Author Topic: Suspicious Firefox 'double' Master Password request...  (Read 3942 times)

Offline sstbb

  • Normal Members
  • *
  • Posts: 3
Suspicious Firefox 'double' Master Password request...
« on: January 10, 2010, 08:08:05 PM »
I'm running FF 3.5.7 with master passwords turned on - this problem was also with 3.5.6
and perhaps earlier... THIS LOOKS LIKE LOGIN SPOOFING.  Details: When FF is started,
two (2) identical master password request forms/windows are displayed with the first
(#1) directly hidden by the second (#2).  #2 can either have ANY password entered
or NO password entered, then it goes away exposing the #1 password screen which
requires the correct password to continue.  Yes, I know this is the definition of an
infection with something, but I can not find it as of 1 month of searching with
Kaspersky, MSSRT, root-kit removers, Clorox (kidding).  I have removed all
add-on from FF except Java starter and .NET framework assistant.  I do
not want to slick and reinstall without identifying this piece of sh*t.

Anyway Great Ones, what do you suggest?  I'm stumped.

/bill

Offline katala

  • Normal Members
  • *
  • Posts: 9
  • Amateur Cryptographer
Re: Suspicious Firefox 'double' Master Password request...
« Reply #1 on: January 11, 2010, 12:04:52 AM »
Is this action easily duplicated, if so can you send a screen cap, or if its a URL you post the URL of the offending site?  I've not encountered a problem like this.
Thank you.


Kq

Offline sstbb

  • Normal Members
  • *
  • Posts: 3
Re: Suspicious Firefox 'double' Master Password request...
« Reply #2 on: January 11, 2010, 02:33:32 AM »
The symptoms happen upon every start of FireFox - thus completely reproducible.
The second master password screen overlays the usual master password request.
No URL are involved - at least a far as the master password is requested before
any tabs are loaded.  That does not mean the original _infection_ did not come
from an infected website.  A single screen shot is attached showing the top
password request moved off the bottom (standard) password request.

Offline tanstaafl

  • Administrator
  • *****
  • Posts: 1363
Re: Suspicious Firefox 'double' Master Password request...
« Reply #3 on: January 11, 2010, 02:20:20 PM »
Are you using Weave or XMarks (formerly Foxmarks) or any other kind of syncing addon?

http://superuser.com/questions/86096/firefox-requests-the-master-password-twice

Offline sstbb

  • Normal Members
  • *
  • Posts: 3
Re: Suspicious Firefox 'double' Master Password request...
« Reply #4 on: January 11, 2010, 06:56:19 PM »
Solution -  The previous post by tanstaafl  pointed to the URL:

http://superuser.com/questions/86096/firefox-requests-the-master-password-twice

with "a" solution.  Evidently, when FireFox is starting with default to open multiple tabs
and more than one of them has login information under Master Password system control,
then a Master Password is requested for each.  Thus, more than one password request
exactly as I'm seeing displayed.  I've confirmed for my installation by removing all
startup tabs except one.  Solved!

Thanks to Raphink for the following post at the above URL.

     I've had this happen when multiple tabs are opened on startup, and several
    of them require a password. Ganesh's answer seems to be a fix for that one.
                                                                  Raphink Jan 6 at 11:52

While I would not call this a bug, I would call it a VERY POOR instance of
interface design, since it enables confusion for actual LOGIN SPOOFING.

/bill

PasswordMaker Forums

Re: Suspicious Firefox 'double' Master Password request...
« Reply #4 on: January 11, 2010, 06:56:19 PM »

 

anything