Firefox phishing vulnerability discovered
Published: 05 Jan 2005 15:30 GMT
A vulnerability in Firefox could make users of the open source browser more likely to fall for phishing scams.
The flaw in Mozilla Firefox 1.0, details of which were published by Secunia on Tuesday, allows malicious hackers to spoof the URL in the download dialog box which pops up when a Firefox user tries to download an item from a Web site. This flaw is caused by the dialog box incorrectly displaying long sub-domains and paths, which can be exploited to conceal the actual source of the download.
Mikko Hyppönen, director of antivirus research at F-Secure, said this bug could make Firefox users vulnerable to cybercriminals. "The most likely way we could see this exploited would be in phishing scams," said Hyppönen.
To fall victim to such a scam, a Firefox user would have to click on a link in an email that pointed to a spoofed Web site and then download malware from the site, which would appear to be downloaded from a legitimate site.
This flaw was given a severity rating of two out of a possible five by Secunia.
David Emm, a senior technology consultant at antivirus company Kaspersky Labs, said it is unlikely that phishers will take advantage of this exploit in Firefox because Microsoft's Internet Explorer still dominates the browser market.
"I think it's unlikely that we'll see hackers rush to exploit this vulnerability," said Emm. "After all, Firefox has a much, much smaller install base than IE and it's likely that hackers will continue to pay more attention to [IE] instead."
This may change in the future as Firefox has attracted a lot of interest in the past few months. A survey at the end of November found that Mozilla-based browsers, including Firefox, accounted for 7.4 percent of browsers in November 2004, up 5 percent from May.
The download vulnerability has been confirmed in Mozilla 1.7.3 for Linux, Mozilla 1.7.5 for Windows, and Mozilla Firefox 1.0. No solution is available at present, but Mozilla developers plan to fix this bug in an upcoming version of the product.
The Secunia advisory and Mozilla bug report are available online.
Did you find this article useful?
101 out of 166 people found this useful
- Share this article:
Full Talkback thread
26 comments
-
A security vulnerability..??? this is a ridicul... Pete Molina -
This article by Ingrid Marson and the opinion... Abe -
Ooooh.. I'm frightened!! I guess I'll switch... Ossama Khayat
-
All I Have To Say Is Firefox Is The Best... Jason -
I agree, Pete, that the vulnerability in Fire... Graeme Wearden
-
Firefox without a doubt, is the best and... Webx -
USE FIREFOX ITS MILES AND MILES AHE... robd
-
Microsoft is waiting for one person to be caught i... The Way
-
Big deal! This is only one problem compared to the... Anonymous
-
If this vulnerability had been identified in IE, t... Anonymous
-
Ouch! 'Users are smart enough to choose their... philbert
-
Lets face it, not everyone out there is a Web... B B
-
I think it's important to put things in conte... Anonymous
-
The simple solution is often the best,JU... Voodoodoctor
-
There is no reason to believe that Firefox is actu... Anonymous
-
Critical mass FUD is the typical reaction of... Arthur B.
-
Firefox will always be more secure than Inter... john_t
-
It doesn't matter at all if only a couple of... Sebastián Benítez
-
Ok, had a quick read of some of these replies... fieldyweb
-
I have to reply to the above comment, be... Webx
-
can't believe it!
But where's the PoC? :) Anonymous
-
Firefox is undoubtedly a better and more secu... Seb
-
I've used Firefox since the Phoenix days. Noone e... Killian
-
I use both Firefox and IE, and while IE is pl... Camper
-
Ok so there is a flaw. So what? How many flaws h... Simon Buckner
-
Nice to see an area in IT where Microsoft doesn't... Bill
