308278 - Spoofing toolbars with <select><option><img>

Status: RESOLVED DUPLICATE of bug 575294

(Core :: Layout: Form Controls, defect)

Description

[Jesse Ruderman]

Spoofing toolbars with <select><option><img>

I designed this spoof for WinXP Classic, maximized browser window with a screen
width of 1024, no bookmarks toolbar, and no tab bar.  A little tweaking could
make it work with many other configurations.

I noticed this while playing with bug 306663.

Comment 1

[Jesse Ruderman]

Attachment: demo

Comment 2

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Maybe we should limit the allowed size of <option>. Or alternativly ignore all non-text content in them.

I bet you could pull very similar spoofs using xul <menupopup>s

Comment 3

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Come to think of it, this is very hard to actually do anything usefull with. The user has to click on the page to get the dropdown to open, before then the right urlbar will be shown. And even once the urlbar is spoofed it will get unspoofed as soon as the user clicks anywhere where he/she would enter sensitive information.

Comment 4

[Jesse Ruderman]

A click anywhere would dismiss the <select>, but typing would not, and most users enter sensitive information by typing ;)

Comment 5

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

But focus has to be on the <select> during the typing, otherwise the dropdown is closed, no?

Comment 6

[Jesse Ruderman]

It might be tricky for an attacker to make a "*" appear every time you enter another character of your password, but other than that, the spoof works pretty well.

Comment 7

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Hmm.. true.. i didn't think about that. I spoofer could simulate a focused formfield (using images or whatnot) while keeping the focus on the <select>. 

Any ideas for what to do for this then? Seems like a pity to disallow images in <select>, although they work pretty crappily right now.

Comment 8

[Jesse Ruderman]

Forward-duping to David Bloom's bug.  His demo makes it clear this problem is higher-severity than I thought, and the discussion there is better.