First serious FIREFOX!! SECURITY BREACH IS HERE - GoFuckYourself.com

azguy · 02-07-2005, 09:23 PM

IE is not affected by this. I guess this comes with the popularity after all.

I haven't seen this posted here yet.

Firefox can be easily exposed to sophisticated phishing attacks:

Visit http://www.shmoo.com/idn/ and see. PayPal's address appears not only in the status bar, but also after you click it. The HTTPS version of it is even scarier.

Fix:

1) Goto your Firefox address bar. Enter about:config and press enter. Firefox will load the (large!) config page.

2) Scroll down to the line beginning network.enableIDN -- this is International Domain Name support, and it is causing the problem here. We want to turn this off -- for now. Ideally we want to support international domain names, but not with this problem.

3) Double-click the network.enableIDN label, and Firefox will show a dialog set to 'true'. Change it to 'false' (no quotes!), click Ok. You are done.

4) Go check out the shmoo demo again and notice it no longer works.

Read more about this in http://www.boingboing.net/ (look up Shmoo Group exploit: 0wn any domain, no defense exists).

Spunky · 02-07-2005, 09:25 PM

Thanks for the heads up

azguy · 02-07-2005, 09:27 PM

Seems like you also need to clear the browser cache after applying the fix to actually see if it works.

xlogger · 02-07-2005, 09:27 PM

mhahahaha!!! NICE!!

Project-Shadow · 02-07-2005, 09:28 PM

Damn, so much for the uber firefox browser =/
Hopefully the users will be smart enough to realise something is up.

azguy · 02-07-2005, 09:29 PM

Quote:

Originally Posted by xlogger

mhahahaha!!! NICE!!

It was only a matter of time. The funny thing is that for the most part IE is not affected (those IE users who installed the i-Nav plug-in (http://www.idnnow.com/ - Internationalized Domain Names) are also vulnerable.

azguy · 02-07-2005, 09:30 PM

Quote:

Originally Posted by Project-Shadow

Damn, so much for the uber firefox browser =/
Hopefully the users will be smart enough to realise something is up.

It's not that easy. The address bar shows the correct address. For SSL connections it even highlights it just like it does with any https address. Crazy shit.

http://www.shmoo.com/idn/homograph.txt

Thurbs · 02-07-2005, 09:32 PM

well nothing is perfect .. great find.

David! · 02-07-2005, 09:32 PM

If you were a hacker, would you bother writing spyware for a browser that is used by a few hundred people in the world?
Most likely, no.
But now that Firefox is gaining popularity and has broken the few millions users mark, hackers will start writing spyware for Firefox.

Antonio · 02-07-2005, 09:32 PM

keep using Firefox, guys
I'll stick to K-Meleon, been using it for years, it's about 100 times better than Firefox!

xlogger · 02-07-2005, 09:33 PM

Another error i found is that if you encript the urls it wont work in FireFox. If you mouse over the url below it looks fine. But click it, it wont work. It will only work in IE.

Link

azguy · 02-07-2005, 09:35 PM

Quote:

Originally Posted by PussyMan

If you were a hacker, would you bother writing spyware for a browser that is used by a few hundred people in the world?
Most likely, no.
But now that Firefox is gaining popularity and has broken the few millions users mark, hackers will start writing spyware for Firefox.

And now they have the entire code available to help them

SmokeyTheBear · 02-07-2005, 09:39 PM

this isnt new ? theres been a few of these for firefox..

azguy · 02-07-2005, 09:41 PM

Quote:

Originally Posted by SmokeyTheBear

this isnt new ? theres been a few of these for firefox..

VII. Timeline

2002 - Original paper published on homograph attacks
2002-2005 - Verisign pushes IDN, and browsers start adding support for it
Jan 19, 2005 - Vendors notified of vulnerability
Feb 6, 2005 - Public disclosure @shmoocon 2005

I guess some extension that fixes it will be available by one of the coders in a day or two.

undermyspell · 02-07-2005, 09:47 PM

It still surprises me that people go through links sent to them via email or otherwise when all they have to do is type in the url and go that way...

good information though for those that don't do type ins when they need to verify or change information

azguy · 02-07-2005, 09:56 PM

Quote:

Originally Posted by undermyspell

It still surprises me that people go through links sent to them via email or otherwise when all they have to do is type in the url and go that way...

good information though for those that don't do type ins when they need to verify or change information

I set up a private home portal for my gf. LOL. It has all the links she needs on a daily basis. She knows this is the only trusted page on the net

pornguy · 02-07-2005, 10:01 PM

Thanks for the info.

woj · 02-07-2005, 10:12 PM

Good info, thx for the heads up...

Mike Okitch · 02-07-2005, 10:43 PM

Thanks for the info mate!

Rochard · 02-07-2005, 10:48 PM

There are exploits in IE because it's the most commonly used browser. The more popular Firefox gets, the more problems it will have.

However, I really think IE will be the standard for some time to come. It's pre-installed on the most popular OS (windows) and people who don't know better will continue to use it.

MrJackMeHoff · 02-07-2005, 10:50 PM

Whoopdy doo
When you load the page you can see the BS domain . If you get the plugin for firefox anyway it shows the true domain right up top. Also if you check the cert it shows all bs too.. I guess if your that stupid..

Triple 6 · 02-07-2005, 11:02 PM

yo son i been done known this exploit back in 88 yo

muddafukkasheeettt

FrankWhite · 02-07-2005, 11:12 PM

http://www.corestreet.com/spoofstick/firefox.html

Der Schleicher · 02-07-2005, 11:21 PM

very helpful tips !

rock on!

QuaWee · 02-07-2005, 11:34 PM

wow, thanks man

zentz · 02-07-2005, 11:37 PM

Quote:

Originally Posted by Doomed

http://www.corestreet.com/spoofstick/firefox.html

your sig is big

chodadog · 02-07-2005, 11:47 PM

See, it's not that Microsoft are somehow slack when it comes to patching their shit it up, it's that they're the main focus because they have the browser market by it's balls. Now firefox is getting to a point where even though it's share is tiny compared to that of microsoft, it's becoming substantial and an exploit would be worthwhile to hackers. So expect firefox holes to be found more often with it's increasing popularity.

xclusive · 02-07-2005, 11:50 PM

thanks for the heads up but there are always work arounds for any software no big deal

Ron Bennett · 02-07-2005, 11:51 PM

Yes, for most folks using an english version OS / web browser, typing in a domain may be sufficient security...

However, in the world of IDNs, things do not work as one would always expect ...

For some folks using *non-english* software, typing in a domain is NO guarantee ... IDNs are not exact and thus there is much latitude in how software maps them to domains.

In a nutshell, there is no guarantee that folks typing a domain name in a non-english based OS / web browser - some will get the website they expect, some won't ... such "best guess" behavior is totally contrary to structure of the DNS system; ICANN was warned repeatedly about these threats and yet has allowed IDNs to go ahead anyways ...

Here's an example of something really spooky ...

Click to this thread below and see if you can spot the real amazon.com?

http://www.dnforum.com/showthread.php?t=81129

Ron

LionDollars · 02-08-2005, 12:13 AM

thanks for the heads up!

CoinsCuties · 02-08-2005, 12:39 AM

Quote:

Originally Posted by Ron Bennett

Yes, for most folks using an english version OS / web browser, typing in a domain may be sufficient security...

However, in the world of IDNs, things do not work as one would always expect ...

For some folks using *non-english* software, typing in a domain is NO guarantee ... IDNs are not exact and thus there is much latitude in how software maps them to domains.

In a nutshell, there is no guarantee that folks typing a domain name in a non-english based OS / web browser - some will get the website they expect, some won't ... such "best guess" behavior is totally contrary to structure of the DNS system; ICANN was warned repeatedly about these threats and yet has allowed IDNs to go ahead anyways ...

Here's an example of something really spooky ...

Click to this thread below and see if you can spot the real amazon.com?

http://www.dnforum.com/showthread.php?t=81129

Ron

You have to register for that link.

Ron Bennett · 02-08-2005, 12:51 AM

Opps ... here's a link to the same thread in their archives.

http://www.dnforum.com/archive/index.php/t-81129

Copy and paste (links in their archive aren't clickable) the first amazon.com link and try it, then copy and paste the second amazon.com link - they look exactly the same, but they are not and actually go to two different places!

Ron

Ron Bennett · 02-08-2005, 11:58 AM

Bump for the day crew ...

The extremely flawed *implementation* of International Domain Names (IDNs) is an issue more folks need to be made aware of - if enough people bitch about this problem, ICANN / VeriSign (.com registry operator) will likely make some meaningful changes before the IDN spoofing problem gets totally out of control.

Ron

colpanic · 02-08-2005, 12:16 PM

FYI, a patch is now available for FireFox.

That didn't take too long now did it

Ron Bennett · 02-08-2005, 01:49 PM

The patch does NOT solve the bad implementation of IDNs ...

From my understanding, all the Firefox patch does is fix config revert problem - that is Firefox would not save whether IDN support was enabled/disabled across browser sessions.

A better fix would be for Firefox to disable IDN support by default, but not sure the bug fix does that.

To reiterate again, the Firefox patch does NOT solve the bad implementation of IDNs ... only ICANN can fix that...

Or alternatively, all software that relies on domain names needs to NOT support IDNs; filtering out of all punycode "xn--" domains by networks, software, etc.

Ron

02-07-2005, 09:23 PM	#1
azguy Confirmed User Join Date: Nov 2004 Location: Scottsdale, AZ Posts: 5,167	First serious FIREFOX!! SECURITY BREACH IS HERE IE is not affected by this. I guess this comes with the popularity after all. I haven't seen this posted here yet. Firefox can be easily exposed to sophisticated phishing attacks: Visit http://www.shmoo.com/idn/ and see. PayPal's address appears not only in the status bar, but also after you click it. The HTTPS version of it is even scarier. Fix: 1) Goto your Firefox address bar. Enter about:config and press enter. Firefox will load the (large!) config page. 2) Scroll down to the line beginning network.enableIDN -- this is International Domain Name support, and it is causing the problem here. We want to turn this off -- for now. Ideally we want to support international domain names, but not with this problem. 3) Double-click the network.enableIDN label, and Firefox will show a dialog set to 'true'. Change it to 'false' (no quotes!), click Ok. You are done. 4) Go check out the shmoo demo again and notice it no longer works. Read more about this in http://www.boingboing.net/ (look up Shmoo Group exploit: 0wn any domain, no defense exists).

02-07-2005, 09:25 PM	#2
Spunky I need a beer Industry Role: Join Date: Jun 2002 Location: ♠ Toiletville ♠ Posts: 133,944	Thanks for the heads up __________________ *YOUR INFORMATION HERE*

02-07-2005, 09:27 PM	#4
xlogger Confirmed User Join Date: Jul 2004 Location: NY Posts: 9,507	mhahahaha!!! NICE!! __________________ ---------- XLOGGER [REFLECTED] [OH]

02-07-2005, 09:32 PM	#9
David! By the wrath of Agamemnon Industry Role: Join Date: Apr 2004 Location: Miami Posts: 6,501	If you were a hacker, would you bother writing spyware for a browser that is used by a few hundred people in the world? Most likely, no. But now that Firefox is gaining popularity and has broken the few millions users mark, hackers will start writing spyware for Firefox. __________________ .

02-07-2005, 09:33 PM	#11
xlogger Confirmed User Join Date: Jul 2004 Location: NY Posts: 9,507	Another error i found is that if you encript the urls it wont work in FireFox. If you mouse over the url below it looks fine. But click it, it wont work. It will only work in IE. Link __________________ ---------- XLOGGER [REFLECTED] [OH]

02-07-2005, 09:28 PM	#5
Project-Shadow Confirmed User Industry Role: Join Date: Feb 2003 Posts: 7,340	Damn, so much for the uber firefox browser =/ Hopefully the users will be smart enough to realise something is up.

02-07-2005, 09:32 PM	#8
Thurbs The Thrilla in Manila Join Date: Sep 2004 Location: Thurbs' Lagoon, Christmas Island Posts: 4,785	well nothing is perfect .. great find.

02-07-2005, 09:32 PM	#10
Antonio Too lazy to set a custom title Join Date: Oct 2001 Location: Spartaaaaaaaaa Posts: 14,136	keep using Firefox, guys I'll stick to K-Meleon, been using it for years, it's about 100 times better than Firefox!

02-07-2005, 09:39 PM	#13
SmokeyTheBear ►SouthOfHeaven Join Date: Jun 2004 Location: PlanetEarth MyBoardRank: GerbilMaster My-Penis-Size: extralarge MyWeapon: Computer Posts: 28,609	this isnt new ? theres been a few of these for firefox.. __________________ hatisblack at yahoo.com

02-07-2005, 09:47 PM	#15
undermyspell Confirmed User Join Date: Sep 2002 Posts: 875	It still surprises me that people go through links sent to them via email or otherwise when all they have to do is type in the url and go that way... good information though for those that don't do type ins when they need to verify or change information

02-07-2005, 10:01 PM	#17
pornguy Too lazy to set a custom title Industry Role: Join Date: Mar 2003 Location: Homeless Posts: 62,911	Thanks for the info. __________________ PornGuy skype me pornguy_epic AmateurDough The Hottes Shemales online! TChicks.com \| Angeles Cid \| Mariana Cordoba \| MAILERS WELCOME!

02-07-2005, 10:12 PM	#18
woj <&(©¿©)&> Industry Role: Join Date: Jul 2002 Location: Chicago Posts: 47,882	Good info, thx for the heads up... __________________ Custom Software Development, email: woj#at#wojfun#.#com to discuss details or skype: wojl2000 or gchat: wojfun or telegram: wojl2000 Affiliate program tools: Hosted Galleries Manager Banner Manager Video Manager Wordpress Affiliate Plugin Pic/Movie of the Day Fansign Generator Zip Manager

02-07-2005, 10:43 PM	#19
Mike Okitch Confirmed User Join Date: May 2004 Location: Guantanamo Bay, Cuba Posts: 4,126	Thanks for the info mate! __________________ SIG TOO BIG! Maximum 120x60 button and no more than 3 text lines of DEFAULT SIZE and COLOR. Unless your sig is for a GFY top banner sponsor, then you may use a 624x80 instead of a 120x60.

02-07-2005, 10:48 PM	#20
Rochard Jägermeister Test Pilot Industry Role: Join Date: Dec 2001 Location: NORCAL Posts: 74,022	There are exploits in IE because it's the most commonly used browser. The more popular Firefox gets, the more problems it will have. However, I really think IE will be the standard for some time to come. It's pre-installed on the most popular OS (windows) and people who don't know better will continue to use it. __________________ “The choice is no longer between right or left. The choice is between normal and crazy.” - Sarah Huckabee Sanders YNOT MAIL \| THE BEST ADULT MAILING SOLUTION

02-07-2005, 10:50 PM	#21
MrJackMeHoff Confirmed User Join Date: Mar 2004 Location: LOLLIPOP ISLAND =-=-=-=-=-=-=-=-=-=-= =-=-=-=-=-=-=-=-=-=-= =-=-=-=-=-=-=-=-=-=-= =-=-=-=-=-=-=-=-=-=-= =-=-=-=-=-=-=-=-=-=-= =-=-=-=-=-=-=-=-=-=-= =-=-=-=-=-=-=-=-=-=-= =-=-=-=-=-=-=-=-=-=-= =-=-=-=-=-=-=-=-=-=-= =-=-=-=-=-=-=-=-=-=-= Posts: 4,569	Whoopdy doo When you load the page you can see the BS domain . If you get the plugin for firefox anyway it shows the true domain right up top. Also if you check the cert it shows all bs too.. I guess if your that stupid.. __________________

02-07-2005, 11:02 PM	#22
Triple 6 Confirmed User Join Date: Feb 2002 Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: Location: isN'T everything Posts: 5,394	yo son i been done known this exploit back in 88 yo muddafukkasheeettt __________________ SIG TOO SMALL! Maximum 1200x600 button and no more than 30 text lines of ALL SIZES and COLORS. Unless your sig is for a GFY top banner sponsor, then you may use a 6240x4800 instead of a 1024x800.

02-07-2005, 11:12 PM	#23
FrankWhite Confirmed User Join Date: Nov 2002 Location: nyc Posts: 3,540	http://www.corestreet.com/spoofstick/firefox.html

02-07-2005, 11:21 PM	#24
Der Schleicher Confirmed User Join Date: Jan 2005 Posts: 1,189	very helpful tips ! rock on! __________________ Teeny Teen Girls - One of the best free pictures and videos online. WEBMASTER - We offer free hosting and dream submitter sign up now!

02-07-2005, 11:34 PM	#25
QuaWee Confirmed User Join Date: Jul 2004 Location: boogers Posts: 5,791	wow, thanks man __________________ i luv mainstream

02-07-2005, 11:47 PM	#27
chodadog Confirmed User Join Date: Apr 2002 Posts: 9,736	See, it's not that Microsoft are somehow slack when it comes to patching their shit it up, it's that they're the main focus because they have the browser market by it's balls. Now firefox is getting to a point where even though it's share is tiny compared to that of microsoft, it's becoming substantial and an exploit would be worthwhile to hackers. So expect firefox holes to be found more often with it's increasing popularity. __________________ 26 + 6 = 1

02-07-2005, 11:50 PM	#28
xclusive Too lazy to set a custom title Join Date: Apr 2004 Location: Buffalo, NY Posts: 35,218	thanks for the heads up but there are always work arounds for any software no big deal __________________ I support MediumPimpin.com / Shemp's Outlawtgp.com /

02-07-2005, 11:51 PM	#29
Ron Bennett Confirmed User Join Date: Oct 2003 Posts: 1,653	Yes, for most folks using an english version OS / web browser, typing in a domain may be sufficient security... However, in the world of IDNs, things do not work as one would always expect ... For some folks using non-english software, typing in a domain is NO guarantee ... IDNs are not exact and thus there is much latitude in how software maps them to domains. In a nutshell, there is no guarantee that folks typing a domain name in a non-english based OS / web browser - some will get the website they expect, some won't ... such "best guess" behavior is totally contrary to structure of the DNS system; ICANN was warned repeatedly about these threats and yet has allowed IDNs to go ahead anyways ... Here's an example of something really spooky ... Click to this thread below and see if you can spot the real amazon.com? http://www.dnforum.com/showthread.php?t=81129 Ron __________________ Domagon - Website Management and Domain Name Sales

02-08-2005, 12:13 AM	#30
LionDollars Confirmed User Join Date: Nov 2004 Location: www.LionDollars.com Posts: 407	thanks for the heads up! __________________ We Now Have 4 Sex Dating sites. Not promoting Sex Dating? You are not earning! http://www.LionDollars.com 16,000 Free Hosted Galleries JUST LAUNCHED.

02-08-2005, 12:51 AM	#32
Ron Bennett Confirmed User Join Date: Oct 2003 Posts: 1,653	Opps ... here's a link to the same thread in their archives. http://www.dnforum.com/archive/index.php/t-81129 Copy and paste (links in their archive aren't clickable) the first amazon.com link and try it, then copy and paste the second amazon.com link - they look exactly the same, but they are not and actually go to two different places! Ron __________________ Domagon - Website Management and Domain Name Sales

02-08-2005, 11:58 AM	#33
Ron Bennett Confirmed User Join Date: Oct 2003 Posts: 1,653	Bump for the day crew ... The extremely flawed implementation of International Domain Names (IDNs) is an issue more folks need to be made aware of - if enough people bitch about this problem, ICANN / VeriSign (.com registry operator) will likely make some meaningful changes before the IDN spoofing problem gets totally out of control. Ron __________________ Domagon - Website Management and Domain Name Sales

02-08-2005, 12:16 PM	#34
colpanic Confirmed User Join Date: May 2004 Location: San Diego, CA Posts: 1,007	FYI, a patch is now available for FireFox. That didn't take too long now did it __________________ I like ducks.

02-08-2005, 01:49 PM	#35
Ron Bennett Confirmed User Join Date: Oct 2003 Posts: 1,653	The patch does NOT solve the bad implementation of IDNs ... From my understanding, all the Firefox patch does is fix config revert problem - that is Firefox would not save whether IDN support was enabled/disabled across browser sessions. A better fix would be for Firefox to disable IDN support by default, but not sure the bug fix does that. To reiterate again, the Firefox patch does NOT solve the bad implementation of IDNs ... only ICANN can fix that... Or alternatively, all software that relies on domain names needs to NOT support IDNs; filtering out of all punycode "xn--" domains by networks, software, etc. Ron __________________ Domagon - Website Management and Domain Name Sales