Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

This wouldn’t be a big deal, as the web is fraught with this kind of malicious sites, but these websites aren’t abusing some new never-before-seen trick, but a Firefox bug that Mozilla engineers appear to have failed to fix in the 11 years ever since it was first reported back in April 2007. The bug narrows down to a malicious website embedding an iframe inside their source code. The iframe makes an HTTP authentication request on another domain.

This results in the iframe showing an authentication modal on the malicious site, like the one below. For the past few years, malware authors, ad farmers, and scammers have been abusing this bug to lure users on sites where they show all sorts of nasties, such as tech support scams, ad farms that reload the page with new ads in a loop, pages that push users to buy fake gift cards, or sites that offer malware-laced software updates. Whenever users try to leave, the owners of these shady sites trigger the authentification modal in a loop.

Every time the user dismisses it, another request is made, and a new modal appears, effectively keeping the user captive on the malicious sites until they close the browser altogether, and are forced to start a new browsing session.

Source: zdnet.com