includes observations such asThe philosophy behind the Unicode spec is to provide all possible useful characters for applications that are 8- or 16-bit clean. This is admirable, but it is nearly impossible to filter a Unicode character stream to decide what is "safe" in some application and what is not. Sound excessive? You should read the article.
Oops, wrong position Posted Feb 14, 2005 8:57 UTC (Mon) by Max.Hyre (subscriber, #1054) [Link] Sorry, I should have attached that to eru's comment, a good ways above.
Attacks on Firefox Posted Feb 10, 2005 0:17 UTC (Thu) by kune (subscriber, #172) [Link] I support the remarks at the end of the article and would like to put it more bluntly: A free software hyped as a tool for the masses needs first-class security patch management. But I've yet to read a statement from the Mozilla guys that they are working on a fix. I still hope that somebody is working on it and we will soon see a fix, which at least switch offs the IDN feature and allows a workable and reliable way to switch it on and off.
Attacks on Firefox Posted Feb 10, 2005 1:34 UTC (Thu) by grantma (subscriber, #5225) [Link] Unlike the author's comment, I set the network.enableIDN to false, and after quitting firefox it IS kept in the next session
Persistently disabling IDN Posted Feb 10, 2005 2:53 UTC (Thu) by lmartelli (subscriber, #11755) [Link] If you want to persistently disable IDN in a Mozilla based browser, you can edit your "prefs.js" file.
Attacks on Firefox- captureing keystrokes in X Posted Feb 10, 2005 5:51 UTC (Thu) by croftj (guest, #332) [Link] This makes me wonder how easy it is to capture keystrokes in X. Can one program capture the keystrokes of another program without it being noticed?
Attacks on Firefox- captureing keystrokes in X Posted Feb 10, 2005 7:39 UTC (Thu) by kleptog (subscriber, #1183) [Link] The answer is yes. Once you're connected to the X session you can do many things including:
- Screen grabs off the screen or any window
X11 objects don't have a security context. The thing that makes it work in general is that you don't *know* the window identifiers of other windows on the desktop. So you have to go looking for them.
The flexibility is very useful because it allows window managers to do the cool things they do. Things like xev and xkill as easily implemented.
I seem to remember someone adding security contexts to an Xserver but it's not in the normal distributions.
Attacks on Firefox- captureing keystrokes in X Posted Feb 10, 2005 12:29 UTC (Thu) by oak (guest, #2786) [Link] Seen on the freedesktop.org mailing lists (if I remember correctly):NSA is adding selinux hooks into X...
Attacks on Firefox Posted Feb 10, 2005 6:26 UTC (Thu) by ll (subscriber, #4404) [Link] Perhaps Verisign and the other certificate authorities, who have made billions of dollars in the past few years, and whose marketing pitches all claim that their signing power helps secure the Internet, will address this issue.
In this example, the ironically-named USERTRUST Network provided the cert that enabled the https exploit. Yet all the coverage I've seen dwells on IDN and the Mozilla implementation.
If CA's want to keep claiming that they "protect identity", perhaps they can spend a few bucks on some R&D to screen out phishing cert requests.
Konqueror Posted Feb 10, 2005 18:39 UTC (Thu) by rfunk (subscriber, #4054) [Link] I just tried Konqueror, and without SSL it takes me to the bogus page,but with SSL I get a warning that the certificate wasn't issued to this host, but was issued to: www.xn--pypal-4ve.com It would be nice if I could make konq not even work at all with unicode domain names though.
characters may look the same Posted Feb 17, 2005 2:51 UTC (Thu) by edmundo (guest, #616) [Link] I think people just have to get used to the inescapable fact thatcharacters that look the same or very similar on the screen might not be the same character. I learnt this on a Commodore PET in the 1970s where they had this character called a "shift-space" whose graphical representation was identical to that of an ordinary space. Do I expect to be able to distinguish all Unicode characters by looking at how they are displayed on a computer screen? Obviously not, though I probably know more about Unicode than most people, many of whom are apparently incapable of distinguishing the 3 Latin-1 characters that resemble an apostrophe or the 2 that resemble a vertical line, for example.
|
|||||||||||