fireFox begins to block data URI's in a new Anti-Phising feature

Mozilla has begun to implement a new feature to start blocking URI's in the navigation bar that abuse protocol. URI scheme was implemented in 1998 developers were looking for ways to embed files inside other files. They came up with URI scheme, this allows a developer to load a file represented as ASCII-encoded octet stream inside another document.

This URI scheme has been popular among the developing community. This allows them to embed text-based files & images inside HTML documents instead of sending them separately. Search engines began ranking sites higher that implemented this new standard.

Here is an example of websites that use data:image/png;base64 raw streams to embed images inside HTML or CSS files instead of loading resources via "HTTP://domain.com..." on HTTP requests:

< img src="data:image/png;base64,iVBORw0KGgoAAA
ANSUhEUgAAAAUAAAAFCAYAAACNbyblAAAAHElEQVQI12P4
//8/w38GIAXDIBKE0DHxgljNBAAO9TXL0Y4OHwAAAABJRU
5ErkJggg==" alt="Red dot" / >

Phishers love these Data URI's

Around the late 2000's URI's were being abused for phising and XSS attacks, phishers began to perfect their techniques around data URI's.

For the past incremental years these tactics have been prevalent the most abused cases use "data:text/html;base64" & "data:application/x-javaScript;base64" These popular techniques provide a way to embed malicious HTML & javaScrip code inside legit sites.

browsers taking action to block data URI's

These URI's can also be loaded inside the browser in the navigation bar to render the file directly; They then use malicious code to hide the URL.

The scheme that was used for embeding files in other files became the standard navigation method in our browsers.

FireFox joins the rest

Developers have been working pretty hard to enforce the browser against incorrect usage of the data URI's. When fireFox Mozilla 59 is released they hope to roll out new security features that will prevent the rendering of dangerous HTML, JS, and SVG data URI's.

Only URI's that render SVG are affected as other image formats cannot be affected.