Firefox users: Beware of Gmail XSS Attack

V

Vertigo Acid

2(-log[H+])4u
Joined
May 31, 2003
Messages
12,410
An exploit for Firefox, reported 10 days ago and as of yet still not patched, is giving attackers access to Google accounts, including gmail.
Firefox users are advised to use NoScript or turn off javacript on unknown webpages and stay logged out of their Google Accounts until a fix is issued.

A 302 redirect error in Google, discovered by bedford.org's Morgan Lowtech aka tx, creates a domain-wide cross-site scripting attack allowing hackers to gain access and modify Google user accounts including e-mails, contact lists and online presence.
Click to expand...
 
I'm glad NoScript is one of the addons I've always had installed since I made the 'switch' to Firefox. One of the essential addons for Firefox, IMO.
 
Noscript? Wouldn't that hurt ad views here? But good on those that allow this site to be exempt.

As for me, I just don't and never have chosen to install even more points of attack into my operating system when I really am better off by having not done so. I'll leave that at that. ;)

Anyway, pretty ironic on what is affecting what here too. And they still havn't fixed it. :D
 
I have been test driving NoScript over the weekend and unlike Adblock which I also run it doesn't improve my browsing experience.

Nearly every site I went to I encountered navigation problems do to Java Script being disabled. It seemed like I needed to white list every site I visited just to get it to work.
 
Lazybones said:
I have been test driving NoScript over the weekend and unlike Adblock which I also run it doesn't improve my browsing experience.

Nearly every site I went to I encountered navigation problems do to Java Script being disabled. It seemed like I needed to white list every site I visited just to get it to work.
Click to expand...

Thats not a problem of NoScript's. Its a problem of the site. Tons of sites use java nowadays. It bugs me. I sometimes use noscript and sometimes not, but I like it better than adblock personally.

I guess it just depends whether you prefer a black list approach or a white list approach.
 
NoScript makes my browsing experience unacceptable. I have no idea how people can stand it.
 
Abu Som3a said:
NoScript makes my browsing experience unacceptable. I have no idea how people can stand it.
Click to expand...

That's how I felt at first, but I got used to it. Now I love it.

Wish I could use it at work.

Really, once you get used to allowing the site access it becomes second nature.
 
StillFunkyB said:
That's how I felt at first, but I got used to it. Now I love it.

Wish I could use it at work.

Really, once you get used to allowing the site access it becomes second nature.
Click to expand...

I tried it again this weekend and agree it is a pain at first to have to let all my main sites I visit have access. Though I can see when you set it all up it works out better, but overall it felt more like a chore than actual help, especially because there are times I visit a site here that has a news story and I want to read it, not worth it to have to keep changing things and having pop ups.
 
Steve said:
what was the original topic of this thread again?
Click to expand...
Firefox has security holes, ,just like IE. Claiming that it is safe is misleading and not true. With its customizability however, firefox remains as the only option for the power user.
 
If I were to use IE for my gmail and FF for everything else would this avoid the exploit?
 
Uh, ok... a few questions?

1) How do you get nailed with this? Only through certain sites? Or just using FireFox in general???

2) What would the "302" error do if you got nailed? Symptoms? I ask because...

...I just got what I think was a "102" error not more than two hours ago in Gmail, problem loading with the server. Though for all I remember now, it could have been the "302" error, but I wasn't redirected anywhere etc. though it was odd.

3) Can this hit you w/o you being aware, and someone potentially has your info and maybe just hasn't done anything with it yet?

4) When they suggest to "stay logged out of your Gmail accounts", does that mean in general, period?

How are you supposed to do that if that's the only email you use?

I have my server's email, but I don't use that for general contact.

Man... if anyone can enlighten me a little further here, I'd appreciate it.
I work from home a lot and have Gmail opened constantly, many different accounts throughout the day and am now worried, especially with the odd error I just got today.
 
Abu Som3a said:
NoScript makes my browsing experience unacceptable. I have no idea how people can stand it.
Click to expand...

That's the price you pay for security. Anyway, it's obvious you didn't even learn to use it properly because you can allow scripts globally and then blacklist sites instead of whitlelist but of course that is the less secure method. I only allow sites to run java that I trust and most others I give temporary java priviledges to, if I site can't function without script then I usually deem it not worth visiting. BTW, even with noscript set to allow globally it still has added protection against known exploits.
 
Abu Som3a said:
Firefox has security holes, ,just like IE. Claiming that it is safe is misleading and not true. With its customizability however, firefox remains as the only option for the power user.
Click to expand...

With noscript it's a lot safer than IE. I know you can disable scripts in IEtoo but in IE it is global and not easily customized. And Firefox is not the only option for the power user, there is also SeaMonkey and Opera.

http://www.seamonkey-project.org/
 
You must log in or register to reply here.
Back
Top