Re: Hacking Firefox

2009-05-05 Thread Jan Schejbal
Hi, Let's say I'm a hacker with access to a public kiosk, [...] I then install that version of Firefox on the kiosk. Simple: You should not be able to do that (if the kiosk is correctly configured). If the hacker can install arbitrary code, he could also install a rootkit with a keylogger or

Re: Hacking Firefox

2009-05-05 Thread Gervase Markham
On 04/05/09 20:27, Andrews, Rick wrote: Are there any safeguards in place to prevent this hack from succeeding? Of course not. Code is code - you can make it do anything. It's just ones and zeroes. They could make the hacked version show your evil website while having the URL bar display "htt

Re: Hacking Firefox

2009-05-04 Thread Nelson B Bolyard
Ian G wrote, On 2009-05-04 13:26: > On 4/5/09 22:04, Nelson Bolyard wrote: >> A very similar hack has already been done. It's a Firefox extension >> that (IIRC) silently installs some roots and shows the green bar for >> (some of) the certs that chain up to those roots. See it at >> https://addo

Re: Hacking Firefox

2009-05-04 Thread Ian G
On 4/5/09 22:04, Nelson Bolyard wrote: A very similar hack has already been done. It's a Firefox extension that (IIRC) silently installs some roots and shows the green bar for (some of) the certs that chain up to those roots. See it at https://addons.mozilla.org/en-US/firefox/addon/4828 Nice,

Re: Hacking Firefox

2009-05-04 Thread Nelson Bolyard
On 2009-05-04 12:27, Andrews, Rick wrote: A customer asked this question, and I couldn't answer it. Let's say I'm a hacker with access to a public kiosk, and I want users of that kiosk to see the EV green toolbar when they use the kiosk to visit my hacked web site. My web site is configured with

Re: Hacking Firefox

2009-05-04 Thread Anders Rundgren
Unfortunately the [potential] problem is much bigger than that! A hacked browser and/or operating system can essentially screw the user in all ways possible for a computer. The green bar may lit all the time for example. I would personally be a bit cautious about opening company mail in a publi