1439157 - Web site login feature permits un-closeable pop-up windows [spam exploit]

Status: RESOLVED DUPLICATE of bug 377496

(Core :: Networking: HTTP, defect)

Description

[ga48]

Attachment: Web shortcut + page content (with javascript login exploit that affects Firefox)

Summary: For at least a year now, a malicious hacker has been installing hostile scripts on thousands of vulnerable web sites, which generate an un-closeable pop-up window by continuously prompting for login credentials.

Currently working example URL:
http://in-fact.tk/?number=800-758-2761

Notes:

1) The malicious server presents targeted threats based on user-agent string
2) Server will display innocent content if a valid phone number is not supplied
3) Chrome & Safari are not affected by the "recurring login" exploit
4) Images & web archive files are attached here in case the site goes down

Comment 1

[ga48]

Attachment: Page content sample

Comment 2

[ga48]

Attachment: Login window sample

Comment 3

[ga48]

Component - Core | Networking: HTTP

Comment 4

[(PTO until Jan 6) Valentin Gosu [:valentin] (he/him)]

So, what the page is doing is it has this code at the end <script>window.location.reload();</script>
This is causing it to reload each time you hit cancel on the login popup, which causes the page to load again and show the popup.
I'm really not sure how we'd go about fixing this.

Comment 6

[Honza Bambas (:mayhemer)]

bug 1312243 fixed this only partially, there is a counter bound to the top level inner window id [1] which changes on every reload.  so location.reload() resets that.

I think the way to fix this is to introduce a permission for tld+1 and subdomains that will switch to "disallow" but let user override one time when the number of canceled consecutive auth dialogs reaches some number (3 - 4) for a browser tab/tld+1 combo.


[1] https://bugzilla.mozilla.org/attachment.cgi?id=8819273&action=diff#a/netwerk/protocol/http/HttpChannelChild.cpp_sec3

Comment 7

[ga48]

Related: https://bugzilla.mozilla.org/show_bug.cgi?id=1312243