Security researchers claim to have discovered a flaw in the open source Firefox browser that allows attackers to disable the browser's anti-phishing filter through a simple change in a site's URL syntax.
Securiteam, a security alert site maintained by vendor
Beyond Security said that the trick could allow for pages that already are in Firefox's registry of known phishing sites to slip past the recognition software and appear authentic to the user.
Securiteam credited a report by an independent researcher using the named
kanedaa. The researcher discovered that the phishing filter would be disabled when an extra 'forward slash' would be entered after the domain suffix (for instance: www.vnunet.com//news/).
Normally, Firefox responds to a known forgery page by alerting users and then redirecting to a search page.
Mozilla, which oversees development and distribution of the open-source browser, didn't immediately respond to a request for comment from vnunet.com.