Saint_Michael 3 Report post Posted February 18, 2008 (edited) OH NO!!! (sarcasm there) A flaw in the way the Firefox and Opera browsers handle an image file could allow an attacker to see what Web sites a person has visited. The problem concerns how the two browsers handle a ".BMP," or bitmap, image file, according to an advisory written by Gynvael Coldwind of Vexillium.org, who posted a video illustrating the problem. A malicious bitmap file can be created that pulls other information from the browsers' memory. Some of the information that can be captured is random, but at other times could be valuable, the advisory said. "The harvested data contains various information including parts of other Web sites, users' favorites and history and other information," Vexillium.org said. Using the "canvas" HTML (Hypertext Markup Language) tag supported by the browsers, an attacker can capture the data. Then, using JavaScript, the information can be sent to a remote server. The flaw could also crash Firefox. The vulnerability affects Firefox 2.0.0.11 and previous versions of that browser as well as the beta version of Opera 9.50. Although kind of out of date in the sense with firefox since everyone should have upgrade to 2.0.12 by now, but of course I am surprise people would still be working in bitmap files after all this time though; I guess they are still used to this day still. Although stealing information and baiting people with images is a pretty old technique in the computer underground, and so I wouldn't be surprise if people still fell for this one. Since it is rarely used these days. SOURCE Edited February 18, 2008 by Saint_Michael (see edit history) Share this post Link to post Share on other sites
