Security researchers claim to have discovered a flaw in the open
source Firefox browser that allows attackers to disable the
browser's anti-phishing filter through a simple change in a site's
URL syntax.
Securiteam,
a security alert site maintained by vendor Beyond Security said that the
trick could allow for pages that already are in Firefox's registry
of known phishing sites to slip past the recognition software and
appear authentic to the user.
Securiteam credited a report by an independent researcher using the
named
kanedaa. The researcher discovered that the phishing filter
would be disabled when an extra 'forward slash' would be entered
after the domain suffix (for instance:
www.vnunet.com//news/).
Normally, Firefox responds to a known forgery page by alerting
users and then redirecting to a search page.
Mozilla, which
oversees development and distribution of the open-source browser,
didn't immediately respond to a request for comment from
vnunet.com.