- Site menu:
- Latest Discussions
- Latest Newswire
- Archives
- Submit Story
- Story HOWTO
- Syndicate
- E-mail Alerts
Trojan forces Firefox to secretly store passwords
|
|
|
Comments (32)
12 earlier comments in the full thread.
Here's the details of the trojan http://blog.webroot.com/2010/10/06/patchy-phisher-forces-fir...
Thanks, TA, sounds like I don't have to worry.
On the other hand, I'm a bit concerned, all my 'website-passwords' are in Firefox-memory, and I heard it wasn't really secure once. Nonetheless, disabling JavaScript by default on all websites (with NoScript) seems a bit too restrictive in my opinion.
On the other hand, I'm a bit concerned, all my 'website-passwords' are in Firefox-memory, and I heard it wasn't really secure once. Nonetheless, disabling JavaScript by default on all websites (with NoScript) seems a bit too restrictive in my opinion.
What I'm wondering is how the bloke at The H could possibly have tested this Trojan on an version of Ubuntu, let alone 10.04, as he claims.
ta: Seems unlikely, doesn't it?
So it's an *.exe file?!?!
That means unless you are running Linux on top of Windoze (to which I'd ask,... WHY!?!?),... or running firefox for Win as a wine service or virtualized,... there would be essentially no chance of the trojan taking over??? Is that what I'm essentially getting, here???
So once again, it's a Windoze threat, only...
That means unless you are running Linux on top of Windoze (to which I'd ask,... WHY!?!?),... or running firefox for Win as a wine service or virtualized,... there would be essentially no chance of the trojan taking over??? Is that what I'm essentially getting, here???
So once again, it's a Windoze threat, only...
Quoting:or running firefox for Win as a wine service
And probably not even then.
It could be a problem for someone running as root.
It could also be a problem for someone running their own installation of Firefox, in their own home directory, with the necessary $PATH and $LD_LIBRARY_PATH. As the owner of the files, that user can run a program with rights to modify nsLoginManagerPrompter.js.
It could also be a problem for someone running their own installation of Firefox, in their own home directory, with the necessary $PATH and $LD_LIBRARY_PATH. As the owner of the files, that user can run a program with rights to modify nsLoginManagerPrompter.js.
@gus, I'm begining to doubt even that, as the details of the Trojan make it unlikely to be installable on a Linux system.
@tracyanne, take a look at the last 50 lines of Firefox's run-mozilla.sh. That's enough env vars to find it. Notice in the first comment's quote:
Quoting:In tests this worked on Windows XP, Windows 7 and Ubuntu 10.04.
@gus, so how did Mr The H manage to install the Trojan on Ubuntu?
I'm not talking about the binary-executable keylogger; I'm only talking about the danger posed to the nsLoginManagerPrompter.js file. Being root isn't the only way to hit that Firefox file.
Quoting:I'm not talking about the binary-executable keylogger.
You might not be, but Mr The H is
Quoting:The manipulation works on all platforms on which the Trojan has the rights to modify the nsLoginManagerPrompter.js file. In tests this worked on Windows XP, Windows 7 and Ubuntu 10.04.
So my question remains, how did Mr The H manage to install the Trojan on Ubuntu?
Quoting:Being root isn't the only way to hit that Firefox file.
No of course not... if you are silly enough to install and run Firefox from your home directory, then yes it may well be possible for someone to edit that script without your knowledge.
Quoting:You might not be, but Mr The H isNo, they aren't. They are talking specifically about the ability to modify nsLoginManagerPrompter.js. The trojan can accomplish it on Windows, with privileges, and
Quoting:the H's associates at heise Security were able to reproduce the effect of the [trojan's] manipulations...My edit does not change the meaning of the quote. The topic at hand is, what can the trojan accomplish? It can modify a critical Firefox file, with sufficient privileges. My point is that it does not need root privileges, when the file in question is owned by a non-root user running Firefox.
The manipulation works on all platforms on which the Trojan has the rights to modify the nsLoginManagerPrompter.js file. In tests this worked on Windows XP, Windows 7 and Ubuntu 10.04.
This attack is a code injection exploit, pure and simple. What's worse, being JavaScript, the injected code is platform-neutral, and will run on any platform that supports Firefox. After the code is injected, it doesn't really matter what platform it's on; it can tailor its further actions as necessary. That includes downloading a custom binary for the platform, to carry out further attacks against the Firefox browser, or simply installing a huge JavaScript file that gets included into nsLoginManagerPrompter.js the next time FF launches.
If The H releases their Linux-based proof-of-concept code to modify nsLoginManagerPrompter.js to the public, I will join you in calling them stupid. Otherwise, don't expect ever to see it. Only the Firefox security team should ever see this code. In the meantime, I'm not willing to brand The H's team a pack of liars.
Quoting:I'm not willing to brand The H's team a pack of liars.
I am.
Then mail them and ask them.
Not giving them the opportunity to defend themselves against such accusations isn't neat.
Not giving them the opportunity to defend themselves against such accusations isn't neat.
I have Slackware 12.1 and Arch (current as of Sunday last). The nsLoginManagerPrompter.js file is only writeable by "root" on those two distros.
I've only run Ubuntu 7.04 off a Live CD, so I can't speak for Ubuntu of any sort, but for Arch or Slackware, it looks like *if* you surfed as "root", you could have that file modified. Could "The H" be running Firefox as "root" to get the file modification to work?
I've only run Ubuntu 7.04 off a Live CD, so I can't speak for Ubuntu of any sort, but for Arch or Slackware, it looks like *if* you surfed as "root", you could have that file modified. Could "The H" be running Firefox as "root" to get the file modification to work?
I'm running ubuntu 10.04 on my work desktop and I can verify that every instance of that file (one each for firefox, seamonkey, xulrunner and thunderbird) is owned by root, and writeable only by root.
Q.E.D.
Q.E.D.
OK, here's the drum. I've been talking on email with someone from The H
Basically the nsLoginManagerPrompter.js file is as safe and secure on Linux, as it ever was. The only known way for an external attacker to exploit that file is to first get someone local to change the permissions on the file, so that it becomes possible for a script running with local user privileges to modify it. That boils down to someone malicious having direct access to the computer, or social engineering.
Of course Mozilla do need to fix a few security issues related to how Firefox handles javascript code. But that's a slightly different issue.
Basically the nsLoginManagerPrompter.js file is as safe and secure on Linux, as it ever was. The only known way for an external attacker to exploit that file is to first get someone local to change the permissions on the file, so that it becomes possible for a script running with local user privileges to modify it. That boils down to someone malicious having direct access to the computer, or social engineering.
Of course Mozilla do need to fix a few security issues related to how Firefox handles javascript code. But that's a slightly different issue.
Interesting, TA, glad to hear you asked!
There are two other ways one could have mentioned file with user-permissions (as I found three of them on my system:)
1) If you have a version in Wine (but there's not much point in running Firefox through wine), 2) If you're running a beta / development version of Fiefox which you unzipped as a normal user, and not as root.
My conclusion is I shouldn't do 2), and instead chown those files to root.
There are two other ways one could have mentioned file with user-permissions (as I found three of them on my system:)
1) If you have a version in Wine (but there's not much point in running Firefox through wine), 2) If you're running a beta / development version of Fiefox which you unzipped as a normal user, and not as root.
My conclusion is I shouldn't do 2), and instead chown those files to root.
> there's not much point in running Firefox through wine
Not true - some websites still require you to pretend to be running Windows to work correctly. I think it's fixed now, but it used to be that if you wanted access to all of the Thomas and Friends website, you needed to run Windows Firefox and Flash through Wine. Surely you cannot get through the day without Thomas videos.
There are others, but no specific examples are coming to mind at the moment. There may be a bank website in that category (not that I would do such a thing).
Not true - some websites still require you to pretend to be running Windows to work correctly. I think it's fixed now, but it used to be that if you wanted access to all of the Thomas and Friends website, you needed to run Windows Firefox and Flash through Wine. Surely you cannot get through the day without Thomas videos.
There are others, but no specific examples are coming to mind at the moment. There may be a bank website in that category (not that I would do such a thing).
Post a comment
A free account is needed to post. Write your comment here first: your text is kept in this browser while you sign up or log in, and is waiting for you when you come back.
Your message:Markdown: **bold**, *italic*, [text](https://link), - lists, > quotes, $x^2$ for math. Formatting help
Sign up and post (it is free) or Log in and post