540737 - Extream Security Issue this bug might have originated from Google's severs and is now capable of infiltration FF's Security

Status: RESOLVED INVALID

(Firefox :: Security, defect)

Description

[Wyatt Childers]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6

I'm am not sure if this is a Google URL and it is very long but Norton detected this as a high risk network traffic security risk

This is the URL i would NOT NOT NOT Click on it:
google.com.analytics.sbeqpirscun.com/nte/TREST11.html/jH4bbcfe99V0100f026002R0c4218b9108T00eac935Q000002fc900801F002a000aJ11000601L656e2d55530000000000Kc7f7100d6

Reproducible: Didn't try

Steps to Reproduce:
No idea i logged into



IP adress (64.150.187.239, 80)

Comment 1

[Wyatt Childers]

Sorry i forgot to say it was google i logged into

Comment 2

[Tyler Downer [He/Him]]

No, that's not a google url. sbeqpirscun.com
http://www.siteadvisor.com/sites/sbeqpirscun.com/
But, how is this Firefox's fault?

Comment 3

[Wyatt Childers]

The exe that Norton tracked it to was Firefox.exe

Comment 4

[Wyatt Childers]

I have another addition how url get to me i went to google.com and logged in a few minutes later this is here i don't understand

Comment 5

[Matthias Versen [:Matti]]

It's by design of a browser that external links in pages are loaded (css, JS, images etc.)

a) Why should this be a bug in Firefox that it loads the URL ?
b) what kind of security risk is this link ?
c) which page included this a link to this URL ?  

This would be only a security issue in Firefox itself if the page would use an existing security hole in FF. A sign that such a hole exist would be for example a Firefox crash or Virus warnings of dangerous files on the hdd (except the FF cache folder).
The host sbeqpirscun.com is already dead for me and without more information i will mark this bug incomplete

Comment 6

[Wyatt Childers]

I am sorry that i forget if ff did crash. But here is some more info this is listed under the Activity list:
"An intrusion attempt by My PC NAME was blocked. Application path \device\harddiskvolume3\program files (86x)\mozilla firefox\firefox.exe"
That is why i suspected it as a ff bug.

The Risk Name as of Norton's info is "HTTP Neosploit Activity 2"
I hope this helps some

Comment 7

[Tyler Downer [He/Him]]

If norton is giving a false positive, which may have been happening here, then they need to fix that.

Comment 8

[Wyatt Childers]

a false positive

Comment 9

[Matthias Versen [:Matti]]

You may want to read http://community.norton.com/t5/Norton-Internet-Security-Norton/Risk-Name-HTTP-Neosploit-Activity-2/m-p/193798#M96799

This doesn't seem to be a false positive but this would be only a valid bug here if the exploit would use a bug in Firefox.