Firefox Browser URL Spoofing Vulnerability

[EA]

(e-mail address removed) typed in

Not just "&". A line in "URL Killfile.txt" can prevent it.

Little harder (more testing) is to avoid false-positives.

J

My suggestion would lead to false positives because there are
legitimate links that use unicode characters (unlikely to be found in
pages from countries that use Roman characters but still....).
That's why I suggested adding a "warning" next to the link instead of
using the killfile. One could then check out the URL if there is
such a warning and determine if it's legit. That should be a rare
situation anyway so false positives would not be a big problem...

Why not just "&"? I might be wrong here but I thought that all
unicode characters have "&" when they are represented as ascii. I
plan to work on a proxo filter on this over the weekend, so if I'm
wrong about the unicode, please correct me....

E.

 

[Guest]

I've written up a brief tutorial on how to set up a proxy.pac file. It
doens't explain everything, but you should be able to just following
the pictures.

http://www.scovettalabs.com/download/IDNWalkthru.pdf

 

[EA]

(e-mail address removed) typed in


My suggestion would lead to false positives because there are
legitimate links that use unicode characters (unlikely to be found
in pages from countries that use Roman characters but still....).
That's why I suggested adding a "warning" next to the link instead
of using the killfile. One could then check out the URL if there
is such a warning and determine if it's legit. That should be a
rare situation anyway so false positives would not be a big
problem...

Why not just "&"? I might be wrong here but I thought that all
unicode characters have "&" when they are represented as ascii. I
plan to work on a proxo filter on this over the weekend, so if I'm
wrong about the unicode, please correct me....

E.

OK...couldn't wait until the weekend

I haven't had the time to test this so I don't know about false
positives or how well it works in general, etc., but it does work on
the page with the vulnerability example. My understanding is that
this spoofing method works by using html equivalents of ascii
characters. These characters need the "&" symbol. The filter issues
an alert message saying that one of the links might be spoofed.
Also, it turns the link into plain text.

Bounds: <a href=*>
Match: *[\&]*
Replace: $ALERT(Mozilla: One or more URLs on this page MIGHT be
spoofed. Please check for false positives.)

If you get alerts on legit pages, then there are too many false
positives and the filter needs more work. I don't see why legit URLs
should have the "&" character but...

E.

 

[Chaos Master]

This is EA for forever:

Bounds: <a href=*>
Match: *[\&]*
Replace: $ALERT(Mozilla: One or more URLs on this page MIGHT be
spoofed. Please check for false positives.)

If you get alerts on legit pages, then there are too many false
positives and the filter needs more work. I don't see why legit URLs
should have the "&" character but...

I've seen pages with URL's like:

http://url.url.url/script.php?parameter1=aaaaa&parameter2=bbbbb

Would this break this rule?

[]s
--
Chaos Master®, posting from Canoas, Rio Grande do Sul, Brazil - 29.55° S
/ 51.11° W / GMT-2h / 15m .

"People told me I can't dress like a fairy.
I say, I'm in a rock band and I can do what the hell I want!"
-- Amy Lee

(My e-mail address isn't read. Please reply to the group!)

 

[EA]

I've seen pages with URL's like:

http://url.url.url/script.php?parameter1=aaaaa&parameter2=bbbbb

Would this break this rule?

The rule should match the "&" character, if it occurs anywhere
between "<a href" and the closing ">" of the link....

After I posted the filter, I did some browsing and I got several
false positives. I'm not sure why. At any rate, the filter needs
more work....

E.

 

[Maxx Pollare]

The voice of "EA" drifted in on the cyber-winds,
from the sea of virtual chaos...

The rule should match the "&" character, if it occurs anywhere
between "<a href" and the closing ">" of the link....

After I posted the filter, I did some browsing and I got several
false positives. I'm not sure why. At any rate, the filter needs
more work....

Try changing the Bounds to something like:

Bounds = "<a href=*/"

Or even shift the catch to the match:

Bounds = "<a\s*>"
Match = "*href=[^/]++\&*"

It should match any link with a "&" between the "href=" & the first "/".

 

[jmatt]

Another way , maybe .

Deepnet Explorer
http://www.deepnetexplorer.com/
Not only is Deepnet Explorer the world’s first browser with RSS news
reader and P2P client integration, it is also the first browser to
foil phishers! With its superior security, functionality and
usability, Deepnet Explorer can dramatically improve your web
experience.
Completely Free No Adware/Spyware No 3rd Party Software
* Posted via http://www.sixfiles.com/forum

 

[schrodinger's cat]

...I don't see why legit URLs
should have the "&" character but...

Here's one legitimate use right off the top of my head: Many search
engines use the ampersand character for conditional statements in
order to narrow a search.

For example here is the URL for the advanced Google search which I use
as the default when searching from the address bar in Firefox:

"http://www.google.com/advanced_search?q=&num=20&hl=en&lr=lang_en&safe=off"

 

[EA]

The voice of "EA" drifted in on the cyber-winds,
from the sea of virtual chaos...

The rule should match the "&" character, if it occurs anywhere
between "<a href" and the closing ">" of the link....

After I posted the filter, I did some browsing and I got several
false positives. I'm not sure why. At any rate, the filter
needs more work....

Try changing the Bounds to something like:

Bounds = "<a href=*/"

Or even shift the catch to the match:

Bounds = "<a\s*>"
Match = "*href=[^/]++\&*"

It should match any link with a "&" between the "href=" & the
first "/".

Thanks!

E.

 

[EA]

Here's one legitimate use right off the top of my head: Many
search engines use the ampersand character for conditional
statements in order to narrow a search.

For example here is the URL for the advanced Google search which I
use as the default when searching from the address bar in Firefox:

"http://www.google.com/advanced_search?q=&num=20&hl=en&lr=lang_en&s
afe=off"

Someone else suggested to limit the bounds up to the first "/" so
that it will only match the top portion of the URL (www.google.com in
your example). That should solve this problem and it will still
match problem links. However, the rules in that suggestion need to
be edited so that they do not match the "//" in "http://" but only
the first "/" in the actual address.

E.

 

[EA]

The voice of "EA" drifted in on the cyber-winds,
from the sea of virtual chaos...

The rule should match the "&" character, if it occurs anywhere
between "<a href" and the closing ">" of the link....

After I posted the filter, I did some browsing and I got several
false positives. I'm not sure why. At any rate, the filter
needs more work....

Try changing the Bounds to something like:

Bounds = "<a href=*/"

Or even shift the catch to the match:

Bounds = "<a\s*>"
Match = "*href=[^/]++\&*"

It should match any link with a "&" between the "href=" & the
first "/".

One more thing:

the filter should not match the "http://" portion of the address.
Also, what if the link does not have the "http://" part (i.e.,
href="www.site.com")? How would you negate "http://" in the match
expression?

E.

 

[Zo]

Just saw this one:

http://www.netsquirrel.com/articles/mozilla_spoofing.html

It does not affect IE, but Moz and FF.

Just saw this fix posted in another newsgroup.

http://users.tns.net/~skingery/weblog/2005/02/permanent-fix-for-shmoo-group-exploit.html

Zo

 

[Mel]

Just saw this fix posted in another newsgroup.

http://users.tns.net/~skingery/weblog/2005/02/permanent-fix-for-shmoo-group-exploit.html

Zo

FWIW: there were 2 instances of \idn-service?1 in Netscapes compreg.dat,
so changed both to 0.

This fix seems to work for "Netscape 7.2" too.

 

[Zo]

Just saw this fix posted in another newsgroup.

http://users.tns.net/~skingery/weblog/2005/02/permanent-fix-for-shmoo-group-exploit.html

It does work in Firefox.

Zo

 

[mike555]

Just saw this one:

http://www.netsquirrel.com/articles/mozilla_spoofing.html

It does not affect IE, but Moz and FF.

=== one might right click and "copy link location" , and paste it into
a non Microsoft product like "Hamsin clipboard" or " QuickPad" to see
what the address really is --- of course this doesn't cure the problem,
but at least you can see it===

 

[John Fitzsimons]

I've written up a brief tutorial on how to set up a proxy.pac file. It
doens't explain everything, but you should be able to just following
the pictures.

http://www.scovettalabs.com/download/IDNWalkthru.pdf

Much better. Thank you.

 

[Iain Cheyne]

Just saw this fix posted in another newsgroup.

http://users.tns.net/~skingery/weblog/2005/02/permanent-fix-for-shmoo-g
roup-exploit.html

There is a simpler and permanent fix using the (awesome) Adblock extension:

http://users.tns.net/~skingery/weblog/2005/02/workaround-for-idn-
spoofing-issue.html

" 1. Install the Adblock Firefox extension.
https://update.mozilla.org/extensions/moreinfo.php?
application=firefox&version=1.0&os=Windows&id=10

2. Look at the Adblock 'Preferences' and go to 'Adblock Options'

3. Tick 'Site Blocking'

4. Add the following filter :-
/[^\x20-\xFF]/

This will block any URL that uses characters outside the normal ASCII
range.


Don't miss step 3! I did the first time and the tip didn't work.

Once you have it in place, go to the test site (http://www.shmoo.com/idn/)
and the links simply don't go anywhere."

 

[Aaron]

No good. I just tried Spoofstick and got the meow page while
Spoofstick was claiming I was at www.paypal.com.

Someone modified it, so it works now

http://www.jarnot.com/mt/archives/2005/02/firefox_spoof_s.php

 

[schrodinger's cat]

There is a simpler and permanent fix using the (awesome) Adblock extension:

http://users.tns.net/~skingery/weblog/2005/02/workaround-for-idn-
spoofing-issue.html

" 1. Install the Adblock Firefox extension.
https://update.mozilla.org/extensions/moreinfo.php?
application=firefox&version=1.0&os=Windows&id=10

2. Look at the Adblock 'Preferences' and go to 'Adblock Options'

3. Tick 'Site Blocking'

4. Add the following filter :-
/[^\x20-\xFF]/

This will block any URL that uses characters outside the normal ASCII
range.

This is great Ian, since I already have Adblock (wouldn't use Firefox
without it). A question on step 4 though. Is the dash after the colon
part of the filter or just an extraneous character? If the dash is not
included you might want to consider removing it from the instructions
on your site, since a colon essentially means "from this point on".
Thanks, good job.

 

[Zo]

There is a simpler and permanent fix using the (awesome) Adblock extension:

http://users.tns.net/~skingery/weblog/2005/02/workaround-for-idn-
spoofing-issue.html

" 1. Install the Adblock Firefox extension.
https://update.mozilla.org/extensions/moreinfo.php?
application=firefox&version=1.0&os=Windows&id=10

http://www.shmoo.com/idn/ --
Iain
Please check www.pricelesswarehome.org, the FAQ and Google Groups before
posting in alt.comp.freeware.

Thanks for the tip, it seems that more fixes are being developed/found daily


Zo