what to add a danger to FF and a fix for it
got this from my linux user group e-mail list.
Quote:
I don't remember this coming up in conversation here:
All Gecko- and KHTML-based browsers apparently share a common
vulnerability due to IDN (International Domain Names) functionality.
Because PUNYCODE can be used to "spoof" letters in the standard English
alphabet, and are treated as separate letters from their homographs, a
domain name can be spoofed. This allows a malicious web admin to
create
an entire spoofed website that serves as a phishing mechanism (or some
other nefarious purpose), and the visitor to the site might never wise
up to it.
I've run across three "fixes" for this in Firefox so far.
The first involves going to the "about:config" page and changing the
network.enableIDN value from "true" to "false". This will work until
you restart your browser, at which point it functions as though no
change had been made, and you become vulnerable again. You can change
the setting from "false" to "true" and back to "false" again every time
you restart your browser, if need be. Yes, this bug has been filed
with
bugzilla.
The second involves opening your compreg.dat file and changing all
idn-service values from 1 to 0. There are two such values, as far as I
can tell. I don't know if only one or both is necessary for this fix
to
work, since on this machine it doesn't work at all. It has zero effect
for me.
The third actually works. Thank goodness. For this, you install the
adblock extension for Firefox, turn on site blocking, and add a regular
expression to the list of blocked sites that covers all characters that
might be used in spoofing URLs. I'll go into more detail now:
1. Go to this page: http://cannotlinkto.com/6oq6f
2. Download and install the Adblock extension for Firefox. You may have
to turn on the ability to install software from a website in your
preferences (under "Web Features"). I recommend disabling the software
isntallation feature when you're not actively using it, of course, but
maybe I'm just weird that way.
3. Open the Adblock preferences dialog (Adblock settings are under the
Tools menu).
4. Open "Adblock Options", and check the "Site Blocking" option.
5. Place the following string of characters in the "New Filter" field:
/[^\x20-\xFF]/
6. Click "Add", and confirm that you want to include this regular
expression as a filter. Whether or not you select "I know what I'm
doing" is up to you.
7. Click "Done".
When this is accomplished, IDN-based URL spoofing won't work. There
will
be no error messages: the link will simply not act like a link.
Clicking
on it will accomplish nothing.
I have confirmed that, with multiple Firefox releases, this survives
browser restarts, not only on Linux but on Windows as well.
Let me know if for anyone out there this fails to solve the problem.
I've developed a fair amount of interest in this matter over the last
couple of days.
--
Chad