Posted on 06/07/2006 6:47:44 AM PDT by ShadowAce
Multiple security organizations warned Tuesday that Internet Explorer, Firefox, Mozilla, and SeaMonkey -- on Windows, Linux, and the Mac -- are vulnerable to a JavaScript bug that could allow a determined attacker to dupe users into giving up sensitive personal information such as credit card or bank account numbers and passwords.
According to Symantec, which issued an alert late afternoon Tuesday, all versions of the Microsoft and Mozilla browsers could be used to harvest data through a JavaScript key-filtering vulnerability.
"This issue is triggered by utilizing JavaScript 'OnKeyDown' events to capture and duplicate keystrokes from users," went the Symantec warning.
The bug would let crafty criminals filter keystrokes entered into a form, say a credit card form to pay for online goods, to an invisible file upload dialog on the same Web page. Once the information's trapped in that hidden dialog -- the vulnerability discoverer used the analogy of the keystrokes "bouncing" from the legit (or at least legitimate-looking form) to the cloaked one -- the data could be sent to the attacker.
"Exploiting this issue requires that users manually type the full path of files that attackers wish to download…[and] may require substantial typing from targeted users, so keyboard-based games, blogs, or other similar pages are likely to be utilized by attackers to entice users to enter the required keyboard input to exploit this issue," continued Symantec.
Danish vulnerability tracker Secunia also posted warnings of the bug Tuesday, and ranked it as "less critical," the second-from-the-bottom rating in its five-step scoring system.
The bug is unusual in that it affects not only Internet Explorer -- including fully-patched IE 6.0 and even IE 7 Beta 2 -- but also Firefox (though the most current version 1.5.0.4), the Mozilla suite, and the separately-developed successor to Mozilla, SeaMonkey. It's also out of the ordinary by virtue of its multi-platform impact: users of those browsers running Windows, Linux, and Mac OS X are vulnerable, said Symantec.
Charles McAuley, who first posted information about the bug on the Full Disclosure security mailing list Monday, also published proof-of-concept code to demonstrate how an exploit might work.
Symantec advised users to avoid unfamiliar Web neighborhoods and/or disable scripting or active content capabilities of the affected browsers.
"Extra protection for your Firefox: NoScript allows JavaScript, Java (and other plugins) only for trusted domains of your choice (e.g. your home-banking web site). This whitelist based pre-emptive blocking approach prevents exploitation of security vulnerabilities (known and even unknown!) with no loss of functionality... Experts will agree: Firefox is really safer with NoScript ;-)"
So much for Open software being more secure....
It is more secure. Post #4 is one reason why.
NoScript rocks. It's a part of my standard list of critical extensions.
This vulnerability appears to affect ...
Internet Explorer, Firefox, Mozilla, and SeaMonkey -- on Windows, Linux, and the Mac
Rather than being something wrong with open source processes, it sounds more to me like it is an issue with javascript itself. It also sounds like someone would have to go through a lot of trouble to be affected by this.
The flaw isn't in the affected browsers but in Java. So this shouldn't count as a black mark on Firefox, nor on IE or any of the other browsers.
I guess they could have included a security feature to plug this hole, but it's not their hole.
What the article doesn't mention is that for Firefox users, disabling Java scripting is as easy as a click of a button.
And I know many FF users who do just that.
Do you use AdBlock or AdBlock plus? If so, which do you prefer?
I don't mess with adblockers. I just right click on the images from ad sites, and =poof= nothing more from that site. Doesn't take long to train it.
Thanks. I pretty much do the same. Disabled it on my laptop, never downloaded on my desktop.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.