New Firefox vulnerability?

[Concerned User]

According to the webroot blog:

http://blog.webroot.com/2010/10/06/p...ing-passwords/

If you've set Firefox to remember passwords (a very useful feature in all browsers), there is a possibility that a trojan will modify the code and not prompt the user at all while saving passwords.

No other details given by Webroot which is very bad!

But there’s some good news: We’re able to easily identify and remove the Trojan (we call it Trojan-PWS-Nslog) from infected machines

Great! How about telling us how to prevent the infection in the first place?

a google search about the trojan (http://www.google.com/search?q=Troja...&start=10&sa=N) shows most of the sites referencing only the webroot site in their articles. Wonder if this is indeed a "buy our software" kind of promotion by webroot?


Disabled the automatic password prompt...So far only IE and Firefox seem to be affected...Wonder if other browsers could also be affected.

[tushR]

I guess same virus will have different name with different vendor, so if you search with a particular virus name (exceptions are global ones like conflicker) then it will take you to the vendor reference page - who named it that way.

[Taurus]

Use Sandboxie to protect your browser.

[garth]

Originally Posted by Concerned User

Great! How about telling us how to prevent the infection in the first place?

Disabled the automatic password prompt...

Have you not prevented it by disabling this then? Maybe not the point i know, but if it works it'll do 'til they close off the vulnerability. And as Taurus said, there's always Sandboxie.

[eyeb]

hm why not use keepass as password manager instead of firefox's builtin one

[Concerned User]

Well, I did not disable the password prompt until now since this is a useful feature. Yes, I do use sandboxie and backup my passwords regularly. Will try Keepass. Thanks!