Feeds

Firefox plans fix for decade-old browsing history leak

'I know where you surfed last summer'

SANS - Survey on application security programs

Firefox developers say they're close to plugging an information leakage hole that has plagued every major browser for more than a decade.

The cascading style sheets history attack makes it easy for web masters to compile vast lists of links visitors have previously viewed. It exploits technology in virtually every browser that causes visited links to be displayed in purple rather than blue. Mozilla has classified the weakness as a bug since at least 2002.

But fixing it has proved to be a vexing problem, largely because programmers didn't know how to close the hole without breaking key web functionality. Many proposed fixes threatened to bring browsers to a crawl or prevent users from knowing whether they had previously visited a website, trade-offs Mozilla, Microsoft and other browser makers have largely considered unacceptable.

Now, Mozilla security team member Sid Stamm says the hole will soon be closed in the open-source browser in a way that won't sacrifice usability. It incorporates technical changes designed to prevent the three most common attacks based on layout, timing and computed style of links.

"A few websites may look a little different, but visited links will still show up differently colored," he wrote here. "A few sites that use more than color to differentiate visited links may look slightly broken at first while they adjust to these changes, but we think it's the right trade-off to be sure we protect our users' privacy." (Additional technical details are here.)

Web application security expert Robert "RSnake" Hansen wasn't nearly as optimistic. In a blog post he said Mozilla's approach only makes it harder to exploit the weakness, rather than eliminating it.

"So let's not pat ourselves on the back too much here - it seems with every hole fixed there's two more that pop up and even when identified they take way too long to fix," he wrote. "I don't mean to harp on the Mozilla guys too much - at least they have a fix in the works. But that doesn't change the fact that we appear to be playing a very losing game of whack a mole."

It's also worth noting that most of the attacks can be eliminated by blocking a site's ability to run Javascript. That means users of the NoScript add-on for Firefox will in many cases be protected against the attack. Then again, it's getting harder and harder to do anything online without Javascript. Any site that has the ability to run code also has the ability to silently pilfer your browsing history.

And that means the changes by Mozilla are a step in the right direction, even if they don't completely eliminate the problem. Stamm has called on other browser makes to follow suit, which would also be a step in the right direction. The Register has placed queries with Google, Microsoft and Opera Software about their plans and will update this article with any responses. ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Arts and crafts store Michaels says 3 million credit cards exposed in breach
Meanwhile, Target investigators prepare for long process in nabbing hackers
prev story

Whitepapers

SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.