Full Disclosure mailing list archives
Re: New Vulnerability against Firefox/ Major Extensions
From: "Matthew Murphy" <mattmurphy () kc rr com>
Date: Wed, 30 May 2007 10:07:08 -0700
On 5/30/07, Steven Adair <steven () securityzone org> wrote:
We are also at risk from rogue developers, people that have hacked/poisoned your trusted DNS provider, those that have modified your /etc/hosts, /etc/resolv.conf, windows\system32\drivers\etc\hosts (and/or related files), people that have hacked the update server and put there own malicious version there, and the unlocked workstation attack from an attacker with a USB flash drive with a malicious update that might sit down at your workstation and -pwn- you.
Or, more simply, from a brute-force poisoning attack that doesn't involve compromising the trusted DNS provider at all. It's been known for *at least as long as I've been in this business* that DNS is *not* secure, even when both the DNS server and the requesting client are not compromised. There's no significant authentication of the DNS server's reply, so DNS responses can be trivially spoofed by an attacker who knows a window of time wherein you might request the address of a particular host. An example of such a condition: scheduled automatic updates. That just happens to be exactly what is described here. You do the math. This really should have been articulated in the original advisory, IMO. When applications depend on DNS for trust decisions, virtually *every* internet connection is untrusted. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- New Vulnerability against Firefox/ Major Extensions Christopher Soghoian (May 29)
- Re: New Vulnerability against Firefox/ Major Extensions Tim (May 30)
- Re: New Vulnerability against Firefox/ Major Extensions Ferruh Mavituna (May 30)
- Re: New Vulnerability against Firefox/ Major Extensions Steven Adair (May 30)
- Re: New Vulnerability against Firefox/ Major Extensions Matthew Murphy (May 30)
- <Possible follow-ups>
- Re: New Vulnerability against Firefox/ Major Extensions Joey Mengele (May 30)
- Re: New Vulnerability against Firefox/ Major Extensions Dr. Neal Krawetz PhD (May 30)
- Re: New Vulnerability against Firefox/ Major Extensions coderman (May 30)
- Re: New Vulnerability against Firefox/ Major Extensions tx (May 30)
- Re: New Vulnerability against Firefox/ Major Extensions Dr. Neal Krawetz PhD (May 30)
- Re: New Vulnerability against Firefox/ Major Extensions Joey Mengele (May 30)