Download Firefox

Firefox is no longer supported on Windows 8.1 and below.

Please download Firefox ESR (Extended Support Release) to use Firefox.

Firefox is no longer supported on macOS 10.14 and below.

Please download Firefox ESR (Extended Support Release) to use Firefox.

Firefox Privacy Notice

Mozilla Foundation Security Advisory 2005-14

SSL "secure site" indicator spoofing

Announced
February 24, 2005
Reporter
Mook, Doug Turner, Kohei Yoshino, M. Deaudelin
Risk
Moderate
Impact
Moderate
Products
Firefox, Mozilla Suite
Fixed in
  • Firefox 1.0.1
  • Mozilla Suite 1.7.6

Description

Various schemes were reported that could cause the "secure site" lock icon to appear and show certificate details for the wrong site. These could be used by phishers to make their spoofs look more legitimate, particularly in windows that hide the address bar showing the true location.

Mook reports that opening a spoof site that never finishes loading in a window displaying a secure site will continue to show the security indicators of the original site. Kohei Yoshino accomplishes the same result using document.write() to create the spoof in the secure window.

Doug Turner demonstrates that faked security indicators can be turned on for the current window contents by attempting to load content from a non-HTTP server that supports SSL (for example, a mail server). The SSL indicator was set based on the successful SSL handshake despite the failure to load the requested content.

Similarly M. Deaudelin demonstrates that a spoofer could use a URL that returns an HTTP 204 error to set both the SSL icon and update the location while still showing the original content, presumably a spoof.

Workaround

Do not browse trusted sites in the same session as untrusted sites. Do not use or trust links from untrusted sites that "helpfully" link to financial institutions or similar sites with high-value information.

References