Just remember that even though Firefox tends to be more secure than Internet Exploder – it’s not immune from vulnerabilities (although they do tend to get fixed much much faster).
The latest one that’s cropped up in both Firefox and Chrome is a clickjacking vulnerability. This is basically where a link is replaced by an attacker to lead to a site (which would usually be setup to deliver malware).
You can find the Proof of Concept (PoC) here.
Security researchers have discovered a flaw affecting Google’s Chrome browser that exposes it to “clickjacking”–in which an attacker hijacks a browser’s functions by substituting a legitimate link with one of the attacker’s choice.
Google has acknowledged the flaw and is working toward a patch for Chrome versions 220.127.116.11 and earlier when running within Windows XP SP2 systems, according to SecNiche security researcher Aditya Sood.
Sood disclosed the flaw on Tuesday and has since posted a proof of concept on the Bugtraq vulnerability disclosure forum.
“Attackers can trick users into performing actions which the users never intended to do and there is no way of tracing such actions later, as the user was genuinely authenticated on the other page,” Sood said within the disclosure.
While Google is working on a fix, a representative for the Australian arm of the company pointed out that clickjacking can affect all browsers, not just Chrome.
I’m pretty sure there has been an Internet Explorer Clickjacking bug going around recently too. There was something with IE8 and apparently the ‘fix’ didn’t even help much.
If you are even more paranoid…just go back to using Lynx on the command line :)
Either way it’s a fairly new brand of vulnerability so I’m sure it will be developed into a more complex and perhaps damaging variation.
However, Nishad Herath, an independent security researcher and CEO of Australian security consultancy Novologica, told ZDNet.com.au that after running Sood’s proof of concept he found that Internet Explorer 8 (release candidate 1 and beta 2 versions) and Opera 9.63 (the latest version) were not exposed to the flaw. But, like Chrome, Firefox 3.0.5 was exposed.
Google’s security researchers had not found any attacks in the wild that exploited the specific vulnerability, said Google’s representative.
“Clickjacking means that any interaction you have with a Web site you’re on, for example like clicking on a link, may not do what you expect it to do,” explained Herath.
I’d except Firefox to come out with an updated version pretty soon patched against this vulnerability, I’m not so sure about the release cycle of Chrome but I’d be surprised if Google let this slide.
It’ll be interesting to watch how far this goes.
Source: Cnet (Thanks Navin)
- Flash Zero Day Being Exploited In The Wild
- OpenVAS 7 Released – Open Source Vulnerability Scanner
- Google Leaves Android Users Vulnerable To WebView Exploit
- Mozilla Denies Firefox 3.5 Bug Is Exploitable
- Twitter ClickJacking Vulnerability
- Data Leakage Bug in Mozilla Firefox Confirmed
Most Read in Exploits/Vulnerabilities:
- Learn to use Metasploit – Tutorials, Docs & Videos - 228,946 views
- AJAX: Is your application secure enough? - 119,318 views
- eEye Launches 0-Day Exploit Tracker - 85,161 views