Skip to main content

TechWeb | News | IE And Firefox Sport New Zero-day Flaw

Multiple security organizations warned Tuesday that Internet Explorer, Firefox, Mozilla, and SeaMonkey -- on Windows, Linux, and the Mac -- are vulnerable to a JavaScript bug that could allow a determined attacker to dupe users into giving up sensitive personal information such as credit card or bank account numbers and passwords.

According to Symantec, which issued an alert late afternoon Tuesday, all versions of the Microsoft and Mozilla browsers could be used to harvest data through a JavaScript key-filtering vulnerability.

'This issue is triggered by utilizing JavaScript 'OnKeyDown' events to capture and duplicate keystrokes from users,' went the Symantec warning.

The bug would let crafty criminals filter keystrokes entered into a form, say a credit card form to pay for online goods, to an invisible file upload dialog on the same Web page. Once the information's trapped in that hidden dialog -- the vulnerability discoverer used the analogy of the keystrokes 'bouncing' from the legit (or at least legitimate-looking form) to the cloaked one -- the data could be sent to the attacker."

Comments

Popular posts from this blog

Iran: A Rummy Guide

To borrow a phrase used for Iraq, there are 'things we now know we don't know.'Back in June 2002, as the Bush administration started pushing hard for war with Iraq by focusing on fears of the unknown—terrorists and weapons of mass destruction—Secretary of Defense Donald Rumsfeld explained that when it came to gathering intelligence on such threats, "absence of evidence is not evidence of absence." Elaborating, Rumsfeld told a news conference: "There are things we know that we know. There are known unknowns; that is to say there are things that we now know we don't know. But there are also unknown unknowns. There are things we do not know we don't know."Now there's a crisis brewing with Iran. And the same basic problem applies: what is known, what is suspected, what can be only guessed or imagined? Is danger clear and present or vague and distant? Washington is abuzz now, as it was four years ago, with "sources" talking of sanctions…