Just remember that even though Firefox tends to be more secure than Internet Exploder – it’s not immune from vulnerabilities (although they do tend to get fixed much much faster).

The latest one that’s cropped up in both Firefox and Chrome is a clickjacking vulnerability. This is basically where a link is replaced by an attacker to lead to a site (which would usually be setup to deliver malware).

You can find the Proof of Concept (PoC) here.

Security researchers have discovered a flaw affecting Google’s Chrome browser that exposes it to “clickjacking”–in which an attacker hijacks a browser’s functions by substituting a legitimate link with one of the attacker’s choice.

Google has acknowledged the flaw and is working toward a patch for Chrome versions 1.0.154.43 and earlier when running within Windows XP SP2 systems, according to SecNiche security researcher Aditya Sood.

Sood disclosed the flaw on Tuesday and has since posted a proof of concept on the Bugtraq vulnerability disclosure forum.

“Attackers can trick users into performing actions which the users never intended to do and there is no way of tracing such actions later, as the user was genuinely authenticated on the other page,” Sood said within the disclosure.

While Google is working on a fix, a representative for the Australian arm of the company pointed out that clickjacking can affect all browsers, not just Chrome.

I’m pretty sure there has been an Internet Explorer Clickjacking bug going around recently too. There was something with IE8 and apparently the ‘fix’ didn’t even help much.

So as always be cautious with what you’re clicking, and if you are super Paranoid just turn off all Javascript.

If you are even more paranoid…just go back to using Lynx on the command line :)

Either way it’s a fairly new brand of vulnerability so I’m sure it will be developed into a more complex and perhaps damaging variation.

However, Nishad Herath, an independent security researcher and CEO of Australian security consultancy Novologica, told ZDNet.com.au that after running Sood’s proof of concept he found that Internet Explorer 8 (release candidate 1 and beta 2 versions) and Opera 9.63 (the latest version) were not exposed to the flaw. But, like Chrome, Firefox 3.0.5 was exposed.

Google’s security researchers had not found any attacks in the wild that exploited the specific vulnerability, said Google’s representative.

Clickjacking is a relatively new browser attack that security researchers Robert Hansen and Jeremiah Grossman gave a talk on it late last year at the Open Web Application Security Project security conference in New York. Such an attack broadly fits within the category of cross-site scripting forgery, where an attacker uses maliciously crafted HTML or JavaScript code to force a victim’s browser to send an HTTP request to a Web site of their choosing.

“Clickjacking means that any interaction you have with a Web site you’re on, for example like clicking on a link, may not do what you expect it to do,” explained Herath.

I’d except Firefox to come out with an updated version pretty soon patched against this vulnerability, I’m not so sure about the release cycle of Chrome but I’d be surprised if Google let this slide.

It’ll be interesting to watch how far this goes.

Source: Cnet (Thanks Navin)

So as most of you probably know the big buzz on the Internet last week was that Google (after supporting Firefox for so long) have actually launched their own browser.

It’s cooled Google Chrome. Now of course in typical Google fashion they call it BETA software, and a number of flaws have popped up during the first couple of days of release.

One cool thing though is that each tab runs it’s own threaded process, so if one tab bombs out it won’t take down your whole browser.

The browser is a move for Google into the online/offline integration they started with Google Desktop, there are more and more online apps (Google Office) that people still want to use offline with a Google made browser this will be possible.

You also have to consider the privacy implications though, if you are also using Gmail…Google will basically know everything you do, even worse if you also use Google Desktop they will know what you have on your computer, what e-mail you send and receive and what you surf on the web.

The German Government has come out and told its citzens NOT to use Google Chrome.

There have been a few flaws released since Chrome came out such as a carpet bombing flaw:

Google’s shiny new Web browser is vulnerable to a carpet-bombing vulnerability that could expose Windows users to malicious hacker attacks.

Just hours after the release of Google Chrome, researcher Aviv Raff discovered that he could combine two vulnerabilities — a flaw in Apple Safari (WebKit) and a Java bug discussed at this year’s Black Hat conference — to trick users into launching executables direct from the new browser.

The PoC is here: http://raffon.net/research/google/chrome/carpet.html

Another is a crash in chrome.dlll.

An issue exists in how chrome behaves with undefined-handlers in chrome.dll version 0.2.149.27. A crash can result without user interaction. When a user is made to visit a malicious link, which has an undefined handler followed by a ‘special’ character, the chrome crashes with a Google Chrome message window “Whoa! Google Chrome has crashed. Restart now?”. It fails in dealing with the POP EBP instruction when pointed out by the EIP register at 0x01002FF4.

The PoC is here: http://evilfingers.com/advisory/google_chrome_poc.php

And a few people have also been complaining that it allows auto-download of executable without a user prompt.

We will be keeping an eye on Google Chrome.