January 6, 2012
Researchers discovers keylogging threats in Mozilla
Basically, he found a way to turn innocuous Web pages into keyloggers. Mozilla patched the vulnerability in Firefox 9, Thunderbird 9, and SeaMonkey 2.6. Then, as is standard operating procedure, they announced to the public what the threat was and that it had been fixed. But the real threat may lie in what the threat wasn't: it wasn't based in JavaScript.
"The basic premise of my research currently is scriptless attacks, meaning attack vectors working in a post-XSS world," Heiderich said in an e-mail. He defined a "post-XSS" world as one where the cross-site scripting attack had been more or less minimized by technologies like sandboxed iFrames, Mozilla's e-mail client Thunderbird and Firefox's Content Security Policy, the JavaScript blocking browser add-on NoScript, and Windows 8.This particular SVG keylogging attack was quite nasty, said Chris Eng, vice president of research at Veracode, a computer security research firm. "The way [it] works is that [the bad guy] binds the letter "a" to an action that causes the browser to sliently issue a request for http://evil.com/?a. Pressing "b" would trigger the browser to silently issue a request for http://evil.com/?b. By "silently" I mean that there's no visual cues to the user that anything is happening--if you were monitoring the network you would see the requests. As long as the attacker controls evil.com and can access the web server logs, he can piece together what the victim is typing, one character at a time."
"The desired goal was to do keystroke logging in the browser, doing so without necessitating JavaScript, so even if you turned off JavaScript it would work," said Jeremiah Grossman, Chief Technical Officer at computer security research firm White Hat Security. "All the browser developers are fixing cross-site scripting. What half a dozen researchers are exploring is what you can do attack-wise in a browser without JavaScript. They're discovering that there's still quite a lot you can do in the browser."
Eng noted that this kind of problem always erupts whenever new standards are rolled out, especially with "extremely detailed and sometimes difficult to understand" attributes. You don't have to go far to find evidence of this, either. Both Mozilla and Google offer hefty bounties for bug-hunters. Eng both cautioned against screaming that the sky was falling and said that this kind of attack was inherently more interesting to researchers.
As unlikely as Eng said it is for an average browser user to fall victim to these atypical but hard to implement attacks, Heiderich warned that it's not anomalous. "The SVG keylogger is just one example of many, and by far not the most impact ridden one," said Heiderich.One way to minimize the risk from this kind of modern threat is to compartmentalize your risk, he said. "The best way [to protect yourself] is behavior, not product. Whether in Firefox, IE, or Chrome, I would use any one of the major browsers for secure browsing, such as banking or Facebook. For promiscuous browsing, such as news surfing, I use a different browser.
Another factor is that the major browser makers, including Google, Mozilla, Microsoft, Apple, and Opera, are all fairly responsive to fixing these threat vectors when discovered, said Grossman. But that doesn't mean that there aren't steps for the home user to take.
Eng concurred and said that there aren't many defenses against attacks that don't rely on JavaScript. "You usually have to just wait for the browser bugs to be fixed. So my options are more limited--either don't use that browser at all, use a completely separate browser for trusted sites versus untrusted ones, [or] stay off the Internet."
Categories:
Browser,
Cross-Site Scripting (XSS),
Firefox,
JavaScript,
Keylogging
August 29, 2011
5 Superb Mozilla Firefox Secrets !!!
I've tried to dug through Firefox's endless list of features to find you the best, little-known secrets you can start using right now.
1. Customize search with Smart Keywords
A little-known Firefox feature lets you run searches within any given Web site from the browser's address bar. For example, to search for "TouchPad" within Amazon.com, all you'd have to do is type "amazon touchpad" in the Firefox bar.
To create a smart keyword, head to a Web site and locate the search field. Then, right-click the search field and select "Add Keyword for this search...". Create the bookmark, store it in a folder, and your smart keyword is now enabled. Try it with reference sites like Wikipedia and IMDB for quick access to answers.
2. Open multiple Web sites at launch
Who says you can have only one home page? You can set Firefox to open all your favorite Web sites at launch. For example, I'd like Prohackingtricks, Facebook, and Twitter to launch every time I open my browser.
In Firefox, go to Options > General. In the home page field, enter URLs separated by pipes. For example "http://www.prohackingtricks.blogspot.com | http://www.facebook.com | http://...." and so on. Then, hit "OK" and relaunch your browser to see the magic happen.
3. Bookmark an RSS feed
If you check certain Web sites frequently, especially news sites, you can create a bookmark that automatically updates with new stories from that feed. For example, Firefox stocks your toolbar with a "Latest Headlines" bookmark, but you can create your own.
Right-click the Firefox toolbar and select "Customize...". Then, drag and drop the RSS logo to the toolbar. Now, head to the site you want to subscribe to and click the RSS button in the toolbar. Then, enter the name of the bookmark and click "Add".
4. Take your settings on the go
Instead of re-adjusting Firefox--bookmarks, passwords, etc.--every time you use a new computer, take all your accounts and settings on the go. This is done by simply installing Firefox on a portable USB drive, and inserting into any computer you use.
5. Master keyboard shortcuts and mouse gestures
Firefox has built-in shortcuts to help you browse a lot faster. For example, there are shortcuts for rotating through tabs, re-opening a closed tab, and toggling Private Browsing. View the full list here.
Firefox has mouse gestures, too. Although they're not as elegant as Mac OS X gestures, they'll become second-nature after some practice. For example, Shift + scroll down sends you back, and alt+scroll lets you scroll by line.
For advanced gestures--like reloading a page by drawing a circle with your mouse--check out the FireGestures add-on.
I am definitely sure there are still great tips you might know that I've omitted, please do share them in the comments below.
Categories:
Firefox,
Firefox tips,
Mozilla Firefox
August 17, 2011
Mozilla Releases Firefox 6 for Coders
Over the weekend, the open source outfit posted the latest stable version of Firefox to its FTP servers, but the browser wasn't formally released on the web until Tuesday.
Firefox 6 is the second incarnation of the browser released under Mozilla's new quarterly development cycle. Previously, the organization rolled out a new Firefox every eighteen months or so, but then Google upped the ante.
With the latest version, Mozilla says, it has improved the startup time of Panorma, a means of organizing your browser tabs, and it has tweaked the "Awesome Bar" – the Firefox address bar – to make it easier to identify exactly where you are on the web. But the biggest changes are for developers.
Mozilla has added a text editor called Scratchpad that lets developers enter, execute, test, and tweak JavaScript code. The idea to offer an alternative to Firefox's Web Console or the Firebug command line, which are designed around a single-line interface. "Interaction with Scratchpad is quite different. It throws away the 'one line of input gives you a line of output' interaction in favor of a text editor that knows how to run JavaScript," Mozilla says.
But if you prefer the Web Console, Mozilla has updated it as well, improving the auto-complete tool and letting you change where the console is located. In the past, the console was anchored to the top of the browser window, but you can now move it to the bottom or open it in a separate window.
The open source outfit has also added a "Window.matchMedia" API to help developers optimize their site or web app across disparate platforms, and "Prefixed WebSockets" and "server-sent event" APIs, designed to facilitate communication between Firefox and back-end web servers.
Packed with all sorts of additional security and bug fixes, Firefox is available for Windows, Mac, and Linux. You can download it here.
Mozilla also released a new version of Firefox for Android on Tuesday, adding a new welcome screen designed to provide quicker access to various tools, working to improve image rendering, and rolling in a few tools for those building mobile web apps. This includes a "single touch events" API, for detecting screen touches and gestures, and IndexedDB API, which provides local database storage for apps that need to work offline.
The new Firefox for Android is now available from Google's Android Market.
June 22, 2011
Firefox 5 Now Available for Download
That’s a big change from the two years it took to move from Firefox 3.5 to Firefox 4. Firefox 5 is part of Mozilla’s new rapid release development cycle. This cycle, which is more akin to what Google does with its Chrome browser, promises faster, more iterative updates. With any luck, Mozilla expects Firefox to hit version 7 by the end of the year.
Visually, Firefox 5 looks identical to Firefox 4. Everything we said in our Firefox 4 review applies to this release.
Rather than reinventing the wheel, Mozilla has added better support for web standards, fixed some bugs, made performance enhancements and added a few additional code touches.
The big new features, courtesy of the release notes include:
- Support for CSS animations
- Better visibility for the Do-Not-Track header preference
- Improved canvas and JavaScript support
- Better standards support for canvas, HTML5, XHR, MathML and SMIL
- Better tuned HTTP idle connection logic
In my tests, Firefox 5 is fast — even faster than Firefox 4. I also love the more frequent update cycle, because it means that the browser will be more able to support the latest and greatest browser features.
To update to the latest Firefox, click on the “check for updates” button in the “About Firefox” menu. In the comments, let me know your thoughts of the new Firefox and its more frequent release cycle.
June 18, 2011
Firefox 5 Around the Corner: To Be Release Soon
The official release date of Firefox 5 has been set to June 21, which is three days from today. If you do not want to wait until then to play around with the latest stable release of the popular web browser, you can go ahead and download the browser for your language and operating system from the official Mozilla ftp site. As with all releases that appear there, there is a slim chance of last minute bugs that could force Mozilla to pull the release and replace it with another one. If you want to be on the safe side, or want to upgrade or install Firefox 5 in a productive environment, it is better to wait until the official release announcement.
So what’s new in Firefox 5? The release notes list the following new features and changes:
- Added support for CSS animations
- The Do-Not-Track header preference has been moved to increase discoverability
- Improved canvas, JavaScript, memory, and networking performance
- Improved standards support for HTML5, XHR, MathML, SMIL, and canvas
- Improved spell checking for some locales
- Improved desktop environment integration for Linux users
- WebGL content can no longer load cross-domain textures
- Background tabs have setTimeout and setInterval clamped to 1000ms to improve performance
- The Firefox development channel switcher introduced in previous Firefox Beta updates has been removed
It should be noted that Firefox 5 introduces HTTP Transaction sorting by CWND which can improve page loading times considerably. See Firefox 5 Gets Faster Connections, Up Next: Memory Improvements for an in depths review and explanation of that feature.
The do not head tracker preference has been moved to the Privacy tab to get more exposure. Users can activate it to send a “do not track” request to each website they open in Firefox.
Interested users can access the complete list of bugs fixed in Firefox 5 here. Each entry links to Bugzilla where additional information can be found.
The latest version of Firefox 5 can be downloaded from the official Mozilla ftp server. It is likely that most Firefox release mirrors will offer the new version on their servers as well.
Next in line is Firefox 6, which will be released in about three months time.
Categories:
Firefox,
Firefox 5,
Firefox Release,
Mozilla Firefox,
software
June 13, 2011
Firefox 5 Gets Faster Connections, Up Next: Memory Improvements
Firefox 5 is a week away from being released as a final version. The browser is expected to be released as final on June 21. When you look at the changelog you will notice quite a few under the hood improvements that have not been talked about yet. HTTP Transactions sorted by CWND is one of those features. Most users probably wouldn’t associate a faster browser with that feature in particular, but the explanation on the Bugzilla site might change that.
What really distinguishes different connections to the same server is the size of the sending congestion window (CWND) on the server. If the window is large enough to support the next response document then it can all be transferred (by definition) in 1 RTT.It basically means that Firefox may load resources faster if connection handling and priorities are changed.
I’ve done an experiment to show the best case – a link to a 25KB resource off of a page that contains a mixture of small and large content. In both cases the 25KB resource is loaded with an idle persistent connection. In the historic case it reuses a connection that had loaded a small image previously and it takes 3RTT (793ms) to transfer it.. in the case of sorting by cwnd the window is large enough to accommodate the entire resource and it is all complete in 1 RTT (363ms). Cool!Even better, the worst case scenario is the status quo of Firefox 4. Users who are interested in a longer, more technical explanation, can visit the Bitsup blog for a taste of that.
Firefox 4 transfer
Firefox 5 transfer
The guys over at HTTPWatch have tested the new feature and found the “the performance benefit [to be] substantial”.
In other news: Firefox has a bad reputation for excessive memory usage, and related to this slow downs especially on startup or when closing the browser window. While that is certainly not the perception of all Firefox users, many perceive Firefox as a browser that uses to much memory.
The MemShrink project aims to optimize Firefox’s memory consumption. The developers list speed, stability and perception as the three core benefits of optimizing the memory usage of the Mozilla Firefox web browser.
The project members will analyze memory leak reports and prioritize them based on numbers of affected users and their default priority.
The developers have created a new website called Are We Slim Yet which tracks the process of cutting down on Firefox’s memory usage.
If things go forward as planned, we might see considerable memory footprint reductions in coming versions of the browser.
Subscribe to:
Posts (Atom)