Firefox 23 and Mixed Active Content

Published: 2013-08-07
Last Updated: 2013-08-08 01:45:27 UTC
by Johannes Ullrich (Version: 1)
11 comment(s)

One of the security relevant features that arrived in the latest version of Firefox was the blocking of mixed active content. In the past, you may have seen popups warnings in your browser alerting you of "mixed content". This refers to pages that mix and match SSL and non SSL content. While this is not a good idea even for passive content like images, the real problem is active content like script. For example, a page may download javascript via HTTP but include it in an HTTPS page. The javascript could now be manipulated by someone playing man in the middle. The modified javascript can then in turn alter the HTML page that loaded it. After all we are using the HTML to load the javascript, so we will not have any "origin" issues. 

Firefox 23 refined how it deals with "mixed ACTIVE content". If an HTML page that was loaded via HTTPS includes active content, like javascript, via HTTP, then Firefox will block the execution of the active content.

I setup a quick test page to allow you to compare browsers. The first page https://isc.sans.edu/mixed.html just includes two images. One is loaded via https and one via http. The second page, https://isc.sans.edu/mixed2.html does include some javascript as well. If the javascript executes, then you should see the string "The javascript executed" under the respective lock image.

For more details, see Mozilla's page about this feature: 

https://blog.mozilla.org/tanvi/2013/04/10/mixed-content-blocking-enabled-in-firefox-23/

------
Johannes B. Ullrich, Ph.D.
SANS Technology Institute
Twitter

Keywords: firefox javascript
11 comment(s)

Comments

Didn't you mean to say: "see MOZILLA's page about this feature" ?
Hmm, I wonder if this will force some of the three-letter-security-vendors to fix their "Enterprise" consoles that server mixed content...
Sorry about the typo. I fixed it and it now says "Mozilla", not "Google".

Paul: They will just require that you use a browser other then Firefox.
[quote=Diary] In the past, you may have seen popups warnings in your browser alerting you of "mixed content". This refers to pages that mix and match SSL and non SSL content. While this is not a good idea even for passive content like images, the real problem is active content like script. For example, a page may download javascript via HTTP but include it in an HTTPS page.[/quote]

Oh the irony! The ISC diary pages are HTTPS but load a GIF image, a CSS file and a Javascript file from translate.googleapis.com as HTTP - i.e. "mixed active content". Oops!

patermann
[quote=comment#26920][quote=Diary] In the past, you may have seen popups warnings in your browser alerting you of "mixed content". This refers to pages that mix and match SSL and non SSL content. While this is not a good idea even for passive content like images, the real problem is active content like script. For example, a page may download javascript via HTTP but include it in an HTTPS page.[/quote]

Oh the irony! The ISC diary pages are HTTPS but load a GIF image, a CSS file and a Javascript file from translate.googleapis.com as HTTP - i.e. "mixed active content". Oops!

patermann[/quote]
Good eye you have there! The issue is actually already on our shortlist. The reason we don't just "hotfix" this is because we're in the process of de-Googling ISC, in terms of analytics, search and translation.

Thanks for your support, and patience!
I must be doing something wrong :-(

I'm using Firefox 23.0 (on windows 7 64 bit), with RequestPolicy and NoScript plugins,
yet I still get the "The Javascript executed" message when visiting
https://isc.sans.edu/mixed2.html
Both requestpolicy and noscript are set to "allow" sans.edu.

(I also am seeing only 6 of the 17 comments to this diary post...)
[quote=comment#26965][quote=comment#26923][quote=comment#26920][quote=Diary] In the past, you may have seen popups warnings in your browser alerting you of "mixed content". This refers to pages that mix and match SSL and non SSL content. While this is not a good idea even for passive content like images, the real problem is active content like script. For example, a page may download javascript via HTTP but include it in an HTTPS page.[/quote]

Oh the irony! The ISC diary pages are HTTPS but load a GIF image, a CSS file and a Javascript file from translate.googleapis.com as HTTP - i.e. "mixed active content". Oops!

patermann[/quote]
Good eye you have there! The issue is actually already on our shortlist. The reason we don't just "hotfix" this is because we're in the process of de-Googling ISC, in terms of analytics, search and translation.

Thanks for your support, and patience![/quote]

quote test[/quote]

quote test 2
[quote=comment#26923][quote=comment#26920][quote=Diary] In the past, you may have seen popups warnings in your browser alerting you of "mixed content". This refers to pages that mix and match SSL and non SSL content. While this is not a good idea even for passive content like images, the real problem is active content like script. For example, a page may download javascript via HTTP but include it in an HTTPS page.[/quote]

Oh the irony! The ISC diary pages are HTTPS but load a GIF image, a CSS file and a Javascript file from translate.googleapis.com as HTTP - i.e. "mixed active content". Oops!

patermann[/quote]
Good eye you have there! The issue is actually already on our shortlist. The reason we don't just "hotfix" this is because we're in the process of de-Googling ISC, in terms of analytics, search and translation.

Thanks for your support, and patience![/quote]

qutoe
[quote=comment#26923][quote=comment#26920][quote=Diary] In the past, you may have seen popups warnings in your browser alerting you of "mixed content". This refers to pages that mix and match SSL and non SSL content. While this is not a good idea even for passive content like images, the real problem is active content like script. For example, a page may download javascript via HTTP but include it in an HTTPS page.[/quote]

Oh the irony! The ISC diary pages are HTTPS but load a GIF image, a CSS file and a Javascript file from translate.googleapis.com as HTTP - i.e. "mixed active content". Oops!

patermann[/quote]
Good eye you have there! The issue is actually already on our shortlist. The reason we don't just "hotfix" this is because we're in the process of de-Googling ISC, in terms of analytics, search and translation.

Thanks for your support, and patience![/quote]
quote quote
[quote=comment#26923][quote=comment#26920][quote=Diary] In the past, you may have seen popups warnings in your browser alerting you of "mixed content". This refers to pages that mix and match SSL and non SSL content. While this is not a good idea even for passive content like images, the real problem is active content like script. For example, a page may download javascript via HTTP but include it in an HTTPS page.[/quote]

Oh the irony! The ISC diary pages are HTTPS but load a GIF image, a CSS file and a Javascript file from translate.googleapis.com as HTTP - i.e. "mixed active content". Oops!

patermann[/quote]
Good eye you have there! The issue is actually already on our shortlist. The reason we don't just "hotfix" this is because we're in the process of de-Googling ISC, in terms of analytics, search and translation.

Thanks for your support, and patience![/quote]

testing message count
Diary Archives