In what’s being termed a Reverse Cross-Site Request (RCSR) vulnerability by Chapin Information Services (CIS), brought to light after a phishing scam on MySpace, multiple browsers across multiple platforms are vulnerable.

There’s been a lot of hype over the vulnerability in Firefox, mostly from the fanboi’s of a competing browser. This has been called a flaw, a security hole and has even been labeled “Critical” by some. This is not the case. This vulnerability has been classified as “less critical’ by Secunia and “low risk” by FrSIRT. Well, guess what? Firefox is not the only browser vulnerable to this type of attack, Internet Explorer 7, Netscape and Safari are vulnerable as well.

This vulnerability could affect anyone, using FireFox, IE7, Netscape and Safari, visiting a website that allows user-contributed HTML code.

The browser is not directly fooled, by the RCSR exploit. Instead the user is presented with a fake login page that fool’s the browser into providing the UserID and Log-In information. None of these browsers were designed to check the form data before submission.

The risk to the average user is negligible, diligence on the part of the user and this type of exploit is not successful. However, this type of attack can be particularly effective, as the user is presented with a Log-In page very similar to the one they are used to seeing on a website they trust.

The Firefox developers are actively pursuing a fix that will be forth coming in either version 2.0.0.1 or 2.0.0.2. The fix is a bit more problematic than most as it will require changes in the “User Interface”. The fix may not make it into 2.0.0.1 because of this. Earlier versions of Firefox are also affected, it is not clear if a fix is forthcoming for those versions.

Firefox developer discussion at Bugzilla Bug 360493 Cross-Site Forms + Password Manager = Security Failure

Microsoft has acknowledged the vulnerability, but inquires by Chapin Information Services (CIS) have been met with this response from Microsoft.

“We are aware of the issue you reported.” And, “As a matter of policy, we cannot comment on ongoing investigations.”

It may be months before a fix is available for Internet Explorer 7

I have located no official documentation or statements by Apple regarding this vulnerability in Safari.

How to Protect Yourself

- Firefox: Disable the Password Manager.

1.Click on Edit -> Preferences

2.In the Firefox Preferences window, select Security.

3.Make sure the following are unchecked under Passwords:

• Remember passwords for sites

- Internet Explorer 7: Disable ActiveX

• IE > Tools > Internet Options > Security > Trusted Sites
• Change to Custom, scroll down to “Active X controls and plugins” either change to “Prompt” or “Disable”.

- Netscape: Disable the “Automatically Fill Passcard” or “Automatically Log In” option in the preferences of Passcard Manager and always check the URL before invoking it.

- Safari: Disable AutoFill

1. Click on Edit -> Preferences

2. Under AutoFill, make sure the following are unchecked :

• User names and passwords

UPDATED: (30 November 2006)
ADDED: Netscape, as a vulnerable browser
ADDED: Secunia Advisory 23066
ADDED: Secunia Advisory 23108

References:
Phishing potentiality affects Safari, Firefox password storage
CIS Finds Flaws in Firefox v2 Password Manager
Bugzilla Bug 360493 Cross-Site Forms + Password Manager = Security Failure
Firefox, IE Vulnerable to Password Theft
Firefox Password Manager information Disclosure
Internet Explorer 7 “mhtml:” Redirection Information Disclosure
Mozilla Firefox Password Manager Arbitrary Credentials Disclosure Vulnerability
Netscape Passcard Manager Information Disclosure
Safari AutoFill Information Disclosure

Someone had the bright idea of not only mimicking an adware vendors domain, but the names of the files, too. This ruse will make it even more difficult for PC users to work out who actually hijacked their PC in the first place.

read more | digg story

Even though 6 billion emails are sent every day, almost no one agrees about simple things like email etiquette, how to organize a note, or whether emails are considered private or not. The 99 tips in this article make up the best in email practices.

read more | digg story

.htaccess files provides us with ways to make configuration changes on a per-directory basis. This file works well in Apache Web Server and on Linux/Unix. It will not work properly on a windows based system.

read more | digg story

Have you ever had to build a new computer system only to get “stuck” when you are trying to set up your e-mail because you punched in your password four years ago and haven’t got a hot clue what it is? In this article, I outline a step by step process for retrieving these lost passwords. All with free software.

read more | digg story

“Google was recently alerted to a potential security vulnerability affecting users of our Web site. We have since fixed this vulnerability, and all current and future Google.com users are protected,” Tyler says.

Oh-oh, here we go - where does everyone keep their passwords - in their Google inbox of - so now it’s blackhat party time . . .

read more | digg story

Symantec on Wednesday released the public beta of its bundled security suite of software known as Norton 360. The service combines software to protect against viruses, spyware and fraud, as well as data backup and restoration and computer tune-up tools.

read more | digg story

Microsoft is beating Oracle hands down with the security of its database, according to a new report.

Microsoft patched 59 vulnerabilities in its SQL Server 7, 2000 and 2005 databases during the period, while Oracle issued 233 patches for software flaws in its Oracle 8, 9 and 10g databases.

read more | digg story

Looks like we are in to a scary new era of hiding malware?

John Heasman of Next Generation Security Software Ltd is well known for bringing us a research paper on how rootkits could use the Power Management section of a BIOS to hide itself. This paper showed us how rootkits could move away from residing on a users Hard Drive and onto a computer chip on a Motherboard. John has come up with a new research paper entitled “Implementing and Detecting a PCI Rootkit” in which he shows us how to plant a rootkit on a regular device like a Sound Card or Modem plugged onto a computer motherboard.

read more | digg story

Mozilla’s Firefox 2 and Microsoft’s Internet Explorer 7 are vulnerable to a flaw that could allow attackers to steal passwords. Dubbed a reverse cross-site request, or RCSR, vulnerability by its discoverer, Robert Chapin, the flaw lets hackers compromise users’ passwords and usernames by presenting them with a fake login form.

read more | digg story