Re: Firekeeper - IDS for Firefox available
* Jex <hewhohuntscats@xxxxxxxxx> [2007-03-09 13:27]:
...
> >rules similar to Snort ones to describe browser based attack
> >attempts.
> > All incoming HTTP and HTTPS traffic is scanned with these
> >rules. HTTPS and compressed responses are scanned after
> >decryption/decompression.
So the next snort style overflow/format string/etc bug from all that
string bashing code going on in the ids can now let the attacker
compromise a process with access to my https stream decrypted -
probably on an already convieniently open descriptor. Yeah. Baby.
"Web Browers are Bloated Fscking Monsters that are full of bugs"
"Lets add more code to look for people exploiting the bugs - of
course this code won't have bugs.."
Now maybe I'm a little bit radical, but something tells me
we've learned nothing from the past here kids.
-Bob
--------------------------------------------------------
Church of the Bloated Spaghetti Monster
O O
< B S M > - ( I'd Fly but I'm Bloated with too much Spaghetti)
/ | | | | | | | \
| | | | | | | | |
$ sudo ldd firefox-bin
firefox-bin:
Start End Type Open Ref GrpRef Name
00000000 00000000 exe 1 0 0 firefox-bin
07cb5000 27cc7000 rlib 0 1 0
/usr/local/mozilla-firefox/libmozjs.so.19.0
0d4fa000 2d4fd000 rlib 0 1 0
/usr/local/mozilla-firefox/libxpcom.so.19.0
063ca000 263df000 rlib 0 2 0
/usr/local/mozilla-firefox/libxpcom_core.so.19.0
0a9ec000 2a9f0000 rlib 0 4 0 /usr/local/lib/libplds4.so.18.0
09f33000 29f37000 rlib 0 4 0 /usr/local/lib/libplc4.so.18.0
0e7fc000 2e806000 rlib 0 6 0 /usr/local/lib/libnspr4.so.18.0
0a0c2000 2a17a000 rlib 0 1 0
/usr/local/lib/libgtk-x11-2.0.so.802.1
0bc86000 2bcad000 rlib 0 2 0
/usr/local/lib/libgdk-x11-2.0.so.802.1
0dc27000 2dc2e000 rlib 0 3 0
/usr/local/lib/libgdk_pixbuf-2.0.so.802.1
0a0bb000 2a0bf000 rlib 0 3 0
/usr/local/lib/libpangocairo-1.0.so.1200.3
03652000 23657000 rlib 0 4 0
/usr/local/lib/libpangoft2-1.0.so.1200.3
0fbcb000 2fbe2000 rlib 0 5 0
/usr/local/lib/libpango-1.0.so.1200.3
01d67000 21d70000 rlib 0 2 0
/usr/local/lib/libatk-1.0.so.1011.3
0b5dd000 2b5ea000 rlib 0 8 0
/usr/local/lib/libgobject-2.0.so.1000.3
0e5a5000 2e5a9000 rlib 0 8 0
/usr/local/lib/libgmodule-2.0.so.1000.3
0278f000 227c9000 rlib 0 10 0
/usr/local/lib/libglib-2.0.so.1000.3
06a54000 26a58000 rlib 0 11 0 /usr/local/lib/libintl.so.3.0
02437000 22513000 rlib 0 11 0 /usr/local/lib/libiconv.so.4.0
0bc14000 2bc20000 rlib 0 4 0 /usr/local/lib/libcairo.so.5.0
0ac74000 2ac90000 rlib 0 7 0
/usr/X11R6/lib/libfreetype.so.13.1
05fcf000 25fdf000 rlib 0 6 0
/usr/X11R6/lib/libfontconfig.so.3.0
0d0c2000 2d0c7000 rlib 0 5 0 /usr/local/lib/libglitz.so.2.0
0a5d1000 2a5d8000 rlib 0 5 0 /usr/local/lib/libpng.so.5.1
06fe5000 26fed000 rlib 0 5 0 /usr/lib/libz.so.4.1
00035000 20039000 rlib 0 7 0 /usr/X11R6/lib/libXrender.so.4.1
09d92000 29dde000 rlib 0 12 0 /usr/X11R6/lib/libX11.so.9.0
07e6b000 27e6f000 rlib 0 11 0 /usr/X11R6/lib/libXext.so.9.0
03b3e000 23b45000 rlib 0 12 0 /usr/lib/libm.so.2.3
0ecae000 2ecd4000 rlib 0 1 0 /usr/lib/libstdc++.so.42.0
0704c000 27080000 rlib 0 5 0 /usr/lib/libc.so.40.3
0e93c000 2e945000 rlib 0 1 0 /usr/lib/libpthread.so.7.0
02384000 22388000 rlib 0 4 0 /usr/X11R6/lib/libSM.so.8.0
0f8dc000 2f8e3000 rlib 0 5 0 /usr/X11R6/lib/libICE.so.8.1
0dd4d000 2dd50000 rlib 0 2 0 /usr/X11R6/lib/libXrandr.so.5.0
05396000 2539a000 rlib 0 2 0 /usr/X11R6/lib/libXi.so.9.0
0eb0e000 2eb12000 rlib 0 2 0 /usr/X11R6/lib/libXinerama.so.4.0
0dac4000 2dac8000 rlib 0 2 0 /usr/X11R6/lib/libXcursor.so.3.0
0a9a9000 2a9ac000 rlib 0 3 0 /usr/X11R6/lib/libXfixes.so.4.0
02114000 2211d000 rlib 0 1 0 /usr/X11R6/lib/libexpat.so.5.0
0afd9000 0afd9000 rtld 0 1 0 /usr/libexec/ld.so