Popular add-ons to Firefox are the latest criminal attack vector
42081
Blog: Popular add-ons could have their update process hijacked by man-in-the-middle attacks.
648643
This article discusses current trends in penetration testing for web application security, and in particular discusses a framework for selecting the best tool or tools to use for these increasingly common type of application.
420080
An update to Firefox fixes a number of security flaws in the browser.
619489
In the very week Mozilla Firefox Version 1.0 was launched, a series of potentially nasty security holes have been uncovered in older versions of the browser.
108889
It's war out there and the good guys ain't winning Cybercriminals are stepping up their efforts to exploit vulnerabilities in web browsers to spread malware using drive-by download techniques.â¦
141049
(InfoWorld) - Just one day after a security researcher showed how Google'sÂ Firefox toolbar could be exploitedÂ in an online attack, a similar flaw has been discovered in the Google Desktop. On Thursday, Google hacker Robert Hansen posted proof of concept details showing how attackers could use Google Desktop to launch software that had already been installed on the victim's computer. The attack is hard to pull off and could not necessarily be used to install unauthorized software on the victim's PC, but it does illustrate the kind of security issues that arise with Web-based applications, said Hansen, the CEO of Web security consultancy Sectheory.com, and a contributor to the Ha.ckers.org Web site. "When you have third parties writing code that interacts with your browser, it inherently breaks the browser security model," he said. To exploit Hansen's Google Desktop vulnerability, an attacker would first have to launch a successful "man-in-the-middle" attack, somehow placing himself between the victim and Google's servers. This could by done by tricking the victim into logging onto a malicious wireless network, Hansen said. Once this was done, the hacker could launch Hansen's attack by changing the Web pages being delivered to the victim's PC. By returning Web pages that have been doctored with new JavaScript code, the victim could be tricked into clicking onto a malicious link, Hansen said. "When they actually click that mouse button, they're not clicking on the Web page, they're clicking on a link to Google Desktop that actually runs code, " he said. The steps Hansen took to pull off the attack are complex because of the security features that Google has built into its software, he added. "What I've done is combine a lot of different attacks that Google desperately tries to prevent." On Wednesday researcher Christopher Soghoian showed how a man-in-the-middle attack could be used to install malicious software on computers that used a variety of popular Firefox add-ons, including the toolbars from Google, Yahoo, and AOL. Hansen has posted a video showing how this attack could be used to launch Windows HyperTerminal. But it could be used to launch virtually any application that has already been installed on the PC, he said. This isÂ not the first bug in Google Desktop. In February, engineers at WatchfireÂ showed how a flaw in the program's Advanced Search Feature could be used to gain access to data or even run unauthorized software on a victim's computer. Two days after the Watchfire bug was disclosed, Hansen himself showed how attackers couldÂ steal information from Google Desktop usersÂ using what is called an anti-DNS (Domain Name System) pinning attack. Google was not immediately available to comment for this story. Â
435582
Blog: Updates address some critical vulnerabilities in the popular browser.
35770
Attackers continue to use well-worn techniques, such as SQL injection, to exploit holes in popular Web applications but have also moved on to other targets, including government sites, and newer exploit methods, such as cross-site request forgery, according to the latest report filed by the Web Applications Security Consortium.
326735
InfoWorld - Makers of some of the most popular extension software used by the Firefox browser are not doing enough to secure their software, a security researcher said Wednesday.
331142
A few months ago I wrote about Web browser hijacking. It&#39;s a problem a lot of computer users are facing these days. You open your Internet Explorer, but instead of being directed to your homepage, you&#39;re sent to some search engine you&#39;ve never heard of.
492868
TechWeb - A new proof-of-concept code is circulating for a Firefox vulnerability that was fixed in Mozilla's security update that was released last week.
607294
Recently disclosed security holes that affect Internet Explorer 7 and Firefox could let attackers grab data via malicious Web sites.
239180
User-generated Web content is becoming a target for hackers and cross-site scripting attacks on Web sites can lead to malware taking over the browsers of machines that use the sites.
502357
Meanwhile, a second unofficial fix is out as attacks on Internet Explorer users are reportedly increasing.
478309
New plug-in software for browsers aims to help people avoid becoming victims of online fraud.
572892
Four new unpatched vulnerabilities have been published for Internet Explorer and Firefox, with two coming for each browser.
497821
Alternative browser features protection against online scams.