335680 - able to sniff firefox https sessions under windows

Status: RESOLVED WONTFIX

(Core :: Security: PSM, defect)

Description

[repbug]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.1) Gecko/20060111 Firefox/1.5.0.1
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.1) Gecko/20060111 Firefox/1.5.0.1

I found a tool at

http://www.download3k.com/HTTP-Analyzer/Download-Free-HttpAnalyzerFull.exe.html

that allows you to see the contents of HTTPS sessions under windows. It seems to be hooking into the appropriate windows dll that does the encryption.
I was able to see my unencrypted passwords with it on all https sites I visited with Firefox. If this tool can do it, so can any sophisticated spyware. 
I would suggest that Firefox use a static library to do https encryption instead of a standard windows dll, because this is a big security hole.


Reproducible: Always

Comment 1

[Daniel Veditz [:dveditz]]

No point in the confidential flag I guess, they advertise on their web site that they can sniff Firefox traffic (or any NSS-using app). Support for NSS apps appears to be the main new feature they're promoting on that page, in fact.

This is probably a WONTFIX--I don't think there is any way to prevent hooking arbitrary dll's in windows. We could link Firefox to a static version of NSS if there is such a thing, but if you've already got spyware it wouldn't be hard for it to inject a page-load listener or a network library hook that could do a lot of the same things.

Comment 2

[Nelson Bolyard (seldom reads bugmail)]

Here is a link to the software maker's page
http://www.ieinspector.com/httpanalyzer/index.html

This tool allows an IE (and now fireFox) user to see the http request
they send, and the http response (headers) they get get back, for http 
and for https.  It shows the http request/response info in the same
browser window where the request/response is actually made/displayed.

There's already an extension for FireFox that does this same thing.
It's called livehttpheaders, and nobody thinks its a huge security flaw. 

I don't think this is a bug at all.  I'd say its INVALID or WORKSFORME.
I wonder if we can get the product's developers to contribute to mozilla!

Comment 3

[repbug]

For http it's OK, but I wasn't too thrilled to see my online bank password decrypted :(. As I wrote before, a spyware could easily do the same thing without my knowledge, and send such passwords to its writer.

A third party can obtain sensitive data if I use Firefox (or IE). This sounds like a security hole to me.

(In reply to comment #2)
> Here is a link to the software maker's page
> http://www.ieinspector.com/httpanalyzer/index.html
> 
> This tool allows an IE (and now fireFox) user to see the http request
> they send, and the http response (headers) they get get back, for http 
> and for https.  It shows the http request/response info in the same
> browser window where the request/response is actually made/displayed.
> 
> There's already an extension for FireFox that does this same thing.
> It's called livehttpheaders, and nobody thinks its a huge security flaw. 
> 
> I don't think this is a bug at all.  I'd say its INVALID or WORKSFORME.
> I wonder if we can get the product's developers to contribute to mozilla!
> 

Comment 4

[Gervase Markham [:gerv]]

> A third party can obtain sensitive data if I use Firefox (or IE). This sounds
> like a security hole to me.

That's like saying that the fact that a burglar can unlock your windows from the inside is a flaw in the windows. But it's not, because if he's inside already, then you've already lost. Same here - if someone has privileges to run this code, then you already have a problem.

Gerv

Comment 5

[repbug]

All I'm saying is that Windows isn't too secure because of this possibility to hook dll functions. Sure, this is not a bug or a flaw in Firefox, but if there is a way to close this hole (by not giving unencrypted sensitive data to a subsystem via dll call), why not do it? 
The SSL encryption could also be done by a static library call, and only the encrypted data would be passed to the dll. If this would be done, Firefox could say that it is not vulnerable to these hook attacks that many other apps are under windows.

Back to your burglar analogy, it would be better if the burglar, once inside, could not open any windows to get out, therefore he wouldn't be able to take anything. And even if someway he could get out with your stuff, the company who manufactured the window could say that his product didn't fail you because the burglar wasn't able to get out that way. 

(In reply to comment #4)
> > A third party can obtain sensitive data if I use Firefox (or IE). This sounds
> > like a security hole to me.
> 
> That's like saying that the fact that a burglar can unlock your windows from
> the inside is a flaw in the windows. But it's not, because if he's inside
> already, then you've already lost. Same here - if someone has privileges to run
> this code, then you already have a problem.
> 
> Gerv
> 

Comment 6

[Daniel Veditz [:dveditz]]

(In reply to comment #2)
> It shows the http request/response info in the same
> browser window where the request/response is actually made/displayed.
> There's already an extension for FireFox that does this same thing.

That's one of their products. The other is a separate app that apparently hooks the dll calls. Linking to a static NSS would prevent this. It would not prevent the hypothetical spyware from modifying the browser itself (as in LiveHttpHeaders) nor would it prevent the spyware from installing a keylogger into the OS.

(In reply to comment #5)
> if there is a way to close this hole why not do it?

Because there's no actual gain when there's so many other ways to get the same information.