1312836 - browser takeover/denial of service via data URI and HTTP authentication dialog

Status: RESOLVED DUPLICATE of bug 1312243

(Core :: Security, defect)

Description

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Attachment: site image

This has started making the rounds... this site creates a ton of HTTP auth dialogs via iframes, which we display as modal dialogs on Windows.  This locks you entirely out of your browser; you can't even right-click close it on the task bar -- need to kill the process.  They also seem to constantly reload the URL that's requesting the auth, and we queue up each of those auth requests so that you get a constant stream of "Authentication Required" dialogs.  If you wait it out it seems to stop eventually, but only after cancelling a few dialogs.

I've attached the data URI and the decoded contents here.

Sample URL that redirects you to this data URL: hxxp://git.believinghx.bid/?id=KzEgKDg4OCkgMjY0LTg2MTY

Comment 1

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Attachment: takeover.txt

Comment 2

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Attachment: takeover-decoded.txt

Comment 3

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Note -- Chrome is not affected because their auth dialogs are not modal.  Going to the URL returns a different URL on chrome, that just pops up an alert() with spew about "There was a dangerous try blah blah blah".  It keeps popping up the alert() [which is modal, still?!], but you can set "prevent this site from creating additional dialogs" and close the tab.