Firefox flaw raises phishing fears

[Schadenfroh]

A vulnerability in Firefox could expose users of the open-source browser to the risk of phishing scams, security experts have warned.

The flaw in Mozilla Firefox 1.0, details of which were published by security company Secunia on Tuesday, could allow hackers to spoof the URL in the download dialog box that pops up when a Firefox user tries to download an item from a Web site. This flaw is caused by the dialog box incorrectly displaying long sub-domains and paths, which can be exploited to conceal the actual source of the download.

Mikko Hypponen, director of antivirus research at software maker F-Secure, said this bug could make Firefox users vulnerable to cybercriminals. "The most likely way we could see this exploited would be in phishing scams," he said.

To fall victim to such a scam, a Firefox user would have to click on a link in an e-mail that pointed to a spoofed Web site and then download malicious software from the site, which would appear to be downloaded from a legitimate site.

This flaw was given a severity rating of two out of a possible five by Secunia.

David Emm, a senior technology consultant at antivirus company Kaspersky Labs, said that phishers aren't likely to take advantage of this flaw in Firefox, because Microsoft's Internet Explorer still dominates the browser market.

"I think it's unlikely that we'll see hackers rush to exploit this vulnerability," Emm said. "After all, Firefox has a much, much smaller install base than IE, and it's likely that hackers will continue to pay more attention to (IE) instead."

This may change in the future as Firefox has attracted a lot of interest in the past few months. A survey at the end of November found that Mozilla-based software, including Firefox, accounted for 7.4 percent of browsers in November 2004, up 5 percent from May.

The download vulnerability has been confirmed in Mozilla 1.7.3 for Linux, Mozilla 1.7.5 for Windows, and Mozilla Firefox 1.0. No solution is available at present, but Mozilla developers are expected to fix this bug in an upcoming version of the product.

The Secunia advisory and Mozilla bug report are available online.

Text

 

[DJFuji]

in addition to IE's much larger market share, FF users are less likely to be clueless users who click on random links sent to them or rush to "confirm their citibank information" after an email informs them that if they dont, their account will be cancelled. I kind of look at phishing/viruses/worms/hackers as a sort of "digital natural selection" that will slowly weed out the morons. Unfortunately its not able to prevent said morons from reproducing, though.

 

[n0cmonkey]

I'm not too worried about it.

 

[AlricTheMad]

besides, if you get spoof stick.......

Pat

 

[CTho9305]

The next version of thunderbird will have some protection to detect likely phishing links, which should also help out. All in all, this is a relatively minor issue (note it was given a 2/5 for severity).

 

[mjohn711]

At least its not as bad as the IE exploits

 

[n7]

Originally posted by: DJFuji
in addition to IE's much larger market share, FF users are less likely to be clueless users who click on random links sent to them or rush to "confirm their citibank information" after an email informs them that if they dont, their account will be cancelled. I kind of look at phishing/viruses/worms/hackers as a sort of "digital natural selection" that will slowly weed out the morons. Unfortunately its not able to prevent said morons from reproducing, though.

:laugh:

Beautiful

That's going to be my new sig!

 

[Miramonti]

Severity rating: 100%
Probability rating: .0000000000001%

 

[Barnaby W. Füi]

Originally posted by: DJFuji
in addition to IE's much larger market share, FF users are less likely to be clueless users who click on random links sent to them or rush to "confirm their citibank information" after an email informs them that if they dont, their account will be cancelled. I kind of look at phishing/viruses/worms/hackers as a sort of "digital natural selection" that will slowly weed out the morons. Unfortunately its not able to prevent said morons from reproducing, though.

Well the problem is that the morons are often our parents, grandparents, etc.

 

[DJFuji]

Originally posted by: n7

Originally posted by: DJFuji
in addition to IE's much larger market share, FF users are less likely to be clueless users who click on random links sent to them or rush to "confirm their citibank information" after an email informs them that if they dont, their account will be cancelled. I kind of look at phishing/viruses/worms/hackers as a sort of "digital natural selection" that will slowly weed out the morons. Unfortunately its not able to prevent said morons from reproducing, though.

:laugh:

Beautiful

That's going to be my new sig!

You attributed my statement to paper tiger??