Dec 23, 2019
Approximately 360,000,000 people use Firefox every single day. 90 % of them or 324,000,000 people use Windows computers. Using a small utility called PasswordFox.exe, I can steal at least 324,000,000 passwords in all of 60 seconds.
This is what happens when a hacker abuses the module - and today, we'll go behind the screen to watch what's really going on.
According to Tim Johnson at the Mcclatchy Washington Bureau,
The average person is registered to **90** online accounts requiring passwords, and the number keeps growing
Not many people are capable of remembering 90 passwords - and our entire online experience depends on access to these accounts. Sounds like a paradox, but no one ever thinks about it, because our browsers, be it Chrome or Firefox save our passwords and do all the work for us. However, because we never think about it, we never stop to ask where those passwords actually are.
You're looking at a screenshot of our trusty partner x64dbg recording Firefox saving my passwords. Highlighted is a call to a function called `PK11_ENCRYPT` that lives in a module called `NS33.dll`. Firefox uses the above-mentioned function to store and encrypt my password. Sounds safe, right?
Above is a recording of Firefox **retrieving** my passwords. As soon as I click "show passwords", a call is made to `PK11_DECRYPT` that decrypts and retrieves your password. Still seems pretty safe right?
`PasswordFox` can (maliciously) use the `PK11_DECRYPT` function the same way Firefox can. There are two screenshots below. One is a recording of Firefox, and one of PasswordFox. Highlighted in both is the same exact call, to the same exact function - you guessed it - `PK11_DECRYPT`.
Operating Systems and many other things in the computing world were designed with trust in mind. Everyone can do everything, because why would anyone want to do anything malicious? In today's world, where huge sums of money stand to be easily made by abusing that naive trust, it doesn't really work.
Firefox can't do anything about it, Microsoft won't do anything about it.
Using sophisticated reverse engineering techniques, Vicarius Topia can identify modules that are likely to suffer abuse, and restrict access to them. With Topia in place, the next time PasswordFox tries to abuse the module, it'll be identified as an intruder, and promptly blocked.
Other popular security software will generally notify you of an attack, but can't do much to prevent it. This is why you need Vicarius Topia - no one else can keep you safe.
February 2021 Patch Tuesday RundownKent Weigle March 03, 2021
Could the Vulnerability Fujiwhara Effect Be the New Normal?Kent Weigle January 18, 2021
Six Ways to Improve Your Patch Management PracticesKent Weigle January 05, 2021
Top Trending CVEs of January 2021Kent Weigle February 01, 2021
So I Really Have to Update Chrome?Kent Weigle February 08, 2021