Another serious Web Browser hole

Contexis Security has found a BIG problem with WebGL implementations on Windows, Mac and Linux have numerous vulnerabilities which allow malicious web pages to capture any window on the system or crash the computer, according to research from Context Information Security. They actually demonstrate how to steal user data through web browsers using this vulnerability!

The report comes right on the heels of Microsoft’s denunciation yesterday of the security architecture of WebGL and announcement that it wouldn’t be seen in Microsoft products any time soon see here .

Sheesh! IE 9 is proving to be WAY more secure that FireFox and even Chrome! But until I can get the Firefox Extensions I use (or comparable) in IE I’m still a FireFox guy.

So let’s fix that:
To Disabe WebGL in Firefox 4

1. Type about:config in Firefox address bar and continue on through past the warning dialog.

2. Type "webgl.disabled" (no quotes) into the Filter box then Double click Webgl.disabled entry and turn its value into “True”.

3. Restart Firefox browser, WebGL is now disabled in Firefox 4.

To disable WebGL in Google Chrome you will need to:

1. Rright-click your Google Chrome shortcut or from your Windows menu on your desktop, click ‘properties’ and add “-disable-webgl” to the Target Shortcut box

2. Restart Chrome

As always please keep your systems, Web Browses and their plug-ins, Anti-virus/Antispyware software, and applications (especially Adobe products!!) up to date and fully patched.

And try and be vigilant about security and always ‘on guard’.

Backup your Facebook Profile Information

I am going to show you two (2) methods of obtaining your Facebook contact information; Names and email account information. One via a browser extension/add-on and another via using an ‘intermediary’ email account – in this case Yahoo.

As I have written many times I love me my Firefox browser. With the add-ons/extensions and tweaks I use, I am able to make use of my Browser as my most important productivity tool. With Firefox extension/add-ons and Greasmonkey extensions I have been able to do just about everything I’ve ever needed to with a browser.

I do also use Internet Explorer for some of my Microsoft sites where it is needed and Google Chrome – though primarily a portable version and/or on my Linux builds. It is also good to check any site building/scripting in all these browsers for differences in behavior.

One reason I don’t use Chrome that often is that although I love many things Google (Gmail and Google Apps in particular), I don not like the fact that just about EVERYTHING you type into Chrome address bar gets sent back to Google! AND the ‘google updater’ is constantly running in the background.

For this reason I use Chrome portable. You can pick up the latest version here. [For a Standalone Installation – To install a portable app by itself, or manually, just browse to the location of the [AppName]_Portable_x.x.paf.exe file you downloaded. Double-click the file to start the installation. Follow the on-screen prompts and select the location you’d like to install to. Within the directory you select, an [AppName]Portable directory will be created containing the portable app.]

Method 1 – Chrome Extension:


Now for the fun! I just found a Chrome extension that is totally awesome but so far is not available or does not have a like kind for Firefox 4. Get a copy of Chrome and install this extension – It is called the
"Facebook Friend Exporter", get it here. 

This extension allows for exactly what it says. You can install this plugin, log into Facebook, go to your ‘Friends’ page and then export all of your friends profile information that is contained in YOUR Facebook profile page(s).
This extension will allow you to get your friends information that they shared to you:
– Name
– Emails
– Phone numbers
– Screen names
– Websites
– Address
– Birthdays

Two methods of exports
– CSV file (if you have many friends, greater than 500, it will be very slow)
– Gmail Contacts (It will place them into a folder called "Imported from Facebook")

Notes:
– An "Export" button will appear on Facebooks toolbar on the top.
– Click on it and it will open a screen to start processing.
– Depending how many friends you have, this may take a very very long time to complete.
– For example: Exporting 100 friends will take at least 30 minutes!!

Additionally I may upload a copy of my portable Chrome build with all the extension already packed in; but that will have to come later.

Method 2 – Via Yahoo:

Another simple method to get Facebook contact information is to use a Yahoo email account.

· Import Facebook Contacts into Yahoo Mail

  • Step 1

Create a free email account at Yahoo Mail if you don’t have one or a use a new one to keep your contacts separate. Make sure you can send a test email out – to ‘verify’ your account. Log out of the Yahoo Mail account, once created. Close all open browsers.

  • Step 2

Open a new instance of a web browser and enter the URL for Yahoo. Log into your ‘general’ yahoo account. [make sure if you have the ‘redirect remover’ Firefox add-on installed in your browser to disable it temporarily]

  • Step 3

Click the "Facebook" button usually down on the lower left hand side. A login prompt will appear requiring a valid Facebook user ID and password.

  • Step 4

Log into the Facebook account where the contacts reside you wish to get. Open a new ‘Tab’ in your browser and type in Yahoo.com (you should still be signed in there too.) As soon as you logged in through the Yahoo Address page, the Facebook contacts will be available in Yahoo Contacts. Open the Yahoo ‘Contacts’ and choose to ‘get/import’ your contacts. A Facebook icon will be displayed and you will be asked if you are sure you wish to import them. Say yes of course and in a few moments all your Facebook contacts (names and email addresses contained in Facebook address book) will now be in your Yahoo Contacts! That simple!!

Contacts that are in Yahoo can then be exported for use in many other email applications. You can choose to export in a few different ‘.csv’ file formats, a single Outlook file format or a zip file containing all the individual files in an ‘address book card’ files format (.vcf). .VCF files can be imported into many applications – Gmail being one, not just Outlook.

· Export Facebook/Yahoo Contacts as a CSV File

  • Step 1

Click on the "Address Book" tab in Yahoo Mail.

  • Step 2

Select "Address Options."

  • Step 3

Click "Import/Export." The Export dialog box will open.

  • Step 4

Click the button labeled "Export Now" next to the email client the export will be imported into. For example, if the exported CSV file will be imported into Outlook, select "Outlook."

  • Step 5

Type a file name for the CSV file into the input box, when prompted and click the "Save As" button. Save the CSV file. The file is now ready to be imported into the specified email client or utilized as data. Super simple!

Updating to Firefox 4

I’ve written previously of my heavy reliance on Firefox and the many add-ons I use to make my time more productive and enjoyable while using the Internet.

Read here.

Now Mozilla has release the final version of Firefox 4.

Firefox 4 provides a MUCH faster and integrated browsing experience than version 3.x. The speed improvement will be noticed more on systems that allow for ‘hardware acceleration’ (more on that later) but it is still much faster on older systems.

Here is how I went about doing the upgrade.

1st download and install the latest version of Mozbackup here:

Download location here

Information page here

This application is wonderful. It completely backs up your profile; bookmarks, settings and extensions.

Run Mozbackup and back up your profile(s) completely.

Download/install Add-on Compatibility Reporter. This requires a few Firefox restarts to be properly loaded.

This add-on will let extensions that are not explicitly ‘approved’ for version 4 to run.

And it will provide a nice interface to report those that don’t work correctly to Mozilla and/or the developer.

[If you use LogMeIn (and you should, if you need remote access to machines – Mac or PC!) here is the process to get the older add-on working in version 4:

Download by right-clicking and choosing to ‘save link as’ to your desktop or wherever this file: https://secure.logmein.com/activex/npRACtrl_ff3.xpi and then open the file with a zip extractor:  (this is zip-file, you can use Winzip, 7-Zip or Winrar. I use 7zip,)

extract the file:

install.rdf

modify it the part ‘3.6 – to read 4.6 here: <em:maxVersion>4.6.*</em:maxVersion>

Then save the file and ‘put it back into the xpi (zip file) overwriting the original.

In the xpi file (opened via 7zip or whatever) delete zigbert.rsa in /META-INF folder

Save all back to single xpi file.

Open Firefox then go to the menu bar on top and choose ‘File>Open File’ and select the xpi file and install it.]

OK so let’s get to it!

Download Firefox 4 here and install/upgrade.

I had very few issues with the upgrade on all my machines. So I’ll address them here.

Once installed there are a few things that may need adjusting. I had to do this on some machines and not others.

If your ‘Menu’ bar disappears it can be brought back very simply. Just right-click on free space in one of the toolbars and the selection of ‘Menu Bar’ switches back to the old layout. I also check the ‘Navigation Toolbar’, the ‘Add-on Bar’, and the ‘Bookmarks Toolbar’.

clip_image002

By choosing ‘Customize’ you can select more items to add to the toolbar and place them where you like.

If you have ‘blurry fonts’ you may have an issue with ‘hardware acceleration’.

Simply go to the Options section from the ‘Tools’ context menu. Then in the Advance then General tab you can ‘uncheck’ the ‘Use hardware acceleration when available’.

clip_image004

Tabs on top? The new version puts them there. I don’t like that, you may. Firefox displays tabs on top by default which is a big change for Firefox 3 users. The customize menu has an option to move tabs back down. The entry Tabs on top needs to be unselected to move them below the address bar again.

On my OS X Machines there was one peculiar thing during the installation. Once the dmg was downloaded and mounted I could not copy the install to the applications directory until I trashed the existing Firefox application. Once installed, most of the above still apply.

On Linux (at least on my Ubuntu installs) Firefox 4 is real fast too!

UPDATE:

Lifehacker.com has some great tips on ‘fixing’ some of the quirks with Firefox 4

Well I hope this help some.