Firefox Spyware infects IE?

[xtort]

This is very interesting stuff. I dont doubt that with FF gaining in
market share, that we will see much more of this sort of stuff...

"What if there was an infection out there that could bypass Firefox and
still get its grubby little paws on IE, and from there, the heart of
your OS? What if that same infection could get past not only FF, but a
whole raft of other (supposedly more secure)"

http://www.vitalsecurity.org/2005/03/firefox-spyware-infects-ie.html

best,
xtort
[http://xtort.net]

 

[me]

This is very interesting stuff. I dont doubt that with FF
gaining in market share, that we will see much more of this
sort of stuff...

"What if there was an infection out there that could bypass
Firefox and still get its grubby little paws on IE, and
from there, the heart of your OS? What if that same
infection could get past not only FF, but a whole raft of
other (supposedly more secure)"

http://www.vitalsecurity.org/2005/03/firefox-spyware-infects
-ie.html

best,
xtort
[http://xtort.net]

FWIW, Firefox has been used as "typhoid Mary" since April '04.
Perhaps earlier.

J

 

[xtort]

This is true, but what is interesting about this method is, that
instead of manipulating active x exploits, it uses the non-MS java-re

best,
xtort
[http://xtort.net]

 

[Fuzzy Logic]

This is true, but what is interesting about this method is, that
instead of manipulating active x exploits, it uses the non-MS java-re

best,
xtort
[http://xtort.net]

Next you can expect attacks via 3rd party plugins.

 

[=?ISO-8859-1?Q?=BBQ=AB?=]

This is very interesting stuff. I dont doubt that with FF gaining
in market share, that we will see much more of this sort of
stuff...

"What if there was an infection out there that could bypass
Firefox and still get its grubby little paws on IE, and from
there, the heart of your OS? What if that same infection could get
past not only FF, but a whole raft of other (supposedly more
secure)"

http://www.vitalsecurity.org/2005/03/firefox-spyware-infects-ie.html

"Being a curious soul, I agreed to the install - and quickly wished I
hadn't!"

This after Firefox prompted the user about installing, including the
information that the applet's certificate is invalid /and/ the issuer
is untrusted. I wouldn't call that "bypassing" Firefox or Opera, which
will also prompt the user.

 

[=?ISO-8859-1?Q?=BBQ=AB?=]

Next you can expect attacks via 3rd party plugins.

Heh, isn't Sun's java plugin a third-party plugin?

 

[123]

http://www.vitalsecurity.org/2005/03/firefox-spyware-infects-ie.html

From the above URL: "This is a shot of IE with the infection domain already
added to the 'Restricted Sites' zone in Internet Options."

This is precisely why I prefer FF to IE: there are "zones" to worry about!

Also: "Being a curious soul, I agreed to the install - and quickly wished
I hadn't!"

Serves the idiot right for installing something from an unknown source!

 

[Wald]

This is very interesting stuff. I dont doubt that with FF gaining in
market share, that we will see much more of this sort of stuff...

"What if there was an infection out there that could bypass Firefox and
still get its grubby little paws on IE, and from there, the heart of
your OS? What if that same infection could get past not only FF, but a
whole raft of other (supposedly more secure)"

http://www.vitalsecurity.org/2005/03/firefox-spyware-infects-ie.html

I agree with other posters that the biggest problem here is the author. He
was prompted before the installation, and neglected to verify the origin of
the software.

It's just the same with freeware: you don't just install everything that's
called "install.exe" without knowing what it is and where it came from...

Regards,
Wald

 

[Mel]

This is very interesting stuff. I dont doubt that with FF gaining in
market share, that we will see much more of this sort of stuff...

"What if there was an infection out there that could bypass Firefox and
still get its grubby little paws on IE, and from there, the heart of
your OS? What if that same infection could get past not only FF, but a
whole raft of other (supposedly more secure)"

http://www.vitalsecurity.org/2005/03/firefox-spyware-infects-ie.html

best,
xtort
[http://xtort.net]

It was the user that allowed the infection not the software. A Security
Warning asked for Permission to download and execute an Applet - the
user clicked yes instead of no and infected his own computer.

 

[James Picardat]

No software, no matter how cleverly writen can protect the user from
himself.

Perhaps this thread should have been named Java Applet Infects IE as
this is actually what transpired; no automatic "behind the scenes"
activity occured from within the Firefox browser session.

Using Firefox as a scapegoat for extremely poor judgement on the part of
the user is IMO in bad taste.

This has the smell of Microsoft behind it.

 

[elaich]

his is true, but what is interesting about this method is, that
instead of manipulating active x exploits, it uses the non-MS java-re

No savvy user has Java installed to begin with.

 

[JanC]

»Q« schreef:

"Being a curious soul, I agreed to the install - and quickly wished I
hadn't!"

This after Firefox prompted the user about installing, including the
information that the applet's certificate is invalid /and/ the issuer
is untrusted. I wouldn't call that "bypassing" Firefox or Opera, which
will also prompt the user.

Yeah, sounds more like 'bypassing the user'. ;-)

There is one problem though: it is possible to disable this security
check, and it seems like some semi-popular 'warez download tool' using
such an untrusted applet has provided a how-to for that. :-(

 

[=?ISO-8859-1?Q?=BBQ=AB?=]

Yeah, sounds more like 'bypassing the user'. ;-)

There is one problem though: it is possible to disable this
security check, and it seems like some semi-popular 'warez
download tool' using such an untrusted applet has provided a
how-to for that. :-(

You mean disable the certificate checking or disable the dialog
entirely? I thought there was no way to disable prompting for installs
with Firefox, and I don't see a way to turn off cert checking in the
GUI.

 

[Old Boozer]

It was the user that allowed the infection not the software. A Security
Warning asked for Permission to download and execute an Applet - the
user clicked yes instead of no and infected his own computer.

Like the old porn dialer Trojans the page could be scripted to install
even if you click no! So in the future these scipt kiddy's may do that.
Proxomitron and the support group at Yahoo for this program try
to keep up with these things. Perhaps people should view webpages
the way they want to instead of the way the page author scripts it.
My intention is to alert the group, not the world.

OB.

 

[=?ISO-8859-1?Q?=BBQ=AB?=]

Like the old porn dialer Trojans the page could be scripted to
install even if you click no! So in the future these scipt kiddy's
may do that.

With Firefox, the installer has no control over the dialog box, so it
can't switch the buttons.

 

[elaich]

With Firefox, the installer has no control over the dialog box, so it
can't switch the buttons.

Add one more good reason to use Firefox and dump IE.

 

[JanC]

»Q« schreef:

You mean disable the certificate checking or disable the dialog
entirely? I thought there was no way to disable prompting for installs
with Firefox, and I don't see a way to turn off cert checking in the
GUI.

The certificate checking IIRC, and it was an about:config setting.

 

[Aaron]

From the above URL: "This is a shot of IE with the infection domain
already added to the 'Restricted Sites' zone in Internet Options."

Obviously, if FF is running, the 'Restricted Sites' zone in IE wont be of
any use.

From here, this trival theory is mentioned

"What if there was an infection out there that could bypass Firefox and
still get its grubby little paws on IE, and from there, the heart of
your OS? What if that same infection could get past not only FF, but a
whole raft of other (supposedly more secure)"

If you can "bypass Firefox" you can do lots of things, not merely
infecting IE. Similarly, if I could get bypass IE, I could change
firefox's homepage, but nobody as borthered to do this yet.

Also: "Being a curious soul, I agreed to the install - and quickly
wished I hadn't!"

Serves the idiot right for installing something from an unknown
source!

Heh.

 

[Nobody]

No software, no matter how cleverly writen can protect the user from
himself.

Perhaps this thread should have been named Java Applet Infects IE as
this is actually what transpired; no automatic "behind the scenes"
activity occured from within the Firefox browser session.

Using Firefox as a scapegoat for extremely poor judgement on the part of
the user is IMO in bad taste.

This has the smell of Microsoft behind it.

I doubt very much that Microsoft would do anything of that nature.

Where's the benefit?

Regards, Trevor