NoScript Sightings

[Giorgio Maone]

The Register: Nothing succeeds like XSS -- Unless you use NoScript, that is

[Giorgio Maone]

The Register: Clickjacking threat punts Facebook survey scam

Prospective marks running the NoScript Firefox plug-in are protected from the line of attack, which continues with a supposed "human verification step". Marks are invited to complete a time-wasting survey before they are allowed to view the T-shirts.

Maybe because I'm not a native English reader, I find the statement above quite obscure.
Softpedia's Report "'Top T-Shirt Fails' Facebook Scam Employs Clickjacking" is fairly more understandable to me:

In this case a hidden Facebook Share button is positioned over the Next one on Step 2 of the "facebook human verification" dialog.

Firefox users who use the NoScript extension will see a warning about a clickjacking attempt being blocked when they click the Next button.

[Giorgio Maone]

1. CNET on "Fake link in email leads to Zeus Trojan" (with screenshot!)
2. MacWorld's "7 essential privacy extensions for Firefox"

[therube]

Critical vulnerability in Firefox 3.5 and Firefox 3.6

10.26.10 - 02:30pm

Issue:
Mozilla is aware of a critical vulnerability affecting Firefox 3.5 and Firefox 3.6 users. We have received reports from several security research firms that exploit code leveraging this vulnerability has been detected in the wild.

Impact to users:
Users who visited an infected site could have been affected by the malware through the vulnerability. The trojan was initially reported as live on the Nobel Peace Prize site, and that specific site is now being blocked by Firefox’s built-in malware protection. However, the exploit code could still be live on other websites.

Status:
We have diagnosed the issue and are currently developing a fix, which will be pushed out to Firefox users as soon as the fix has been properly tested.

In the meantime, users can protect themselves by doing either of the following:

Disabling JavaScript in Firefox
Using the NoScript Add-on

http://blog.mozilla.com/security/2010/1 ... refox-3-6/

[LouCypher]

 
Beware enticing Bieber links, free offers on Facebook
InSecurity Complex - CNET News

...yadda..yadda...

If you see a potential or obvious scam on Facebook report it to the person whose account is spreading it, M86
said. The NoScript Firefox plug-in protects against clickjacking attacks such as this, it added.

[Giorgio Maone]

Techdirt: Am I Violating The DMCA By Visiting The NYTimes With NoScript Enabled?

[Giorgio Maone]

Forbes: NoScript #1 tool of the digital middle-eastern revolutionary

[Giorgio Maone]

NoScript among the "Enhanced Protection Recommendations" by NSA (US' National Security Agency this time ) (page 7 of the PDF).

[tlu]

The man in the browser and Phishing with legit URL’s

Of course noscript will prevent these kind of attacks ...

[therube]

Softpedia.com: NoScript 2.1.6 Brings Keyboard Accelerators

[Giorgio Maone]

Forbes - Best Read: Brand'ts Top 5 Malware Threats in 2012

If you’re not running Firefox with NoScript installed, you need to do so right now. As far as I can tell, it’s the only surefire method of preventing an accidental infection of a Windows PC by exploit-kitted Web pages.

[Tom T.]

Forbes - Best Read: Brand'ts Top 5 Malware Threats in 2012

If you’re not running Firefox with NoScript installed, you need to do so right now. As far as I can tell, it’s the only surefire method of preventing an accidental infection of a Windows PC by exploit-kitted Web pages.

I believe I'll link that in the thread, "Google Chrome vs. FX+NS;", thanks.

[therube]

Softpedia.com: NoScript 2.2.5 Released

It took only three release candidates for the developer to come out with the stable version for NoScript 2.2.5.

All the features you’ve been accustomed to have been preserved and there is no addition in the extension. As all the effort invested to reach this version number was to eliminate bugs and improve compatibility with various widgets and websites.

As such, the new release brings to the table better compatibility with Verified by VISA (www.securesuite.net). On the same note, ClearClick feature has also been improved, as there is better compatibility with recent Disqus widget versions.

Linux tooltips obstructing the embedding unblocking confirmation dialog should no longer occur as the developer came up with a workaround for the issue.

NoScript allows JavaScript, Java, Flash and other plugins to be executed only by trusted websites of your choice. You can download it from this page.

[Giorgio Maone]

Remove Facebook Timeline' themed scam circulating on Facebook (Zero Day, ZDNet's security news by Ryan Nairaine Dancho Danchev):

Users are advised to take advantage of Firefox’s NoScript extension in order to prevent clickjacking and likejacking attempts.

[Tom T.]

@ Giorgio:

Did you break the lnk deliberately? There's a space after the URL closure tag that caused a line feed in the wrap, I think. Removing the space (butting up "Remove" to the "]" makes the link work.

Seems like a safe link that users might want to click, but of course I wouldn't edit your posts without checking first. If it was broken deliberately for anti-SEO or whatever, cool.