Full Disclosure mailing list archives
Re: FFSpy, a firefox malware PoC
From: James Matthews <nytrokiss () gmail com>
Date: Tue, 26 May 2009 10:45:26 +0300
On the iPhone a new app came out called MobileSpy. Designed to secretly record all activity on the iPhone. OMG The iPhone now has spyware etc..... No the user must 1. Jailbreak his phone 2. Download and install the Mobilespy application. Recently a person told me that stupidity is a capital crime. We see that evermore here. These days we are worried about drive-by downloads. Spyware in the form of Mozilla Firefox has been an issue for a while. James On Tue, May 26, 2009 at 9:28 AM, Shell Code <technobuster () gmail com> wrote:
On Wed, May 20, 2009 at 6:12 AM, saphex <saphex () gmail com> wrote:I think this is interesting, http://myf00.net/?p=18 _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/I fail to understand what is new or interesting in this POC. If a person with malicious intent gains so much access to a system that he can put his files or firefox plugins, modify existing files, etc. then he can do anything he wants anyway. This is nothing new. It was well known always that Firefox plugins can also be made to do malicious things such as steal passwords, sniff data before it gets encrypted in SSL, etc. Absolutely nothing new. The same holds true for a user downloading malicious software on his own and running it on his system. It is true that most users don't verify the source code before running. But this is not anything specific to Firefox. This holds true for any open source or closed source software users download. So, again FFSpy sniffing data is nothing new.From the POC it seems that somehow the attacker has to gain physicalaccess to the system or do some social engineering attack to fool the user in installing or modifying his existing plugins. The PoC does not explain how this is done. This is like claiming, "I have found an interesting attack which involves modifying XYZ program or DLL or script on the system that would sniff data and send it to a remote server. I name it ComputerSPY". This is very lame. Of course if you have access to modify or create stuff in the system, you can do anything. Nothing new at all. What is the point of the POC? What is the PoC trying to achieve? Is the POC trying to tell us something that we already don't know? _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
-- http://www.goldwatches.com http://www.jewelerslounge.com
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- FFSpy, a firefox malware PoC saphex (May 19)
- Re: FFSpy, a firefox malware PoC Shell Code (May 25)
- Re: FFSpy, a firefox malware PoC James Matthews (May 26)
- Message not available
- Message not available
- Re: FFSpy, a firefox malware PoC Shell Code (May 26)
- Re: FFSpy, a firefox malware PoC David Blanc (May 26)
- Re: FFSpy, a firefox malware PoC saphex (May 26)
- Re: FFSpy, a firefox malware PoC saphex (May 26)
- Message not available
- Re: FFSpy, a firefox malware PoC Shell Code (May 25)
- <Possible follow-ups>
- Re: FFSpy, a firefox malware PoC FUDder Guy (May 25)
- Message not available
- Re: FFSpy, a firefox malware PoC FUDder Guy (May 25)
- Re: FFSpy, a firefox malware PoC Fosforo (May 25)
- Message not available