Firefox 0.9.3 false safety

Printable View

October 16th, 2004, 08:33 PM
lepricaun

Firefox 0.9.3 false safety

hi all,

i was doing some investigating on my drive since i am planning to write a program which reads the saved passwords and usernames for Firefox (just like iekey.exe from passware does for Internet Explorer).
but what i have found out is that when you go to "tools","options","privacy" and hit the "clear all" button, nothing is removed! the files which contain the stored history and the "encrypted passwords" still have the same content AFTER pressing that button. you'll have to clear all the options one by one in order to clean your history.

also all interesting data is saved in one and the same folder:
C:\Documents and Settings\<your username>\Application Data\Mozilla\Firefox\Profiles\default.sfp

in this folder there are several interesting files, but one of them is the most interesting: signons.txt. this is the txt file where the url history AND the saved passwords and usernames are stored (although encrypted).

i think the encryption is some kind of base64 form since the encryptions looks a lot like it (but can't be decyphered using base64).

also when you have cleared all data, one by one via the GUI from firefox, this file still contains semi personal data, it is some kind of url history which goes way back in time.
e.a.:

the signons.txt file on my computer contains the following:

Quote:

#2c
http://www.antionline.com
http://www.guidancesoftware.com
http://admin.bbknk.nl
http://ldbreg.lycos.com
http://www.modifiedmemphis.com
http://www.governmentsecurity.org
http://www.programmersheaven.com
http://www.gulftech.org
http://www.hackquest.de
https://piauth.prodigy.net
http://www.hackerslab.org
http://cboard.cprogramming.com
http://www.securstar.com
http://www.cc-cards.net
http://sbcglobal.prodigy.net
http://www.linuxforums.org
http://www.windowsforum.org
http://www.linuxquestions.org
http://www.actorpoint.com
http://217.30.18.106:8080
http://www.codeguru.com
http://members.driverguide.com
http://www.loginmatrix.com
http://www.ps3portal.com
http://www.security-forums.com
http://neworder.box.sk
http://www.asisonline.org
http://gradespeed.hardin.isd.esc4.net:81
http://www.programmingforums.org
.

this file contains entries of sites i haven't visited in about 2 months (and i clear my history etc about 2 times per week)!

i find this a really BAD thing that anyone who can read files on your computer can find out these things so easily even if you think you are safe by clearing your cache, history, passwords etc very often, the file still contains personal data!

so i think i will go for another browser (again), and hope to find one which DOES delete everything if you say so!
October 16th, 2004, 09:29 PM
chsh

This file doesn't exist under PR1.0 that I can see. Out of curiosity, why are you running an older vulnerable version?
October 16th, 2004, 09:32 PM
mmkhan

Yes u r right i have checked the mentioned files and it is disclosing the information that i have cleared from the 'Options' menu. Guys anyone knows that why is this happening that after hitting the 'Clear All' button in 'Options' menu, the information si still ther on the system. :-(
October 16th, 2004, 10:08 PM
lepricaun

Quote:

This file doesn't exist under PR1.0 that I can see. Out of curiosity, why are you running an older vulnerable version?

because i still need to reinstall my system, and haven't bothered getting an updated version yet (i know, not a good thing, but i'm planning on doing it tomorrow!)

but i will try and figure out where the passwords are stored in the latest version too ;)

[EDIT]well, just installed the latest version, and it appears to be solved here, BUT the passwords are still stored in the same file (signons.txt)![/EDIT]
October 17th, 2004, 07:21 AM
SecGod

so i think i will go for another browser (again), and hope to find one which DOES delete everything if you say so!

Avant browser http://www.avantbrowser.com/
October 17th, 2004, 07:35 AM
Soda_Popinsky

SecGod, you seem to be anti Internet Explorer, according to your post here:
http://www.antionline.com/showthread...r=1#post790717

Understand that Avant is just a browser that runs off the IE engine.

It's pretty much the same as running IE, w/ some extra features.
October 17th, 2004, 11:57 AM
lepricaun

then that's not a good option either, since i do not like IE for its lack of safety too..

perhaps i will try opera and see how safe this is ;)
October 17th, 2004, 12:10 PM
MrLinus

Isn't the signons.txt the wallet password storer? That is, you have the browser remember your logins? Isn't that whole process insecure to begin with? I never used it with IE, why would I use it with Firefox in the first place (I use mozilla but same diff in some regards)?

chsh, you're probably like me and don't use it, hence why you can't find it. The process of storing user name, password and other info locally has always been an insecurity and one thing that many (if not all) browser manufacturers enable. That and HTML emails are evil things that software manufacturers developed for the "ease of users" (i.e., lazy users).

So if you don't want to have passwords stored locally, don't use the wallet feature. Problem solved.

Oh.. on a side note, the author of this little tool is trying to create an equivalent for firefox. He seems to agree with you that it is a Base64 (based on an August entry in his blog this year).
October 17th, 2004, 02:31 PM
lepricaun

Quote:

Oh.. on a side note, the author of this little tool is trying to create an equivalent for firefox. He seems to agree with you that it is a Base64 (based on an August entry in his blog this year).

well, it looks like it is base64 encoded, but when i try to decode a string, it doesn't work (also his script doesn't work).

normally i NEVER used stored passwords, but i know of many people who do, so it IS a security issue, and when you can't erase it (although your under the impression that you did), makes it a even bigger security issue.
October 17th, 2004, 02:57 PM
w0ob

Firefox

Firefox is a good browser, Just as good as anyother browser.
I dont think that the problems is in the browser. More likley its how you use the browser and what settings you have.

And remember thats just an oppninion :)

(please mind my spelling english isnt my first language :) )
October 17th, 2004, 03:41 PM
Juridian

Solve all your problems. Learn to write your own browser.
October 17th, 2004, 04:38 PM
w0ob

Juridian:

Quote:

Solve all your problems. Learn to write your own browser.

Well for us unfortunate noobs that isnt the easiest way to get a working browser. :)
That's probobly why this dissussion was opened. If you have the knowledge to write your own browser, you probly wouldn't bother posting in such a thread. :)
October 17th, 2004, 07:02 PM
chsh

Quote:

Originally posted here by MsMittens
Isn't the signons.txt the wallet password storer? That is, you have the browser remember your logins? Isn't that whole process insecure to begin with? I never used it with IE, why would I use it with Firefox in the first place (I use mozilla but same diff in some regards)?

With firefox you can set a master password that will be used to encrypt all the other passwords, so it's SOMEWHAT more secure, but I still wouldn't trust it.

Quote:

chsh, you're probably like me and don't use it, hence why you can't find it. The process of storing user name, password and other info locally has always been an insecurity and one thing that many (if not all) browser manufacturers enable. That and HTML emails are evil things that software manufacturers developed for the "ease of users" (i.e., lazy users).

I know I have at least two stored for news sites, but for everything else I just log in. It could also be an OS thing, I'm on linux.

Quote:

Originally posted here by lepricaun
normally i NEVER used stored passwords, but i know of many people who do, so it IS a security issue, and when you can't erase it (although your under the impression that you did), makes it a even bigger security issue.

Um, you just said yourself firefox PR1.0 fixes the clear thing, so really, what's the problem here? You were using an old browser that had a bug in it (it is beta, ya know), and it's since been fixed. In the future, why not simultaneously file a bug report when you find stuff? If the dev. team doesn't know about it, how are they going to fix it?
October 17th, 2004, 08:45 PM
lepricaun

Quote:

Um, you just said yourself firefox PR1.0 fixes the clear thing, so really, what's the problem here? You were using an old browser that had a bug in it (it is beta, ya know), and it's since been fixed. In the future, why not simultaneously file a bug report when you find stuff? If the dev. team doesn't know about it, how are they going to fix it?

i did report it, but like you said, it's an old version. but the clear thingy isn't the thing i'm worried about, it's the way the passwords are stored. even IE stores them more safely.
and that still is the same in the latest release... and although i haven't been able to get the strings decrypted doesn't say it is secure. anyone with local (or remote) access to your computer could retrieve that file and decrypt it at his own computer in a flash.
October 17th, 2004, 09:16 PM
Vorlin

Quote:

anyone with local (or remote) access to your computer could retrieve that file and decrypt it at his own computer in a flash.

Hehe, good thing for me I have all outside access blocked. As for anyone having "local" access, if I ever saw someone at my PC that wasn't my gf or someone else explicitly trusted, then they'd have a much greater issue than me losing my password.

As stated previously, security is 1 divided by convenience. Online protection is sketchy at best, since every method can be circumvented through one method or another as well as enough time given...

Firefox 1.0PR is a lot better in a lot of areas and also needs a lot of improvement. It's not going to stop me from using it though. A few well-used techniques guarding privacy (aka, no passwords being stored) will hamper subversion...
October 17th, 2004, 09:32 PM
moxnix

Well, I do store some passwords in Firefox. I really don't know why any one would want them though. Seems like a lot of trouble to go through to just get my 'Washington Post', 'AO', and 'gmail' passwords...........that certainly are not valuable.

Any potentially valuable password will not ever be stored in a web browser. I use 'PassWord Safe' to store most all of my passwords, except my online banking password. That is stored only in my head, and in a sealed envelope in my safe. (note I do have online banking cababilities, but have never used it.)
October 17th, 2004, 09:53 PM
ammo

Password managments was redone in PR1.0:

From release notes:

Quote:

# Strong Encryption For Passwords Available

Passwords saved with the Password Manager can now be more easily encrypted with strong encryption by creating a "Master Password". If you create a Master Password, you are prompted once per session to enter the Master Password so that Password Manager can automatically fill in site logins. A useful feature for people who share computers with others and want improved security.
October 17th, 2004, 11:33 PM
chsh

Quote:

Originally posted here by lepricaun
i did report it, but like you said, it's an old version. but the clear thingy isn't the thing i'm worried about, it's the way the passwords are stored. even IE stores them more safely.

Care to elaborate? I'm interested in the differences between the two browsers' approach to this feature.

Quote:

and that still is the same in the latest release... and although i haven't been able to get the strings decrypted doesn't say it is secure. anyone with local (or remote) access to your computer could retrieve that file and decrypt it at his own computer in a flash.

I find that hard to believe since you yourself are having trouble decrypting it. It's not "in a flash". Instead of wildly guessing at what goes on during the encryption/decryption sequence, why not just go get the source?

All that aside however, I still don't get what the issue is. These sorts of features are in and of themselves a tradeoff in security -- regardless of which way you look at it. By telling it to remember your password you are no longer required to gain access to a particular site, only your browser is. I see that as a much larger breach in security than an encrypted file on a drive.
October 18th, 2004, 12:15 AM
Vorlin

One other thing I'd like to mention in comparison to IE's method of safety versus Firefox. How long has IE been out? It wasn't even MS' product and it hasn't changed in over two years. FF has them definitely beat on updates, extensions, themes, and various other areas and I'd put my faith (and have) into a browers that's being updated regularly, has a Security Bounty Program for reporting bugs and exploits, AND allows me to customize it fully...
October 18th, 2004, 12:30 AM
w0ob

Password management and storing passwords in a computer can't ever be safe since all of these methods are based on code written by humans. It is a part of human nature to fail. And sadly we always fail when it comes to important things. And this I would call a fact.
October 18th, 2004, 01:47 AM
devpon

When I go to Saved Password, there is a + in a box, expand and go to View Save Password -> Remove All. Would that not remove the passwords.
October 18th, 2004, 06:43 AM
lepricaun

Quote:

Firefox 1.0PR is a lot better in a lot of areas and also needs a lot of improvement. It's not going to stop me from using it though. A few well-used techniques guarding privacy (aka, no passwords being stored) will hamper subversion...

i also have the latest version running now, but i also never store passwords.

Quote:

Care to elaborate? I'm interested in the differences between the two browsers' approach to this feature.

as soon as i can tell you exactly how they are stored in IE. i have been able to trace it back to the registry, and in such a key, that you can not access with regedit / regedit32.
but even if you have that key, the passwords still aren't stored in plain text.

Quote:

I find that hard to believe since you yourself are having trouble decrypting it. It's not "in a flash". Instead of wildly guessing at what goes on during the encryption/decryption sequence, why not just go get the source?

well, i doubt that it will take long if you have the right encryption method.
and like stated before by MsMittens, i'm not the only one who thinks it is base64, the only difference i can think of is that they've added some other string to the base64 string.

well i'm still searching for the source, but i'm not able to find it, but as soon as i have it, i will go and study it ;)

Quote:

One other thing I'd like to mention in comparison to IE's method of safety versus Firefox. How long has IE been out? It wasn't even MS' product and it hasn't changed in over two years. FF has them definitely beat on updates, extensions, themes, and various other areas and I'd put my faith (and have) into a browers that's being updated regularly, has a Security Bounty Program for reporting bugs and exploits, AND allows me to customize it fully...

i know Firefox is a LOT better then IE, but like i said before, even IE has this done better. for the rest i'll choose FF above IE anytime.

it's not like i hate it, i'm still using it, but i just don't like the way it stores passwords.
October 18th, 2004, 05:03 PM
chsh

Quote:

Originally posted here by lepricaun
as soon as i can tell you exactly how they are stored in IE. i have been able to trace it back to the registry, and in such a key, that you can not access with regedit / regedit32.
but even if you have that key, the passwords still aren't stored in plain text.

How do you know? You don't know how the passwords are stored, you just said so yourself. Is it just me, or is this "I know without knowing" getting a bit silly?
So what, FF doesn't use the registry. The registry isn't exactly a secure thing you know, and it doesn't exist on other platforms. FF went with a cross-platform friendly method of storing their info, they encrypt it, and you are calling it an insecurity? Granted, this started out as a bitch about a bug in FF0.9.3 which really should've just entailed looking up a bug in bugzilla and then finding out you should upgrade, but now it's turned into a whole other deal. Give up the whole "I don't like how firefox does this, it's bad" garbage, and either explain in detail how IE does it better, or quit posting wild assumption.

Quote:

well, i doubt that it will take long if you have the right encryption method.
and like stated before by MsMittens, i'm not the only one who thinks it is base64, the only difference i can think of is that they've added some other string to the base64 string.

well i'm still searching for the source, but i'm not able to find it, but as soon as i have it, i will go and study it ;)

I linked it to you. It's not a painstaking search.

Quote:

i know Firefox is a LOT better then IE, but like i said before, even IE has this done better. for the rest i'll choose FF above IE anytime.

How do you know IE has done it better? Just because it's using "security through obscurity" and hiding somewhere in the registry doesn't make it more secure.
October 18th, 2004, 07:52 PM
lepricaun

Chill off chsh, let's keep this a normal and mature thread.

IE stores the passwords in the registry encrypted and hidden.
YES they are harder to find then the ones FF stores --> conclusion --> IE does a better job IMHO.
is this so hard to grasp?
ok, i don't know exactly how you can retrieve them by IE, but i also don't by FF, still i'm a lot closer to retrieving them from FF then i am from IE. and i've been trying this for IE for about 6 months now (on and off), FF took me 5 minutes to figure out how it works (without the source). and to figure out they haven't done it as good (or even worse then) IE.
October 18th, 2004, 10:29 PM
chsh

Quote:

Originally posted here by lepricaun
Chill off chsh, let's keep this a normal and mature thread.

Since when is asking for you to do some research a sign that I am excited about something, and acting immature? Seems to me that baseless statements are a touch more immature than asking for proof, but hey, to each his own.

Quote:

IE stores the passwords in the registry encrypted and hidden.
YES they are harder to find then the ones FF stores --> conclusion --> IE does a better job IMHO.
is this so hard to grasp?

It is not any more hidden as an app (and a user) can access the registry just as well it can a file.

Quote:

ok, i don't know exactly how you can retrieve them by IE, but i also don't by FF, still i'm a lot closer to retrieving them from FF then i am from IE. and i've been trying this for IE for about 6 months now (on and off), FF took me 5 minutes to figure out how it works (without the source). and to figure out they haven't done it as good (or even worse then) IE.

It's a measure of security through obscurity, it isn't more or less secure, it's simply different. When you can come out and say "I cracked the encryption firefox uses on signons.txt in 12 hours, and the encryption IE uses took much longer", and provide the data to back it up, it will be a meaningful statement. Until then I don't see how you can reliably comment on one or the other. In fact, your notion that simply hiding something in the registry makes it "more secure" than writing it to a file is almost laughable.

By the way, since you've been trying for so long, perhaps you'd be interested in this page, and this one (the result of 2 minutes of googling) that shows that form field entries are stored in: HKEY_CURRENT_USER under Software\Microsoft\InternetExplorer\IntelliForms, or, when there is no current user, it's stored in: HKEY_LOCAL_MACHINE with the same path.
October 19th, 2004, 03:08 AM
!mitationRust

Quote:

Originally posted here by lepricaun

i know Firefox is a LOT better then IE, but like i said before, even IE has this done better. for the rest i'll choose FF above IE anytime.

I don't see why it so hard to lock down IE and run it on a "less privileged" account.
"PS. "experience" = anecdotal evidence, which really has no place in a technical discussion."
October 19th, 2004, 06:18 AM
lepricaun

Quote:

By the way, since you've been trying for so long, perhaps you'd be interested in this page, and this one (the result of 2 minutes of googling) that shows that form field entries are stored in: HKEY_CURRENT_USER under Software\Microsoft\InternetExplorer\IntelliForms, or, when there is no current user, it's stored in: HKEY_LOCAL_MACHINE with the same path.

i know those keys, but i don't think they are stored there.
use RegMon from sysinternals to see what strings IE visits when using the passwords, the above strings aren't touched.

Quote:

Since when is asking for you to do some research a sign that I am excited about something, and acting immature? Seems to me that baseless statements are a touch more immature than asking for proof, but hey, to each his own.

there's nothing wrong for asking for research, it was they way you asked that came over to me as assultive (is this a word?).
but like i said, i DID research, and yes i'm convinced that when i have found out which encryption it is exactly for FF you can crack it within 12 hours, but this also goes for IE so that doesn't say that much.

Quote:

I don't see why it so hard to lock down IE and run it on a "less privileged" account.

this goes for every program, not just IE.

Quote:

PS. "experience" = anecdotal evidence, which really has no place in a technical discussion.

no you right, but unfortunately no one here can tell me more about this subject so i'm all alone here ;)
October 19th, 2004, 07:32 AM
!mitationRust

Quote:

Originally posted here by lepricaun
this goes for every program, not just IE.

Yep, it's a beautiful feature. ;)
October 19th, 2004, 09:11 PM
chsh

Quote:

Originally posted here by lepricaun
i know those keys, but i don't think they are stored there.
use RegMon from sysinternals to see what strings IE visits when using the passwords, the above strings aren't touched.

How about this then: You and I collaborate and research this further, with the goal of determining which way each browser stores the info. I just got an eval copy of XP Pro, so I will load it up tonight, install the latest of both browsers, and then go to some news sites, sign up using dummy account names, and try and store all this crap. You do the same with the browsers, and then we can compare notes. We will have hard data and observations about how each does it, which will be way more valuable than hearsay and guesswork IMO. There may be reasons RegMon might not work, although I'm unsure. I will play with it tonight.
October 20th, 2004, 06:33 AM
lepricaun

i like that idea, one disadvantage tho, i have to work late this week, so my time to spend behind my computer is very limited.

but i will surely try and figure it out ;)

i'll keep you posted too :lol:
October 20th, 2004, 08:33 AM
chsh

Stage 1:
I signed up for a free account at nytimes.com, and said yes in both browsers to remember the password.

Observations:
At least Firefox, and probably IE encrypt both the username and the password.

In Firefox's case, I haven't done any exploration of the encryption method. I will get to it later. For starters, it stored everything in c:\Documents and Settings\<username>\Application Data\Mozilla\Firefox\Profiles\aer7j1o6.default\signons.txt. The info it stored appears thusly in the file:

Quote:

#2c
http://www.antionline.com
.
http://www.nytimes.com
USERID
MDIEEPgAAAAAAAAAAAAAAAAAAAEwFAYIKoZIhvcNAwcECM0Ru06n5UpCBAhw6jd+7Exfjg==
*PASSWORD
MDIEEPgAAAAAAAAAAAAAAAAAAAEwFAYIKoZIhvcNAwcECFKX05abTK1IBAj0HQsw2RFJbQ==
.

Whatever it is using to salt the encryption algorithm generates a consistent first 45 bytes of data, with only the last 25 bytes variable. Interestingly, I used the password and username the same, but it still provided different encryption results (though it does help to explain the similarities, I would venture). This is definitely not a simple base64_encode(), it is definitely encrypted. How, I am not sure, and am going to save for another day, just like I'm going to save playing with the rest of IE for another day. :)

In IE's case, all that is held outside the "Protected System Storage" is the ID for the site, which is stored in:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Intelliforms\SPW as a DWORD called "8[H=?2N=/5BLV #", or "38 5b 48 3d 3f 32 4e 3d 2f 35 42 4c 56 20 23" in hex.

I'll append more on this when I get the opportunity.
October 20th, 2004, 11:45 AM
lepricaun

Nice work, like i said, i'll have to work a lot these days, like i am doing now, but as soon as i have the time i will surely get into it ;)
October 20th, 2004, 04:30 PM
chsh

Stage 1 (continued):
Today I was playing around and I found a utility that will actually just outright display to you all of the information in your Protected Storage area, which is kind of amusing. http://www.nirsoft.net/utils/pspv.html

To understand why it works requires a bit of working knowledge on how the whole Protected Storage bit seems to work. Note: this is based on guesswork, but it is educated guesswork. :) It seems that it uses something of your user credentials (user/pass) to generate a key with which it encrypts a whole bunch of data -- not just autocomplete entries. Other things like private keys, keypairs for remote authentication, etc., are all stuffed in there as well. This is an important thing to understand because it explains why the security around the Protected Storage area should actually be incredibly strong, but is overall rather weak. I say weak because the system is designed such that all of the information you need to decrypt the Protected Storage contents exists on the machine. You can crack a system password given enough time, and once you have that, you have all the contents.
The real problem comes in when you consider that this is provided by Windows itself, and is designed to prevent people from breaking into the system if they steal a copy of the registry off the hard drive. Functionality must be exposed through some API (perhaps the MS Crypto API?) that will allow you to write some of your own data to the Protected Storage.

Unfortunately, what this means is if you can get Windows running as either Administrator or your victim, you can easily run such a tool and break the Protected System Storage -- without having to crack any encryption.
Now, just because I've found such a tool doesn't mean I'm going to stop playing around and seeing how things are encrypted and such. I did say I was going to try and do it manually (under the assumption that the above two cases are NOT possible), and I'm going to stick to that. The next step is to visit MSDN and see what Microsoft has to say about third party developers sticking stuff in there. :)

Guess I forgot to mention: Yes, PSPV worked well for me, it yanked the Autocomplete entry and showed me the username and password. For proof, and since I really don't care about the account, see the attached image. Yes, there was no other stuff, remember, this is a fresh XP install. :)

Edit #2: Well, that didn't take long. 10 seconds for MSDN to return a result for Protected Storage API as a search string.
http://msdn.microsoft.com/library/de...og/ipstore.asp

Edit #3: As a side note, I was grepping around last night for the user/pass from linux, and I found that nytimes.com's signup, when you make an error, includes the passwords on the form page after you've submitted once and generated a problem (ie: not filling out a field that's required). What happened was the browser I signed up there with had a copy of the form page in its cache. Def. not a good looking result for the nytimes.com developers.
October 20th, 2004, 09:00 PM
lepricaun

hi,

i already had the tool pspv.exe and i did try to follow what it does too.
i also have a copy of iekey.exe from passware.
the link above is a demo, but as you can see this program uses a completely different approach then the pspv.exe tool.. (try it with regmon).

i'm working on firefox atm and have run it through w32dasm (took about 10 minutes to disassemble on my centrino 1600mhz, 1gb memory notebook),i wanted to attach the output file, but even in a zip file it still is 16,2 mb's!
i'm now trying to figure out how the encryption works ;)

i'll keep you posted!