Sunday, March 30, 2008

Curious Firefox Tidbits

In tracking down a problem installing the latest NEXT release of Newsfox into Firefox Minefield nightlies, I thought I had a corrupted profile.

So I deleted it and created a fresh one.

Only Minefield refused to launch saying that Firefox was already running (even though it wasn't).

Failure to Launch

I worked through the tips in my post "Firefox is Running..." Even when it isn't... but wasn't able to resolve it.

I did a bit more research on the Profile folder over in the MozillaZine Knowledge Base but came up empty. However, I did learn about the Profiles.ini file.

Turns out that when I found and inspected that file on my system, I saw that the profile listed for Minefield was still the old one, and not the new one I created.  I edited the file to reflect the new profile name and Minefield launched again, just as normal.

So, if you've tried everything else troubleshooting a failure to launch your Firefox profile, check the profiles.ini file and make sure the filenames/paths match correctly.

An Interesting Discourse

In my post Firefox 3 Security Blocker: Going In Deep, I fussed quite a bit about the lack of user control and openness of the "attack-site" feature in Firefox 3.0.

Seems I'm not the only one.

In the comments, a thoughtful gentleman named BartZilla opened up a discussion reviewing some of the deeper workings on this process.

Firefox Antiphishing Server-side Project (codename: "Firefox is spyware") - BartZilla

He pointed to an additional source of information regarding the workings of this feature

Protocolv2Spec - google-safe-browsing - Google Code

Certainly interesting information and thoughts for the die-hard Firefox fans.

Who is JSON and why are his files now on my PC?

I've really been impressed with the Firefox 3.0pre build work on the Places structure.  Places is the new bookmarking feature which uses SQLite for storage management. The file is called places.sqlite.

You can peek into it with one of the various freeware SQLite viewers: Two More "Lite" SQLite viewers - All good, light, and free

(Note:  I wasn't able to open it as long as it was "locked" by Firefox 3.0 running.  If this happens to you, first close out your Firefox 3.0 session so it "unlocks" then attempt to open it with one of the SQLite file browsers mentioned above.)

Something interesting about this for you forensics folks is that the places.sqlite database also records when the bookmark was added to the database, as well as when it was last modified.  As well as visit dates and associated session numbers. Certainly could be potentially useful information in an investigation.  The change to SQLite files will cause many older Firefox history/bookmark reviewing utilities to no longer work, however, it should also help provide even more information to reviewers when new utilities are released to read back the contents of the new places.sqlite files.

One feature that I really liked was the ability to easily do backups and restorations of the entire bookmark structure in Firefox 3.0.  In the past trying to sync bookmarks between browsers/systems meant a lot of copy/paste work in the bookmark manager.

Now, in Firefox 3.0 you can backup your entire bookmark structure with a few clicks, and restore the entire set, overwriting the existing structure, with a few more.

Up to last week or so, the backup file was generated as a "bookmarks.html" file.

When I generated one recently, it was found to now be in the following format: "Bookmarks 2008-03-30.json"

Turns out the JSON file format is a progression in the new direction of Firefox 3.0.  It has always been planned but only just finally made it into the recent builds.

Most of my text-editors choked on my file (being as it is so large), but Microsoft Word was able to open it up and with a bit of work, I was able to pick through all 81 pages of it.

Other Stuff

Story - Interesting prototype web history browser utility. The Story Manual goes into some detail about this. as it applies to Firefox's new places.sqlite file.

Internet And Chat Forensics » SlideShare - Good overview presentation of browser forensics.

Locationbar² Updated for Firefox 3 - Cybernet News. Good review of an Add-on for Firefox that will highlight the "true" URL base of a weblink in your browser address bar.  This might be good to help guard against URL spoofing or purposefully malformed weblinks often used by phishers.   It appears this was going to be an embedded feature in Firefox 3.0 but got stripped out. Developer's website: design-noir | Mozilla | Locationbar².

Cheers.

--Claus

Posted by Claus at
Labels:

No comments:

Post a Comment

Subscribe to: Post Comments (Atom)