Evil Series: Turn Firefox 4 or 3 into Keylogger and Steal Passwords

Thilak — Mon, 25 Apr 2011 14:05:32 +0000

Firefox has a feature which remembers your password, so that you don’t have to physically type it whenever you visit your favorite site like Facebook or Twitter. Each time you log into the site for the first time, Firefox will display a note requesting whether you want to save the password or not. By removing this password prompt message, you can turn your Firefox into a secret key logger remembering each and every password used to login. There are two scenarios where you may find this worthwhile:

1. You are the only person using the computer, and you have used a master security password. In this scenario, you find it rather annoying to see the message consistently, and it’s safe to disable the password prompt since you have encrypted all your passwords with a master password, which is required to either use or view your saved password.

2. Your friend frequently uses your computer, without your permission and you want to steal his password to warn him about the consequence. Whatever the reason maybe, I truly believe having your own little key logger in your own computer isn’t something which is morally wrong; unless you are stealing his PayPal password (Firefox doesn’t remember passwords from sites like PayPal by default).

Firefox saves all its “not-to-be-messed-with” settings in the components folder normally located at C:\Program Files\Mozilla Firefox\. We modify nsLoginManagerPrompter.js to change the way Firefox behaves when it comes to saving passwords.

How to Disable Save Password Notification in Firefox 4+

1. Go to your Mozilla Firefox installation folder. By default, Firefox 4 is installed to this folder: C:/Program Files (×86)/Mozilla Firefox/ (in Windows 7)

2. Here comes the tricky part, Firefox 4 saves most of its components in an archive called omni.jar and archive extracting tools such as the one built into Windows 7 or 7Zip fail to open or extract omni.jar. I tried WinRAR 4 and it seems to handle omni.jar without any snags. I have not tested other programs, so it’s wise to make a backup of omni.jar for the worst case scenario. Also note that WinRAR cannot extract omni.jar in system folders such as “Program Files”, so copy omni.jar to a different location before extracting it.

3. Open component > nsLoginManagerPrompter.js with a text editor (preferably the one with syntax highlight. I use Notepad++)

4. Select everything between line 800 to 869 and replace it with:

{code type=php}var pwmgr = this._pwmgr; pwmgr.addLogin(aLogin);{/code}

5. Save the file and repack omni.jar. Again, be a careful while you repack. Do not repack “omni” folder, but repack everything inside that folder. Compress it as zip, and then rename omni.zip as omni.jar

6. Close Firefox and overwrite the old omni.jar with the one which you just modified.

How to Disable Password Save Notification Bar in Firefox 3+

Removing the password save notification in Firefox 3+ is simpler than Firefox 4 because older versions of Firefox do not compress their components in omni.jar. You can find nsLoginManagerPrompter.js normally located in C:\Program Files\Mozilla Firefox\components\

Replace line 642 to 711 with this code:

{code type=php}var pwmgr = this._pwmgr;

pwmgr.addLogin(aLogin);{/code}

Firefox will now save all the usernames and passwords automatically without the user’s consent. You can view saved password from Firefox > Options > Security > Saved Passwords.

Things to keep in mind:

1. Use this tutorial at your own risk and responsibility.

2. Do not use this tutorial with malicious intent.

3. nsLoginManagerPrompter.js might change when you upgrade your Firefox to a newer version.

4. Use a strong master password before you disable “Remember Password” notification. Otherwise, anyone with access to your browser can see your passwords in plain text.

Stories you may like:

This article, Evil Series: Turn Firefox 4 or 3 into Keylogger and Steal Passwords, was published at TechBuzz. Please don't violate our copyright

Firefox 3 gets native theme for Vista, XP and OS X

Thilak — Sun, 21 Oct 2007 18:46:12 +0000

Firefox has the same standard look and feel across all platforms. But this is going to change in Firefox 3. Mozilla is working on new visual theme for Firefox, which will be designed to smoothly fit into the operating system. Probably, this will help Mozilla in retaining new users, who would otherwise find it difficult in Firefox environment.

From the screenshots, the planned Vista theme looks a lot like Internet Explorer 7 with the same forward/backward icons. Likewise, the OS X version of Firefox 3 would resembles a lot with Safari. Linux will probably have a native theme as well, but this is going to be hard as Linux comes in variety of flavors.

I think this is step in the right direction to retain more users, but at the same time, it will be hard for those using Firefox across different platforms. For instance, I use both Vista and Ubuntu on my laptop, but I use XP on my desktop, which meansÃ¢â‚¬Â¦ i’ll have to get used to three different themes of Firefox. I hope, they add an option switch back to the standard theme, just like how it looks today.

[Via: Alex Faaborg, CyberNet]