Tag Info

Hot answers tagged

23

I actually think the Mozilla devs have been pretty smart with this. Historically, most PDF exploits have come from the rendering engine rather than the parsing side. Adobe got wise early to the fact that malformed structure and content would screw them, and put a lot of effort into making sure that their parsing engine was rock solid. If you look at some of ...


19

You cannot assume that an add-on is safe "because it's hosted in one of the official extension galleries". In this answer, I start with the explanation of how extensions end up in the extension galleries for the popular browsers. At the end, I dedicate an extra section to Chrome. How does an item get listed in the official stores? Anyone with Google ...


16

Technically, the popup does not ask you whether you really want to download the file; that decision, you already took when you clicked on the link which triggered the download. The popup asks you what Firefox should do with the file when it has been fully downloaded. Potentially hostile files can be a security issue. Filesystems normally store files as ...


12

I'm guessing that uninstalling IE is impossible or impractical. Go to Control Panel -> Uninstall a program -> Turn Windows features on or off. There you can deselect Internet Explorer. You need to harden IE as well. An application could launch or embed an IE window that could then be used to gain control of the system. Consider this attack: an attacker ...


12

Exploits fall into roughly two distinct categories: those which break the semantic rules of the implementation language (buffer overflows, use-after-free, uncontrolled type casts...) and those which play "by the rules". Since the new PDF reader is written in Javascript, exploits from the first category ought to be extremely rare, because of the intrinsic ...


10

Firefox does not support MHT files without addons. It is possible that you have tricked Firefox into opening each MIME object from the MHT file into a new tab. It is doubtful that this could turn into a security flaw. Update: I confirm that behavior with a valid MHT file. It is a Firefox configuration issue. By default, Firefox will not recognize the ...


10

IMPORTANT: This is in noway a full list of the things you should look for, use this answer as an example, a first step in your path and research on your own. I've had a similar task long time ago. I had to security-wise review the code of a Firefox addon, I'm sure you'll easily find Chrome/other browsers' equivalents. Also have in mind the Extensions in ...


9

There are many scripts and projects to help site owners detect AdBlock Plus, but I think you're interested in how they work. The idea is simple. The website loads a JavaScript file called ads.js (or any other name that AdBlock Plus finds"attractive"), which contains: var amIHere = document.createElement("div"); amIHere.setAttribute("id", "amIHere"); If ...


7

When I tried downloading from https://www.mozilla.org/en-US/firefox/fx/ I was pointed to http://mirrors.coreix.net once, then http://mozilla.mirror.nexicom.net/, then http://mozilla.c3sl.ufpr.br. Whether this is the way Firefox's download page is supposed to work or not, I do not know myself. A more appropriate way to resolve this though, would be to ask: ...


6

In Firefox: Yes, absolutely. Nothing about the Firefox architecture prevents them from doing so. While the passwords are in theory "encrypted" while stored on disk, the decryption key is also stored on disk. Therefore, any software with access to the filesystem will find it trivial to decrypt the stored passwords and access them. (If you don't want to ...


6

To disable it just write about:config in the address bar and search for network.prefetch-next. Set this to false and no pre-downloading should occur. - This does not work on 18.0.2 on Ubuntu or Windows 7, although it is the only method I have found searching the web. I have tried various other settings, nothing worked. It seems that this behavior cannot be ...


6

Whenever you are auditing a new type of application you should look at the other types of vulnerabilities that have been found. A good way of doing this is searching the CVE database. In the case of browser extensions you should look at this Defcon 17 talk: Abusing Firefox Addons. Extensions are given elevated rights, and can be extremely hazardous. In ...


6

Safe Browsing API Google offers Safe Browsing, which uses URL lists as well as heuristics: Safe Browsing works in two ways to help protect you against phishing and malware. First, Google downloads a list of information to your browser about sites that may contain malicious software or engage in phishing. If the URL of the site you're on matches ...


6

There are two issues here which make me say no you can't trust them 100%. Now the reason being is that you haven't reviewed the code on one side. It might contain some malicious code which was slipped in by a rogue developer or intentionally by the organization. For standard organisations this is normally very uncommon, but there have been cases such as ...


5

Firefox isn't “pre-downloading”. You chose to start downloading by selecting “Save Link As” in the menu, or left-clicking on a link whose content type has no internal or external handler. Once Firefox has started downloading, it prompts you for a save location. As long as you haven't entered that location, it downloads the file to a temporary directory ...


5

Yes it's possible, even over ssh and quite trivial to do. Enable X11 forwarding over ssh (e.g., -X option), start firefox, go to Preferences -> Security -> Saved Passwords -> Show Saved Passwords. You could also find them in the relevant files in ~/.mozilla/firefox/{ user_profile } specifically key3.db for the encryption key and signons.sqlite for the ...


5

Email is usually/historically encrypted using PGP or GPG. There are PGP and GPG addons for most common browsers; You will need to generate a key-pair for yourself and follow basic key-management procedures. This is all fairly long-winded to put into an answer on here, but there are some GUIs available that make the process easier, such as GPG4Win. The ...


5

You're protecting two different things. NTFS only provides storage protection. The Firefox master password provides protection in terms of storage, and up to the point of use. Once in use, your filesystem will be decrypted for any application you're running. In contrast, the FF-based encryption will give access to your private key only to FF when it's ...


5

Firefox's Sync is a locally AES-256-CBC encrypted database of your stuff (which can include passwords), stored on Mozilla's servers. The key does not leave your browser. But it can be found in every browser you Sync with. The Sync key is stored locally in your passwords. If you don't have a Firefox Master Password, it's not encrypted on your machine. If ...


5

Read this document. Relevant excerpt (page 3): The Firefox platform has no mechanisms to restrict the privileges of add-ons. The add-on code is fully trusted by Firefox. The installation of malicious add-ons can result in full system compromise. There is no security measure to restrict the intercommunication between add-ons. As a result an add-on ...


4

Maybe it's best to explain the problem with mixed content. A lot of websites will store the login state into the session, and if an attacker has the session-id, he can impersonate the logged in user. The session-id must be sent along with each request, so the server can recognize the user, this will usually be done with a cookie containing the session-id. ...


4

Yes, it does add to security and yes it should be done but security is often neglected over usability. For example the Chrome notification is barely even present as opposed to the firefox popup. More importantly, to actually prevent such a threat the browser must not only notify the average user (who would have no idea what's doing on) but also give the ...


4

The "master password" that Firefox allows you to set, when remembering passwords for sites, is also used to protect the private keys for personal certificates (that is, they are encrypted with a key derived from that master password). Firefox may fail to suggest setting such a password when generating a new key if you instructed it not to use one. Note that ...


4

I can imagine certain conditions for this to become a security issue: The browser downloads the file that triggers a vulnerability in the file browser like the WMF vulnerability A virus scanner might start scanning the partially downloaded file and it could trigger a vulnerability in the scanner. Sophos had some bad press recently. A huge file that is ...


4

Javascript can read password dialogs just like any other field: document.getElementsByName("passwordentry")[0].value so you can certainly have a piece of javascript that checks if the password field has been filled in much faster than humanly possible, as long as the user has javascript enabled.. You may want to implement a proof-of-concept to see how ...


4

Canvas is a feature that allows a website to generate graphics dynamically, at client-side, right in front of your eyes. It is harmless, but there is a process named Canvas Fingerprinting where some Canvas features can be used to obtain detailed information about your Browser, like what your browser is and what exact version, whats your OS, what fonts you ...


4

There is one for Chrome, released mid-last year, called XSS ChEF. Based on some earlier work finding vulnerabilities in Chrome extensions. Unfortunately it doesn't seem to be about finding new vulnerabilities but rather an easier way of exploiting/demonstrating them once you have found one. I haven't used it myself but based on the way it works (it's just ...


4

There are two related but distinct issues here: that Chrome can retrieve passwords without extra authentication, and that it displays them upon request. Both Elliott Kember and Tim Berners-Lee confuse these issues. That Chrome is able to retrieve passwords without prompting the user is inherent in using an operating system facility to store the passwords. ...


4

I believe you misunderstood the Firefox function. Firefox itself is not a mail client, therefore it doesn' provide you with ability to encrypt and/or sign your emails; use Mozzila Thunderbird with Enigmail and OpenPGP plugins if you're looking for this kind of functionallity. Here's nice how to: https://securityinabox.org/en/thunderbird_main The Security ...



Only top voted, non community-wiki answers of a minimum length are eligible