IFrames and URL Stringency - Mozilla Firefox Bug

Updated: A relative POC is released HERE

The inline frames play a crucial part in sharing and delivering third party content through them. But this is also a hardened fact that Iframes are used effectively by malware writers to spread infection across domains in a hidden manner. But the question is , Do browsers play significant role in this?

The URL obfuscation is a big stringency in the online world. Actually, it tests the browser efficiency to dissect the behavior of crafted URL. That has to be done. The browsers have shown a rogue behavior in determining the source and destination of URL's when it is obfuscated or fused with meta characters. This is dangerous from a user perspective because a victim can go to undesired destination. Well, lot of changes have been noticed in browser development with respect to that but in certain conditions , browsers still fail to find the authentic nature of URL's being rendered in the browser. A Google Chrome URL Obfuscation Vulnerability can be seen HERE

Further, a recent bug has been posed to BugZilla ID - 570658 regarding the behavior of IFrames and Frames handling the URL obfuscation. Firefox implements a notification alert to user when a obfuscated URL is used in the address bar as follows



On performing analysis of various malware, a bug has been noticed in all version of Firefox which fails to generate an alert when obfuscated URL is being placed in Iframes. In certain cases, it can be used effectively in spreading malware and stealing sensitive information. While discussions on BugZilla, it is noticed that Firefox behavior is completely different in these two scenarios which should not happen. The bug is in open state now. The major improvements can be seen in the following trunk

nsHttpChannel::ConfirmAuth()

A generic POC can be considered as

[iframe src="http://www.example.com@malware.com" width="600" height="600" /];

May be it is considered as a fact that frames are not shown directly but this is a bug by behavior. We can expect some changes in coming time regarding this falsified behavior.

15 comments:

F4t4l said...

I guess it works on IE6 as well?

http://www.impactunlimited.com/frames.asp?url=http://www.google.com

F4t4l said...

sorry..no it doesnt ..MS has another things to worry abt :-D

I was drunk!

Swiss Gaer Backpack said...

but I really
enjoyed the article. It proved to be Very helpful to me and I am sure to all
the commenters here! It’s always nice when you can not only be informed, but
also entertained! I’m sure you had fun writing this article.

debouchage canalisation paris said...

This is really my very first time here, great looking blog. I discovered
so many interesting things inside your blog especially its discussion.

debouchage canalisation paris said...

This is really my very first time here, great looking blog. I discovered
so many interesting things inside your blog especially its discussion.

Zip Repair said...

 That's a best blog.

Ps0ram said...

intresting article and nice blog keep it up

Truth About Abs said...

IFrame should be avoided.I think browser do play
significant role.

Keylogger said...

How to repair Excel files
access password recovery software


This blog is
really very helpful for updating my knowledge...

steve said...

Thanks a lot for sharing this useful and attractive
information pet birds  

casino royale suit said...

One of the biggest challenges that face anyone is justifying what one want to do and why it's going to disrupt the status quo -- whether it be to give opinion or starting a converstaion. It really helps when reading your material insisted on the matter you have highlighted. Fine tunning the concept you discussed will surely bring new opportunities in this area of interest and brings will result something positive. I appreciate your efforts of taking notice of above discussed matter.
Swarovski Evening Bag 
 

Alex edward said...

One of the biggest challenges that face anyone is justifying what one want to do and why it's going to disrupt the status quo -- whether it be to give opinion or starting a converstaion. It really helps when reading your material insisted on the matter you have highlighted. Fine tunning the concept you discussed will surely bring new opportunities in this area of interest and brings will result something positive. I appreciate your efforts of taking notice of above discussed matter.  Sky Fall Stripe Suit

josef said...

Hi
There! siblings loves your striking editorial and pls carry on
adjustable
beds reviews

Andrew Smith said...

It's gracefull to see what i was searching for. That's the material which I was searching about. The matter you've highlighted above is surely valueable for anyone to workout. the concept of your article is very true and It will result in a positive way. Thanks you very much for sharing this with us.

drive
jacket

Life said...

The synopsis must interest the editor in the .....life coach sydney

Post a Comment