464233 - Security Issue

Status: RESOLVED INCOMPLETE

(Firefox :: Security, defect)

Description

[langlietech]

User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.0.3) Gecko/2008092414 Firefox/3.0.3
Build Identifier: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.0.3) Gecko/2008092414 Firefox/3.0.3

I have been finding a lot of users who use Firefox 3.0.3 and webmail accounts that are receiving mail from themselves w/links from China. These occurrences only happen to people logging on to web accounts, not using computer based mail programs and using Mozilla firefox. Most occurrences are only a month or slightly longer old. I have personally logged onto my gmail account and have found mail to myself as well. Accounts that I have never used webmail interfaces do not get this mail from myself. I do not know for sure the link of the self sent emails are related to firefox, but it seems to be. I would feel a lot better about recommending and using firefox (as I always have) if somebody could check the possibility that this is a problem. I have clients that check webmail with internet explorer, and as yet have not seen the same problem.

Reproducible: Always

Steps to Reproduce:
1.
2.
3.

Comment 1

[Brandon Sterne (:bsterne)]

Unfortunately, there is not a lot of usable information in this report for identifying an actual bug in Firefox.  The report seems to imply that Firefox users are having their webmail accounts compromised but there is not enough data here to support that claim.  Keep in mind that spammers can send email to a webmail user and simply forge the From: address as the same the recipient.  We might want to resolve this as INVALID unless we can get additional information.

Comment 2

[Tyler Downer [He/Him]]

Agreed.
Reporter, please specify what you mean and give details about how this is an issue with Firefox.

Comment 3

[Benjamin Smedberg]

Please reopen if additional information becomes available.

Comment 4

[Daniel Veditz [:dveditz]]

From lines forged to be the recipient are a common feature of both spam and email attacks. Whether you get either tends to be a function of how and where your address has been used. Personally I'm not seeing spam of this sort to my yahoo or gmail webmail addresses, but I do see it on a non-webmail account I've used for years on publicly accessible web sites (such as this one).

Do your Firefox-using and IE-using clients use the _same_ webmail sites? Do they use it in similar ways in terms of where they might give out their email addresses?

There are places that track widespread spam attacks, if you looked up the specific Chinese links in their databases/forums you could probably find out more about those specific spam campaigns and the tactics used. You would almost certainly find they were spread without regard to the victim's browser if you checked a larger sample like that, although if the larger sample repeated your browser-specific results then we'd have something interesting to look into.