Firefox Vulnerable To Password-Stealing Attack

[Nomad559]

http://www.macworld.com/news/2006/11/22/firefox/index.php

A flaw in Mozilla’s Firefox browser makes it easy for cybercriminals to steal user information on Web sites where users create their own pages, such as MySpace.com.

The flaw lies in Firefox’s Password Manager software, which can be tricked into sending password information to an attacker’s Web site, said Robert Chapin, president of Chapin Information Services. For this attack to work, attackers need to be able to create HTML (Hypertext Markup Language) forms on the Web site, something that is allowed on blogging and social networking sites.


Microsoft Corp.’s Internet Explorer (IE) is also susceptible to these type of attacks because, like Firefox, it does not ensure that password information is being sent to the same server that requests it, Chapin said.

But IE is less likely to be tricked because it does a more thorough job in checking to see where the log-in form is coming from before it automatically submits password and user information, he added.

:)

[longship]

1. Lesson: Do not log in to phishing attempts.

This is talking about phishing, or as some call it, spoofing. The solution is to *not* log into pages which you are not absolutely sure are the original login page.

The exploit is not operative at any *important* pages, like banks and retail outlets, because users do not have access to put up HTML code on those sites.

The Mozilla people should fix this quickly and post upgrades, though.

[Nomad559]

2. should fix this quickly

Agreed, but from the article ... The attack was used in a MySpace phishing attack reported in late October

I assume the Mozilla people have known about this attack for over three weeks now.

:)