442041 - Firefox 3.0 is easily hijacked

Status: VERIFIED INVALID

(Firefox :: Security, defect)

Description

[Mohammed Sayed]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9) Gecko/2008052906 Firefox/3.0
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9) Gecko/2008052906 Firefox/3.0

When I installed Firefox 3.0 after Firefox 2.x it got easily hijacked, but I am not sure about what caused that.

Reproducible: Always

Steps to Reproduce:
1.
2.
3.

Comment 1

[:Gavin Sharp [email: [e-mail]]]

What do you mean by "hijacked"? You'll have to provide more information.

Comment 2

[Dave Garrett]

Do you mean you got a virus or other infection?  (please be vastly more specific)

Go to about:plugins and post your Flash plugin version.  Flash versions prior to 9.0 r124 suffered from an exploit, so it's possible it could be that.  (though, honestly, without more information this is a complete shot in the dark)

Comment 3

[b. satyrc]

8.7.13

FF3 (1.9.0.3071) is being hijacked with a forced display overlaying ad that the user HAS to select "skip this ad" thus identifying the user IP and inserts cookie before one can access the now blocked display.

The FF 'block pop-up windows' is enabled (Tools/Options/Content) with no exceptions listed.

This "skip this ad" forced overlay never happened in FF2.
Wxp pro sp2, Windows firewall enabled.

Shockwave Flash 9.0 r124 and 6.0 r29 are installed.

Comment 4

[Jo Hermans]

(In reply to comment #3)
> 8.7.13
> 
> FF3 (1.9.0.3071) is being hijacked with a forced display overlaying ad that the
> user HAS to select "skip this ad" thus identifying the user IP and inserts
> cookie before one can access the now blocked display.

Can you give an example where this happens ? It's most likely a CSS based 'interstitial', which is not a real popup, and can thus not be blocked by the popup blocker. There is no known method of blocking this content, and probably, there will never be one.

I don't understand why you call this a 'hijack', Firefox is just displaying the content of the page. And you don't leak your IP-address anymore than you did by just downloading the webpage. You can always block the cookie using the normal method (although it will probably prevent you from seeing the page - but that's the decision of the website).

Comment 5

[Dave Garrett]

In no way can knowing your IP be considered something you can expect to hide unless you're using anonymizing proxies.  IP addresses are not private information; for any 2 way communication, both parties need to know eachother's IPs.  This is how the Internet works.  (and a Firewall does not do anything about this fact)

You're either seeing annoying (and hard to block) interstitial ads, stupid Flash overlay ads, or you have unknowingly installed some adware program.  Installing Adblock Plus is the best way to deal with the former.  For the latter, that's all up to you; use something like Spybot Search & Destroy to scan for that junk, and try not to install it in the first place.  (could either be a standalone program or a malicious plugin/extension you installed into Firefox)

You can see if it's some junk you installed into Firefox by going through the standard add-on troubleshooting motions:
http://support.mozilla.com/en-US/kb/Safe+Mode
If it's not there, then it's an extension.  If it is there, try disabling plugins via the add-ons manager.  If you still get it afterwards, it's not installed in Firefox.

In any case, this is now 2 separate vague "hijacked" bug reports and this really should be closed as INCOMPLETE or INVALID at some point.  Essentially, "hijacked" is not a real term here, so please be a lot more specific if you wish to have your problem fixed.

Comment 6

[Tyler Downer [He/Him]]

Closing per comment 5