Firefox hole *maybe* ?
Page 1 of 2 12 LastLast
Results 1 to 10 of 11

Thread: Firefox hole *maybe* ?

  1. #1
    StOrM™
    Join Date
    Aug 2004
    Posts
    1,003

    Firefox hole, *maybe* ?

    Greeting's

    I am not sure if its a bug but I don't understand why such a *feature* is there (okay it might help improve performance but can also serve as a security weakness). I read two threads on firefox about its prefetch feature. I have *disabled* prefetch in firefox on my system (Although i don't think it hold's much relevance here)

    Anyway I found out that before we click "SAVE", firefox already starts to download the file in background (so even before I have clicked save the file will be placed in temp directory). Now if this can be disabled or is a feature (i don't know why it should be a feature) then please tell me.

    I have conformed this by trying a simple experiment.

    I went to sourceforge.net. There I went to BO2K project (http://sourceforge.net/projects/bo2k/)
    I clicked on download then I selected the latest file (http://sourceforge.net/project/showf...?group_id=4487)
    and then I selected the server closest to me (I also tried with two different random servers but again this information is irrelevant).
    Then the opening (and the file name here) dialog box appears in firefox. ** At this point of time I have NOT clicked save ** but the file is already being downloaded while window is in background. I had a look into my firewall and say that even before clicking "save" the file is being downloaded (because the bytes received counter is going up) just to double check I let the download continue after about 1.3 MB being downloaded my anti virus starts showing automatic clean up and warning message's.

    Once again if this is a feature then please tell me, I didnt know of such a feature.

    Also I have firefox 1.5
    Parth Maniar,
    CISSP, CISM, CISA, SSCP

    *Thank you GOD*

    Greater the Difficulty, SWEETER the Victory.

    Believe in yourself.

  2. #2
    Leftie Linux Lover the_JinX's Avatar
    Join Date
    Nov 2001
    Location
    Beverwijk Netherlands
    Posts
    2,535
    I believe it is a feature..

    And I personally like it

    I also don't see how this is a security hole.. perhaps someone can enlighten me..
    It's a bandwidth hog, but that's all I can think of..
    ASCII stupid question, get a stupid ANSI.
    When in Russia, pet a PETSCII.

    Get your ass over to SLAYRadio the best station for C64 Remixes !

  3. #3
    Just Another Geek
    Join Date
    Jul 2002
    Location
    Rotterdam, Netherlands
    Posts
    3,403
    IIRC IE has the same "feature".
    Oliver's Law:
    Experience is something you don't get until just after you need it.

  4. #4
    Banned
    Join Date
    Apr 2003
    Posts
    1,147
    I'm not sure it is the browser or the background intelligent transfer service in Windows. If you have the service turned on, the browser will make use of it to download files in the background. If you turn it off, I bet you don't get the file until you hit "save."

  5. #5
    AO Curmudgeon rcgreen's Avatar
    Join Date
    Nov 2001
    Posts
    2,716
    It does seem that they are crossing the line of trust
    just to give you the impression of a performance gain.
    You like to think of that last dialog as the place where you
    can safely bail out. What if the file was something potentially
    embarassing or illegal. You were tempted to inquire about it,
    but wisely (you think), decided not to download it. Forensics can
    now prove that you are lying, and you have a copy of the offending file
    on your computer.
    I came in to the world with nothing. I still have most of it.

  6. #6
    StOrM™
    Join Date
    Aug 2004
    Posts
    1,003
    Greeting's

    I'm not sure about BITS being used by other applications except windows update but then I have yet to search. Although I know that prior to SP2 it was set on automatic in both XP home and Pro but after SP2 it has changed to manual in XP pro but home by default is still set on automatic.

    Anyway I'm not sure of how to explain this but the scenario is almost same as what rcgreen said. I had an experience once at friends place with an older version of firefox with javascript on and the site offered a file to download (we never clicked a download link) but just a link to an pop up information, but after few seconds trendmicro started displaying warnings about a trojan file. I'm not sure of what exactly happened but this was the scenario.
    Parth Maniar,
    CISSP, CISM, CISA, SSCP

    *Thank you GOD*

    Greater the Difficulty, SWEETER the Victory.

    Believe in yourself.

  7. #7
    Banned
    Join Date
    Apr 2003
    Posts
    1,147
    Well, it's NOT BITS. I thought it was running on the laptop. Nope. Still get the download without specifically asking for the save. Same behavior in IE as in FireFox. Downloads are very fast, though.

    'Course, I don't get tempted to download things I shouldn't. So, I have nothing to fear ...

    Right?

  8. #8
    i've noticed that before, actually i like it, as often i click to download something, go out the room for an hour or so then realise i have forgot to click ok, but maybe it is a little glitch?

  9. #9
    Ok it is a security hole. Some sites out there(I use linux and surf with firefox so pretty much safe to everything) when you enter them, try to d/l a wmf file onto your comp. In FF the would you like to d/l dialog comes up. so if FF is prefetching... then even if you say no, windows users are going to get hammered by the WMF backdoor, at least thats the way it seems to me. How thorough is FF in cleaning up its pre-fetches that are not okayed by the user?

  10. #10
    StOrM™
    Join Date
    Aug 2004
    Posts
    1,003
    Greeting's

    I think what locked has mentioned is what i wanted to say, there are many site's which offer a file to download automatically which they know will be rejected by advanced user but by the time you decide to click "no" the file if is small enough and you have a fast Internet connection may be downloaded.

    But I have to accept that site's that carry out such activity are not legit at all. Also what rapier57 said is true

    "Course, I don't get tempted to download things I shouldn't. So, I have nothing to fear ..."

    but then what about site's which offer a file to download on their own when you click link to something else. I still find this as a weakness if not an exploit because although prefetch means file being downloaded in background without you clicking save .. but then how much gain can there be. I mean how much time before you say save to a file..
    Parth Maniar,
    CISSP, CISM, CISA, SSCP

    *Thank you GOD*

    Greater the Difficulty, SWEETER the Victory.

    Believe in yourself.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •