Can Mozilla-Based Browsers be Hijacked?

Chibi Merrow asks: "Matt Hartley in his latest GnomeReport speaks of supposed browser hijacker programs that are now targeting Mozilla FireFox instead of IE. While this is in a way cool (since that means the browser's now considered mainstream), it's also hard to believe. It doesn't help that his article is very light on details. Now there have been some discussion about spyware masquerading as valid extensions; but they require user intervention to install. Most people think of a browser hijack as something that automatically installs itself. Has anyone ever encountered an actual self installing browser hijacker/spyware program that has targeted Mozilla Firefox, or is this a bunch of FUD?"

Comments

No ActiveX

[colinramsay]

One of the reasons that IE is so susceptible to this sort of thing is because of ActiveX - an inherent security hole. While xpinstall is similar, it will always require clear user input to get the extension installed.

And lets not forget the obvious - IE6 is always going to be bad for this. Mozilla gets updated each and every day and has a regular release schedule.

I know who I'd rely on for the latest and greatest security tech.

Re:No ActiveX

[Anonymous Coward]

IE's default security settings will only install signed ActiveX controls, and that's AFTER the user agrees to it. It's no different than with Mozilla's.

Re:No ActiveX

[obeythefist]

There's always a risk that any application that's handling data, especially unclean internet data, can be the victim of a buffer overflow. Here's where the open source nature of Mozilla beats MSIE hands down, the code is open to scrutiny which means that someone somewhere has probably already looked after most of the exploits already. That's the theory, anyway.

Re:No ActiveX

[cookd]

That means nothing. In any computer product that is intended for use by non-computer-experts, the developer needs to keep this in mind: You cannot trust the end user to make good decisions regarding computer security.

Here is what I mean. My dad clicks on a link. The front page says "Click here to install the software necessary to view this web site." So he clicks. He gets a scary message, warning about potential viruses and trusting and digital signatures and stuff. None of it makes sense. Essentially, it gets translated into the following question:

Do you want to visit the web site? OK / Cancel.

XpInstall is just as vulnerable as ActiveX in this regard. People are dumb. Just like you don't care enough to read the full EULAs with all their legal mumbo-jumbo, most computer users won't really consider the warning.

And, by the way, ActiveX also requires an OK before installing, just like XPI. There are buffer overflows or cross-site scripting attacks that can bootstrap an attack without ActiveX (and to which Mozilla is just as vulnerable), but ActiveX itself doesn't offer any way to auto-install software without the user's agreement, unless the user changes the Internet Security settings.

ActiveX == Browser Plugins. Mozilla allows plugins, so there is NO difference.

IE gets updated whenever a security flaw is found. And the user is prompted to download the update. I don't get alerts when FireFox needs an update -- I go to the website once in a while. You tell me which method is more likely to keep my dad's computer secure.

Re:No ActiveX

[WIAKywbfatw]

And lets not forget the obvious - IE6 is always going to be bad for this. Mozilla gets updated each and every day and has a regular release schedule.

Let's get one thing straight: this sort of browser hijacking isn't aimed at defeating technically-minded people like you or I, it's aimed at non-technical users, such as friends and relatives we might have encouraged to switch away from Microsoft Internet Explorer, or people who've installed Mozilla Firefox from a magazine cover disc, etc.

For the most part, these non-technical users aren't going to be actively updating their software on a regular basis. They're not going to be looking out for potential security risks and their solutions because they thought that they were leaving all that behind when they switched over from MSIE. In all probability, many if not most of these users won't even know that they've been hijacked if and when that happens.

To suggest that browser hijacking doesn't have the potential to be a major problem for Mozilla users is rather short-sighted. Being dismissive about it is like adopting a "head in the sand" security policy, and no better than a "security through obscurity" one.

Re:No ActiveX

[Curtman]

• IE gets updated whenever a security flaw is found. And the user is prompted to download the update. I don't get alerts when FireFox needs an update -- I go to the website once in a while. You tell me which method is more likely to keep my dad's computer secure.

You're wrong. Mozilla, and Firefox both inform you about about updates. take a look at the URL 'about:config' and filter for 'update_notifications'. Unless you changed something, update_notifications.enabled will be set to true, and when a new version is released, you'll be brought to the moz homepage when a new version is available. You'll also see a setting there for frequency to check for updates, and a time of the last check.

Re:No ActiveX

[Ithika]

I just did what you suggested and (using Firefox 0.8) my update_notifications.provider.0.datasource is empty [default]. Does this prevent Firefox checking for updates? Certainly it never told about the upgrade from 0.7 to 0.8.

Re:No ActiveX

[Curtman]

No it won't disable it, it just allows you to override the default. I believe 0.8 is the first browser in the pheonix/firefox lineage to support updates, but Mozilla has since 1.4 or something like that. Here's a screenshot of what updates in future Firefox's will look like (known as SmartUpdate)

Re:No ActiveX

[ccady]

ActiveX itself doesn't offer any way to auto-install software without the user's agreement, unless the user changes the Internet Security settings.

AFAIK Mozilla never allows you to auto-install without a warning.

IE gets updated whenever a security flaw is found.

B.S.

Re:No ActiveX

[Anonymous Coward]

What good is a warning among dozens of other dialogs which need to be OK'd to view a page? Too many people don't need to be elaborately tricked into installing spyware, but almost all can be made to click on that OK button.

Re:No ActiveX

[4of12]

You cannot trust the end user to make good decisions regarding computer security.

You are so right.

It makes me think the better overall policy is to make flexible easy upgrades scarier.

But make the initial installation as capable as possible so most users won't ever feel a need to do an insecure upgrade.

In the Mozilla and FOSS world things are still not much better than in the Windows world as far as security is concerned. A lot of the current problems with Linux security policies are masked by a 1337 userbase, but widespread deployment could lead to problems like this.

Re:No ActiveX

[mhesseltine]

There's always a risk that any application that's handling data, especially unclean internet data, can be the victim of a buffer overflow. Here's where the open source nature of Mozilla beats MSIE hands down, the code is open to scrutiny which means that someone somewhere has probably already looked after most of the exploits already. That's the theory, anyway.

That's the theory. In practice, however, that still doesn't necessarily work. Look, for example, at the recent buffer overflow found in CVS, software that's been open since its inception and been around for a long time. Also, look at the latest problems with OpenSSH, again a package that has been around for quite a while, and one that people should be *very* security concious about.

While the idea that the code being open forces the bugs to be found and removed, that only works if someone with the skill to find the bug, and the willingness and skill to fix the bug does so.

Re:No ActiveX

[Anonymous Coward]

people like you or I

"you or me".

Re:No ActiveX

[llefler]

There's always a risk that any application that's handling data, especially unclean internet data, can be the victim of a buffer overflow.

Insightful? Not even close. Buffer overflows aren't a given. They aren't a fact of life. Quite simply, all you have to do is simple bounds checking. If you allocate a 4k buffer, don't try to copy 6k to it. Buffer overflows are a 'feature' of C/C++. There are plenty of other languages that don't have that problem.

Unchecked buffers are the result of poor program design. No programmer, or company, should say that they are security conscious if they haven't done a code review and fixed them.

Re:No ActiveX

[Anonymous Coward]

This has nothing to do with buffer overfloaws or other coding flaws. ActiveX/XPI are designed in -- both are means to run semi-trusted code off the Internet.

Re:No ActiveX

[rthille]

Your post made me think that the user prompt really needs to be: "Do you trust this website with full control over your computer?"
But the problem is with the browser. If the browser were designed to be able to per-domain sandbox even plugins (a shit load of work I know, and it would limit their functionality), then a user could install a plugin downloaded from a site, view that site, and all the plugin could do would be screw with the data from that site. I guess what I'm advocating is that plugins be written in java, or at least execute in a java-sandbox like environment.

Re:No ActiveX

[Anonymous Coward]

Buffer overflows are a 'feature' of C/C++. There are plenty of other languages that don't have that problem.

Buffer overflows exploitation is better characterized as a 'feature' of the OS and underlying architecture. I say this becuase a buffer overflow in and of itself is really not that significant. It is the potential to inject, and cause to execute, arbitrary code that operates with all of the vast priveledges of the program which was exploited that is really the problem. You can eliminate buffer overflows by switching to a different langauge, or by using safe buffer APIs for C and C++. However, none of these choices change the fact that your underlying security model is weak and flawed.

Re:No ActiveX

[rbright]

Buffer overflows are a 'feature' of C/C++. There are plenty of other languages that don't have that problem.

Of course the interpreters for those languages are usually written in C or C++, so we haven't quite escaped the problem yet.

Re:No ActiveX

[llefler]

Of course the interpreters for those languages are usually written in C or C++, so we haven't quite escaped the problem yet.

Well, since Delphi doesn't have an interpreter, I would say as least some of us have escaped the problem. Haven't had a buffer overflow in an application in 10 years. Pointers and range checking hasn't been a problem either.

Re:No ActiveX

[zoloto]

ActiveX == Browser Plugins. Mozilla allows plugins, so there is NO difference.

You couldn't be more wrong and here's why:

XPI installer will ask you ONCE if you'd like to install a plugin without any custom text that lies to you and says to view our website click here.

ActiveX pops up 20+ times before it goes away.

Slight difference in my mind.

Re:No ActiveX

[Beryllium Sphere(tm)]

>ActiveX also requires an OK before installing

If memory serves, IE's Medium security setting allows signed ActiveX to load without prompting. You're right if you're talking about XP SP2, or if I'm mistaken.

Re:No ActiveX

[cookd]

It probably depends on the version of IE. I'm using XP SP1 right now, and IE reports version 6.0. I didn't notice what they were on SP2, but I'm guessing they're tighter. They're downright draconian on W2k3.

In any case, here are the settings on my XP SP1 version of IE6:

Default security for Internet zone: Custom (but very similar to Medium, and the same in all of the settings I list below).

Medium security setting: .NET programs = enabled
Download unsigned ActiveX = disabled
Download signed ActiveX = prompt
Run (existing) ActiveX = enabled
Script (existing) safe ActiveX = enabled
Script (existing) unsafe ActiveX = disabled

Re:No ActiveX

[Ciaran_H]

I believe the updates to IE in XP SP2 will block all ActiveX controls unless explicitly told otherwise, and it won't use a popup to notify them of this - simply display a message at the top of the window.

But I don't use IE much, so I don't have any experience of this.

Re:No ActiveX

[Anonymous Coward]

He gets a scary message, warning about potential viruses and trusting and digital signatures and stuff. None of it makes sense.

Then no offense sir, but your father is an idiot and shouldn't be using a computer. A computer is a tool like a car. If your father cannot be taught enough to learn when his computer is telling him something is wrong, HE SHOULDN'T FUCKING USE IT. It's that simple.

Re:No ActiveX

[obeythefist]

That's a good point, well backed up, but on the upside, if you follow the process along, open source has another advantage. The fixes for open source software seem to come out within hours after really serious exploits are found. Microsoft, being a product seller, spends way too much time rationalising the budgetary costs of fixing the bug, implementing, then testing it. They have to, because you sure hear about it whenever a MS patch breaks something else.

I'm a big advocate of the theory of open source software, although I'm a gamer and the unfortunate reality is that Windows does games better to this date. Doesn't mean I'm not eagerly watching the progress that Linux is making.

IE is part of Windows

[Gary Destruction]

That in of itself makes it more insecure. I mean, it uses Windows' SSL whereas Mozilla has its own SSL. It has Windows remember passwords whereas Mozilla has a password manager. Mozilla just being a stand alone app makes it safer in that regard. And even a recent exploit caused by an issue with file extension spoofing vulnerability was an issue only with IE. Mozilla still showed the file's name in its entirety.

Re:IE is part of Windows

[Anonymous Coward]

Integration into the OS makes the scope of IE vulnerabilites larger, but it doesn't necessarily make IE less safe. Microsofts neglect towards known vulnerabilities is a problem, but a similar attitude would hit Mozilla just as hard.

An example: For a short time, several themers chose to distribute Mozilla skins in XPI form, because that allowed users to install them without additional files. The now preferred way of installing skins requires the help of a script, either in the browser (theme installer extension) or on a webpage. The latter method does not give skins access to JavaScript and is considered safe. XPIs can do a lot more: The installation process can run arbitrary code on the target system and even skins which are installed this way can later on access browser resources and relay them to an external attacker.

Re:IE is part of Windows

[Gary Destruction]

Why did they have to make XPI? I mean, Mozilla was doing so well. Why not just make a plugin that has an installer or a self-extract zip file or something of that nature? Is there an XPI viewer available?

Re:IE is part of Windows

[Curtman]

• Why not just make a plugin that has an installer or a self-extract zip file or something of that nature?

Haha. That's exactly what they did do. To quote the manual:

An XPI file is nothing more than a ZIP file with its own installation script. Using a ZIP utility, you can archive the xfly directory and preserve the subdirectory structure so it's installed in the user's chrome directory as it is in your own. Make sure that the ZIP file, whatever it's called, contains the top-level xfly subdirectory as part of this structure. If it is a JAR file you are distributing for your package, make the JAR file (xfly.jar) the top level, with the content, skin, and locale directories contained within

Re:IE is part of Windows

[sql*kitten]

it uses Windows' SSL whereas Mozilla has its own SSL

Actually, this is exactly contrary to SSL philosophy. When asked "why doesn't SSL/SSH do such-and-such", developers reply that they want to concentrate on the crypto layer and other applications can use that layer to provide their own services (for example, sftp is layered on top of ssh, VNC uses ssh to provide its crypto, etc). So, there's one crypto system to maintain and patch, not two or even n.

It's Unix philosphy too, building useful things from small tools that do one thing well. The Mozilla people lost sight of that pure vision LONG ago, and reimplemented everything from scratch. Kinda missing the point of libraries altogether.

Re:IE is part of Windows

[anim8]

It's Unix philosphy too, building useful things from small tools that do one thing well. The Mozilla people lost sight of that pure vision LONG ago, and reimplemented everything from scratch. Kinda missing the point of libraries altogether.

OTOH this is why Mozilla is able to run on multiple platforms and architectures.

Re:IE is part of Windows

[Anonymous Coward]

And "ActiveX"* is just a simple installer bootstrapper, but that hasn't stopped 8 straight years of ActiveX-bashing on the Internet.

Fact is, for whatever reason, Mozilla took the most maligned feature of IE and copied it.

(* actually the term "activex" means a lot of different things, but the security sensitive one is the plug-in installer).

Re:IE is part of Windows

[Anonymous Coward]

> It's Unix philosphy

And "Windows Philosphy" would be to use the built-in HTTPS libs. The idea of shared code isn't exclusive to Unix.

The fact is that Netscape^WMozilla has always seeen themeselves as their own 'operating system' layer. Remember Andreeson and his quip about "reducing Windows to a bunch of poorly debugged device drivers" -- well, the same attitute lives on today at mozilla.org.

Re:IE is part of Windows

[Curtman]

Who ever said the packaging for ActiveX should be more complicated?

I love that bit where they say

• The .cab file format is a nonproprietary compression format, also known as MSZIP, that is based on the Lempel-Ziv data-compression algorithm. (Other compression formats might also be supported later.)

I'd hate to see what Microsoft considers to be proprietary, because .cab and 'MSZIP' would fit my definition pretty closely.

Re:IE is part of Windows

[Anonymous Coward]

I don't think you have clue what "proprietary" means. If CAB is proprietary, so is ZIP, RAR, ACE, JAR, TGZ, etc.

Anyway, they wanted to get at the signature without unpacking the archive -- WHEN Mozilla supports signed components, they'll have to deal with the same issues.

Re:IE is part of Windows

[jtev]

Um, well, now that L-Zs patent is up it's not, but it used to be. Even if it's not Microsoft Proprietary, it's still proprietary.

Re:IE is part of Windows

[Curtman]

First off, Mozilla does support signed components, and has for a long time.
And are you fucking kidding me? MSZIP? And you don't think that's proprietary? Lets take a stroll down memory lane:

• CAB History
• 
  
  In 1977, Abraham Lempel and Jacob Ziv devised and published a paper on their new compression method, LZ77. In 1982, James Storer and Thomas Szymarski released their LZSS variant. In the early 1980s, Microsoft required some form of data compression for their installation media to cut down on the number of disks needed to install MS-DOS and Microsoft Windows, so they took Haruhiko Okumura's implementation of LZSS. Their compressed files had a SZDD signature.
  
  In 1989, Phil Katz put the deflate method in the public domain. Microsoft started using the algorithm to compress their installation media. The signature changed to KWAJ.
  
  In the early 1990s, various people invented new forms of disk formatting for the IBM PC, increasing the amount of space on a disk despite the PC's inflexible floppy disk controller. Once again, Microsoft products were getting bigger and bigger, so Microsoft took one of these disk formats and called it DMF, or Windows formatted disks.
  
  For most of the early 1990s, Jonathan Forbes had been writing fast versions of LZH archivers on the Amiga. In 1995, he and Tomi Poutanen devised an LZH adaption known as LZX. Its main benefits beyond deflate were a compact way of encoding large match offsets, and ramping up the size of the LZ sliding window. Furthermore, their Amiga implementation included file merging (known as solid archiving in RAR), where file data was grouped into large blocks, instead of files being individually compressed. This file merging technique also appeared in other new archivers around that time. By coincidence, Microsoft devised a new installation media which used file merging! This time, they were cabinet files or CABs. They included two compression methods - MSZIP (aka deflate) and Quantum, a large-window LZ compressor using arithmetic coding, licensed from its author David Stafford.
  
  In 1997, Jonathan Forbes went to work for Microsoft. Soon enough, cabinet files started supporting a modified form of LZX. But finally, Microsoft published an official specification for cabinet files, MSZIP and LZX. They did not detail Quantum, and their LZX specification contained errors to such extent that it was not possible to create a working compressor or decompressor from the specification.
  
  In 2000, Stuart Caie embarked on writing a CAB unpacker for Dirk Stöcker's XAD system. He discovers all of the above, including the LZX specification errors, but eventually comes up with a working LZX extractor. Being a generous devil, and wanting help with the remaining Quantum extractor, he converts his XAD client into a command-line CAB decompressor. In 2002, Matthew Russotto kindly researches and writes the Quantum extractor.
  
  In 2003, Stuart Caie launches a new library designed to support all major Microsoft compression formats, called libmspack.

Now what definition of proprietary can you concoct to make MSZIP non-proprietary?

Re:IE is part of Windows

[Anonymous Coward]

Thanks for the correction, I was unaware their spec was broken.

YOU actually have the whole story. The original poster was just being a reactionary dumbass about the "MSZIP" part.

Re:IE is part of Windows

[Curtman]

YOU actually have the whole story. The original poster was just being a reactionary dumbass about the "MSZIP" part.

Which original poster? I WAS the original poster. The parent to mine was saying that Mozilla somehow copied the packaging of ActiveX components. I went off googling for a reference to the ActiveX components, and discovered MS actually claims their proprietary cab format is non-proprietary.

Thats it.. No more replying to AC's for me.
<mental_note>There's a reason my threshold filters AC posts</mental_note>

Re:IE is part of Windows

[Anonymous Coward]

> Which original poster? I WAS the original poster
I know :)

(psst: on the intenet you are what's in your post...)

Yes, i've seen it

[Joff_NZ]

www.crack-locater.com tries to get you to install a couple of .xpi extensions into Mozilla... I naturally clicked "Cancel", so I couldn't tell you what they did...

Re:Yes, i've seen it

[Gary Destruction]

Are you sure that's the right site? It just looks like a search directory to me.

Re:Yes, i've seen it

[Joff_NZ]

Yes, you're right.. it was a misspelling, the site in question is www.crack-locator.com
Guess I should have checked that

Re:Yes, i've seen it

[Curtman]

Hah, all I got was this.

Re:Yes, i've seen it

[gazbo]

Here we go: I manually downloaded and unpacked the XPI file, to see the JS installer and an exe. Here's what AVG had to say about it.

Re:Yes, i've seen it

[Anonymous Coward]

Please learn how to make links.

Compromise your machine <a href="http://www.crack-locator.com">here</a> !

(without the "; " that Slashdot put in) yields: Compromise your machine here!

Re:Yes, i've seen it

[Anonymous Coward]

These site1 site2 do something similar.

Re:Yes, i've seen it

[gnu-generation-one]

"www.crack-locater.com tries to get you to install a couple of .xpi extensions into Mozilla... I naturally clicked "Cancel", so I couldn't tell you what they did..."

The page includes a 1x1pixel iframe, with CSS visiblility set to hidden, referencing:

http://stat4.z-stat.com/cl.html

That will give you a javascript prompt "sorry your browser is not Win32 compatible", then it will try to launch an XPI installer, and then it will try to send a windows executable file "application/exe, do you want to run or save"

Specifically, it uses the line
<iframe src=/download_plugin.exe></iframe>

And:
http://install.xxxtoolbar.com/ist/scripts/ prompt.p hp?event_type=onload&retry=3&account_id=133735&rec urrence=always&adid=a1057165573

if navigator.platform != 'Win32' then it will display the non-windows "error message"

If your browser is running on Win32, it will use an OBJECT tag to send you a .cab (cabinet, an installer archive?) file, plus it will attempt to open a popup window at install.xxxtoolbar.com, and will attempt to place it at a location well off-screen. When I tried downloading that file without the correct referer field, it returned a blank page with javascript to try and close the window.

if InstallTrigger.updateEnabled() is true, it will attempt to send you an XPI file, otherwise it will check to see if you're running netscape 4 and set document.location to a file called netscape_install.exe

The installer file itself is located at:
http://www.xxxtoolbar.com/ist/softwares/v3.0/ ist_n etscape.xpi

Actually, it turns out that the XPI file contains a Windows executable called istinstall_netscape.exe, along with an install.js javascript file which installs and runs the executable. Presumably the Windows nature of this program is the reason the webpage displays its own error message when it detects a non-Windows system.

Obviously, I have no interest in finding out what plugin.exe does if you chose to decomplile it, and I'm not sure I've got any programs which will look in the .cab file. I assume they attempt to run the same Windows exectuable in different ways, from within different packages.

So while there're XPI files to be had, it looks like there's fun for all the browser families at sites like that, and I hope internet explorer is as good as dealing with it as mozilla was.

Semi-OT: Why are extensions not signed ?

[Wudbaer]

I love Firefox and Thunderbird. But everytime I install an extension I really wonder: Why does noone bother to sign their extensions ? As the browser complains that the extension is not signed a mechanism to do that must be there.

Re:Semi-OT: Why are extensions not signed ?

[Anonymous Coward]

Signing extensions doesn't really help unless you have hierarchical or p2p trust relationships. Even then someone would have to identify bad code and revoke the trust relationship with the author.

Let's say I sign my extension with a private key named "George.Brampton@yahoo.com". How does that make you more confident that the extension is legit?

The only thing which signing would accomplish is making redistribution safer for people who actually check the signatures against the public keys on the authors website.

Re:Semi-OT: Why are extensions not signed ?

[ManxStef]

Surely you could get MozDev to be (one of) the top level Certificate Authority(s) though, seeing as it's already the main repository for plugins. Maybe XULPlanet and a few others too, along the same lines as the SSL cert. verification model. Establish some trusted bodies and give them the issuing responsibilities.

Get these bodies to issue a cert. to each project and provide a mechanism for signing code, then plug the above CA servers into Mozilla, Firefox, etc., write some checking code (displaying warnings for unsigned code, for example) then you're done :)
Not quite that easy in practice though, I guess?

Re:Semi-OT: Why are extensions not signed ?

[rempelos]

Do you know how much a certificate costs? When someone writes a small plugin and shares with the rest of the world for nothing, what reasons does he have to sign it.

If you want to install a plugin, just make sure you trust the provider. I think it's better to install plugins only from the official mozilla web site, just as a precaution.

Re:Semi-OT: Why are extensions not signed ?

[Anonymous Coward]

I think it's around $200 for a ActiveX cert, not ridiclously expensive.

But, others have pointed out, it would actually be better to create a signing authority at MozDev rather than have stuff signed by Joe Blow.

what reasons does he have to sign it

As Mozilla-based malware becomes more popular, Mozilla WILL have to change the install policy to require signed components. Just look at the path Microsoft took -- For IE3, signed ActiveX was optional, for IE4 it became required, and XP SP2 will have a bunch of other restrictions.

If you want to install a plugin, just make sure you trust the provider

"Trust, but Verify" -- without code signing, you can't do the latter part. Right now the evil doers could easily pretend to be Mozilla.org.

Re:Semi-OT: Why are extensions not signed ?

[Anonymous Coward]

WHY would you use MozDev as a certificate authority when we already have REAL certificate authorities? I highly, highly doubt the ability of MozDev to run a secure certificate authority service considering much larger businesses do that exclusively.

If you want a certificate, you must BUY a real one like everyone else. It costs money. Open Source people are against that.

not enough users...

[ajayrockrock]

Why would they even bother to attack a browser with such a low marketshare?

Re:not enough users...

[Gary Destruction]

IIS has a lower market share that Apache, yet it's attacked all the time. I think someone's trying to prove a point with the firefox extension malware.

Re:not enough users...

[kalidasa]

The script kiddies have Windows. They don't install Linux (and God knows they don't have Macs), so most of this stuff is written for Windows. Yes, Windows has an exceptionally bad security model, so this isn't the only (and may not even be the main) explanation, but it's important to keep in mind that it may be less about target richness than about how convenient a learning/test platform is.

Re:not enough users...

[Anonymous Coward]

Script kiddies don't write exploits, dumbass.

Difference between Linux and Windows

[atomic-penguin]

On a Linux-based system this would only affect the current user unless running Mozilla as root. But on a Windows system, depending on the version of Windows, the damage would be equivalent to that in an IE exploitation would it not?

Re:Difference between Linux and Windows

[Gary Destruction]

Theoretically, running as a non-privileged user on an NT-based system would prevent damage to system files or the registry. It would also prevent raw socket access which is only available to the administrator account. But most developers don't take the security into account and most people don't run 2000/XP as non-admin. O&O software is the first software maker I've seen that takes non-admin user accounts into consideration. They actually ask during setup who you want to have access to the program and its settings.

Re:Difference between Linux and Windows

[DiscoOnTheSide]

Personally I wouldn't think so, being that Firefox isn't as nuzzled closely in the OS code as IE is...

Re:Difference between Linux and Windows

[mikehoskins]

And then there is the issue of NTFS vs. FAT-32. With FAT-based filesystems, even on NT/2000/XP, everything runs as root. On NTFS-based filesystems, there is something of a security layer.

The next time you see a bootable C:\ drive formatted to FAT-32, note this: The OS, IE, and most apps are unprotected and can be compromised. In other words, in this configuration, IE is STILL running as root/administrator.

It's very odd that for backward compatibility reasons that M$ chose to leave FAT-32 insecure and that a file system can make an app insecure. This is most certainly not how Unix/Linux native filesystems behave.

Now why do people have FAT-32 on their bootup partitions on NT-based filesystems? Simple: It makes it really easy to image and to backup/resore to/from lots of software -- even old imaging and backup/restore apps based on non-NT OSes work with FAT-32. You could, in effect, use Windows 98/Me to image a bunch of NT/2000/XP machines in this configuration.

For example, the company I work for bought a COMPAQ desktop machine preloaded with XP. It came with a single partion (C:\) that was bootable and was formatted with FAT-32.

So, do you plan to buy that new NT-based operating system preinstalled? You had better check to see if any of your partitions that run software or store data use FAT-32.

Fortunately, there is a built-in utility to convert from FAT-32 to NTFS:

C:\WINNT\system32>convert /?
Converts FAT volumes to NTFS.

CONVERT volume /FS:NTFS [/V]

volume Specifies the drive letter (followed by a colon),
mount point, or volume name.
/FS:NTFS Specifies that the volume to be converted to NTFS.
/V Specifies that Convert should be run in verbose mode.

C:\WINNT\system32>

Re:Difference between Linux and Windows

[Anonymous Coward]

There's an MCSE Old Wives Tale that FAT is preferable for a boot partition. In practice, however, it hurts performance, security, and reliability, and doesn't help very much at all in a recovery situation.

CONVERT won't apply any permissions to your installation. There's no security in NTFS with your entire drive set to "Everyone:Full Control". There's some other process (that I've forgotten) to get the default ACLs applied, and even that's flaky.

I'm also kinda suprised that HP shipped you a FAT partition -- MS seems to be mandating NTFS for all OEM XP installations.

Re:Difference between Linux and Windows

[mikehoskins]

All true....

Only thing I've seen...

[J'raxis]

I've only come across a couple of porn sites that try to install something using the XPI facility, but you get prompted to install it. It was amidst a rats' nest of other dialogs popping up (not "popup" windows, just dialogs asking me to install extensions to handle all kinds of exotic filetypes and JavaScript alert() boxes), so I almost missed it.

Re:Only thing I've seen...

[silicon not in the v]

That's a rather appropriate place for "exotic" filetypes.

Re:Only thing I've seen...

[Anonymous Coward]

It's a good point that the current dialog box looks too much like a javascript "confirm()" prompt. Which probably make it too easy to just click OK without reading it.

One smart thing Microsoft did was make the ActiveX install dialog look unique and a little scary -- it says "Security Warning" and has it's own graphic.

Re:Only thing I've seen...

[J'raxis]

The Master Password dialog box is nearly identical to:

prompt( 'Please enter the master password for the Software Security Device.' );

Even the same icon is used, FFS. At least the Master Password icon should be something like a padlock, or a key, like other browsers use for their password dialogs.

The only difference is that the JavaScript version will say "[JavaScript Application]" in the title bar instead.

Re:Only thing I've seen...

[Anthracks]

For what it's worth, this is in Bugzilla as bug 101611 (http://bugzilla.mozilla.org/show_bug.cgi?id=10161 1), but there hasn't been any sort of work done on it.

Not Just Windows anymore....

[keoghp]

It's interesting to note that these security hacks and loop holes are not just restricted to "windows".

As other OS's and app's become more popular we will see a rise in breaches and attempted breaches of these systems.

No matter if your an Admin of a "microsoft", "Sun", "Linux" system. Security should still be on your agenda regardless of system.

Re:Not Just Windows anymore....

[Anonymous Coward]

Thankyou captain obvious.

-1 redundant

Re: E gets updated whenever a security flaw is fou

[orbman]

Take a look at
http://www.safecenter.net/UMBRELLAWEBV4/ie_unp atch ed/index.html
http://pivx.com/larholm/unpatched/
http://www.malware.com/index2.html
http://www.ee ye.com/html/Research/Upcoming/index.h tml
http://www.guninski.com/browsers.html

And for Mozilla, see
http://bugzilla.mozilla.org/
(search for "security" and sort by Severity)

How many bugs of type "silent delivery & execution of code" can you find for MS IE? How many in for Mozilla?

What's really funny....

[Fuzzle]

Is that I submitted a story about a website trying to install mal-ware through Mozilla 2 months ago, and it never got published. While I'm not trying to bitch about the editors, because it probably didn't seem that important, it's hilarious that now because someone has written "an article", which appears to be rambling, it's a large issue. Oh bla di.

Wow, talk about timing!

[GeckoX]

OK, well, AVG on my main system was screaming at me this morning, found a trojan browser-hijacker.

So what right?
Well, I haven't had a virus in _years_ now, AND, (here's the kicker), I do NOT run IE, EVER. Firefox exclusively and previous incarnations for years previous.

And no, it most deffinately did not come in through email.

So apparently, the article is correct.

(As well, I NEVER click ok or the like unless I KNOW i initiated installation of something myself, and I haven't seen anything like that anyways in the past few weeks.)

I'd love some more details and a patch ;)

Re:Wow, talk about timing!

[AngryWookiee]

I had similar experince just the other day using Firefox on Windows. My McAfee virus scan went crazy telling me that there was a javascript (no suprise that it was javascript but I can't ever remember having somethink like this happen with Firefox) file trying to run and the path that it was pointing to was in the mozilla directory, McAfee was unable to quartine or delete it (even though I went to another page and went to Privacy options and clicked the clear cache button) so I had to do it manually. The file was some type of javascript file (according to McAfee Virus Scan) but I could not see it for myself, McAfee was pointing to C:\Documents and Settings\UserName\Application Data\Phoenix\Profiles\default\9mwg5m76.slt\Cache\_ CACHE_001_\somename.js

I have also had one occasion where Firefox would start to download an executable file and ask me where I would like to save it, I just cancelled out of it, but none the less it was trying to download an exe file.

My computer has been running slowly since then which makes me think that there may be some type of virus, trojan, or spyware running but McAfee virus scan and Spybot tell me different.

Re:Wow, talk about timing!

[Anonymous Coward]

RUn www.avast.com home edition on your box. AVG does not catch them all.

Re:Wow, talk about timing!

[kfuq]

why dont you get a 2nd opinion ?

OS dependancy?

[polyp2000]

Im sure if one hacks around hard enough a security hole can be found in any browser. I'd like to hope the non-bloat nature of Mozilla and its open-source goodness would ensure to an extent that its inherently very secure, and that potential holes are fixed rapidly. However I think that one also has to take into account the operating system the browser is running on and whether any Mozilla exploits are dangerous accross different platforms. My guess is that though Mozilla is enjoying a good market share at the moment, any exploits that may arise are going to target the operating system, in most cases that will be Windows. Its pretty dificult to run arbitrary code on linux or OSX without being very stupid.

Even so, using Mozilla on windows is a sensible thing to do from a security perspective since it provides another layer of security. IE, is so tied into the OS in this regard, but Mozilla is more of a seperate entity.

nick ..

Re:OS dependancy?

[silicon not in the v]

I just reloaded a friend's old laptop last night that had been overrun by malware and spyware--toolbars, browser redirection, the whole bit. It's Win98SE, and he hadn't been very good keeping up on his Windows Update. I had gotten the CD of updates from Microsoft through February 2004, so I was able to keep his computer unplugged from the net for that. Then, I made a CD of some protection software--ZoneAlarm, Spybot, Firefox to load up before I connected him to the network. That was my first experience using Spybot S&D. It was really nice that is stays running and prompts you to accept or deny each registry change that is being attempted.

I've seen it

[alatesystems]

I saw one xpi try to install on cracks.am. I was happy and mad at the same time. It's mainstream!!!

Chris

Hoo, boy!

[gazbo]

the non-bloat nature of Mozilla

Oh man, you almost had me there!

Related info

[eyepeepackets]

I run Opera (IDs as IE) on a Slackware-based IBM laptop. Here is today's hijack string my Opera user got in his shell as I was browsing sites for heat pipes from a Google search:

Warning: Actions not found: addBookmark, viewBookmark, copy, undefined-key, find, findAgain, history, loadImages, openURL, mailNew, new, openFile, print, exit, reload, saveAs, paste, delete, cut, undo, historyItem, back, forward, abort, PageUp, PageDown

Didn't bother to determine which site did this as it doesn't bother me, but it was interesting to see.

Not necessarily

[nes11]

"While this is in a way cool (since that means the browser's now considered mainstream)"

actually it just means that hackers are finally starting to realize that people using IE rarely have data worth accessing. If someone's using FireFox, chances are they're bright enough to have some cool data.

On our webserver, we're only getting about 1.5% of 50,000 hits per day that our Firebird/Firefox, so it's still far from mainstream.

If it has user input and output ...

[Jahf]

Any program that is complex enough to have user input and system/user output is going to be possibly exploitable.

So yes, I believe it may be possible to exploit Mozilla.

But I also believe that the exploit will be known almost as soon as it hits the streets rather than being kept quiet until the devs get around to fixing it.

And if the devs don't quickly fix it I trust that the community will, because it is in their own interests.

The last 2 paragraphs are because Mozilla is open, IE is closed, plain and simple.

Not to mention that I don't believe that Mozilla is -as- vulnerable to exploits as IE nor will such exploits be as serious due to purposeful lack of OS integration.

Re:If it has user input and output ...

[Anonymous Coward]

This is NOT an "exploit"!!

Mozilla is functioning as designed, and it's designed to allow ActiveX-style installation of either cool stuff or malware from the internet.

Just came across one...

[raj2569]

http://public.searchbarcash.com/v2/prompt.php?p=9F D0986F08B7A3A78E58EA0BA7D7954967FEF1419B066DF507A3 4BFBE0441883698566F3B68DF40448AC9A8309A1DE98CFEADA A19AB062C96BF6FCB02431F41783FD95A9751819B0D69E4766 069F882D40938F635FA9C5E34D3FAA84DC818401D6DE0D8818 FE60E4F0CAC3638AA07AB3EC36C9F96DC232EBC4C884963972 446AAFECB8026C6FE467D0

from http://www.bkahuna.scripterz.org/dg-tproxy.html

raj

Please learn how to make links.

[Anonymous Coward]

Please learn how to make links.

<a href="http://www.safecenter.net/UMBRELLAWEBV4/ie_u npatched/index.html">safe center</a>

yields: safe center

etc.

Re:Please learn how to make links.

[marcus]

Please learn how to

highlight text
hit Ctrl-T for a new tab
hit middle mouse button to paste text
hit Enter to go

It takes a lot less time than typing all that other stuff you suggested. Don't tell me about inferior hardware or software. Those are your choices. ;-)

Re:Please learn how to make links.

[John Harrison]

The problem is that /. mangles URLs by randomly inserting spaces, so it is considered good etiquette to input links as HTML.

Re: E gets updated whenever a security flaw is fou

[cookd]

So what you're saying is:

Check all of these 3rd-party sites that I have chosen which list a bunch of security holes for Explorer. How evil! Now check a specific query that I have chosen. See! No bugs!

Well, duh. If you get to pick the evidence, you can prove whatever you want. I'll try my hand at this game. Try this page. 9 serious security issues in the November 2003 update. And I was even nice and kept it on Mozilla's own site. These are the vulnerabilities that were fixed in the last release. Good job, but that isn't any better than the IE story.

BTW, I wasn't very impressed with the vulnerabilities on the pages you linked to. Some of them are "vulnerabilities that must be executed in the My Computer domain" (um, the My Computer domain means you are a program on the local computer, so how is that a vulnerability?), others that exploit holes in 3rd party plugins, and others that require the user to click OK a couple of times. I'm really not sure how you can consider any of those as real problems with IE. Sure, they're opportunities for social engineering, but those aren't security flaws any more than any other program that allows you to download code from the Internet. Yep -- FTP is an insecure program, because if you type "GET program.exe", then double click on program.exe, it runs code on your computer!

The ones that actually seem to be dangerous and due to actual problems with Explorer and not false alarms or 3rd-party issues, well they don't seemt to work very well. Perhaps they've been patched?

Honestly, I use both IE and FireFox. They both have pros and cons. They both have security issues. But neither one has a clear advantage in terms of security. Hackers are creative, and they come up with new attacks every day. No code is perfect, but it seems that everybody is doing the best they can do.

Different data here

[kmike]

Webalizer stats for May:
1 39346847 78.96% MSIE 6.0
2 4523223 9.08% Mozilla/5.0
3 2250067 4.52% MSIE 5.5
4 710608 1.43% MSIE 5.0
5 696715 1.40% MSIE 5.01

Ok, I know some browsers other than Mozilla disguise as Mozilla/5.0, but their number should be really insignificant.
And no, it's not very geeky site, it's a forum for R/C enthusiasts.

Re:Different data here

[nes11]

Interesting. Our site is a small private university, so I'm sure the majority of our visitors are parents, grandparents, or alumni that are the farthest from the geek spectrum. And I would guess that R/C visitors are a little more on the geeky side than not. It would be really interesting to see results from someplace like yahoo or google to see the middle of the road.

Re:Different data here

[Anonymous Coward]

Check out Google Zeitgeist.

auto download

[dotpl]

the auto download feature in firefox is great. But what about those site that automatically redirect to an executable file?

A user visits the site, and the autodownload kicks in; the file being so small it will not pop up the download window. Later on, the user looks at his desktop and sees an executable. he double clicks.

I think the autodownload should be disabled for links that the user hasn't clicked on. If the site is pushing a download, the browser should prompt the user.

it has been reported, but the devs don't seem to agree.

My advice...

[Maljin Jolt]

If I would be a web browser designer/engineer, I'd force a privilege degradation for browser process. Just like web server runs under user apache and ftp runs under ftp, browser would be running under user "browser". Saving stuff only to some dedicated "download" area, no-no executable filesystem by default with proper quarantine checks. So the user should manually move stuff into his property to execute it, if she wants to. Or run it in other jail.

Technically, it is possible to do it on KDE desktop for example, with a little shell scripts and/or .desktop shortcuts to run as a different user.

Perhaps a distro aggregators should prepare such environment for moron users by default.

Re:My advice...

[smcv]

It's a limitation of the Unix user model (and probably also the Windows user model) that only root can change userID to become a less priviledged user (programs like su, sudo, ksu, etc. are all setuid root, or at least communicate with something that is, in order to accomplish this). Making a program that can switch UID thus requires setuid bits and other unpleasantness, and requires active intervention from root.

(It's particularly nasty if you want to avoid active attacks rather than just mistakes, because you then have to ensure that you've irrevocably changed UID and that there's no going back - looking at Linux man pages, there are some unwelcome interactions between real, effective and saved UIDs, and between BSD and POSIX semantics.)

It would be nice to have some feature where there's a hierarchy of users, either hard-coded (e.g. a user fred can setuid() to any user whose name starts with fred-, but the sub-users can't setuid() back), or, better, dynamically defined by root (e.g. by writing something into /proc or /sys, which you'd normally want to do during boot).

I might see if I can implement this after my exams finish: "Feudal Linux", perhaps?

Idle musing about what I'd want to happen, assuming that fred-www is a sub-user of fred:
- if a file's permissions let fred-www read or write it, so can fred
- if fred-www can traverse a directory, so can fred
- fred can't execute fred-www's files? Fairly useless in practice, since the problem is more likely to be with scripts, plugins etc., in which case it's the application's responsibility to protect users from accidentally executing other users' files
- fred can send signals to fred-www's processes (so kill/xkill still work, for when the browser crashes or uses excessive CPU time), but not vice versa (because otherwise fred-www could be extremely annoying)
- root (or, looking at kernel/sys.c, anyone with capability CAP_SETUID) implicitly has everyone else as a sub-user

Of course, this idea is partly inspired by the vapourware/semi-hoax project Jesux (I don't agree with the goal, but that doesn't mean they can't have good ideas :-)

(Alternatively, User-mode Linux could be an idea to look into.)

I saw one non self installing one

[auzy]

The other day I saw one that wasn't self installing, however had the mozilla firefox extensions.. Maybe the mozilla developers should have security levels on the extensions so that certain ones can be permanently blocked so u dont accidently install them, after the 10th time its popped up.. Would also be nice if there was a untrusted extensions database too, that means that if someone chooses to use it, that some known dodgy applets would be blocked (which contain spyware or whatever).. But to avoid any legal problems, just let users mark stuff as spyware, and when a certain threshold is reached.. block it in the database.

Being hetrogenous reusing code

[nfabl]

One of the major problems with Windows and IE isn't so much the quality of the code, but the fact that everyone is running the same code, hell even the same binary. Hence the worms can be spread so easily.

Mozilla/Firewombat have so many different versions floating about that a large scale exploit would be very difficult to pull off.

The fact that mozilla's ssl implementation is new and probably less tested will never make it more of a target than IEs or windows, even if mozilla became as popular. (So long as mozilla is forever in active development.)

I think this vulnerability has been fixed

[Anthracks]

Unless I've missed something, bug 238684 (http://bugzilla.mozilla.org/show_bug.cgi?id=23868 4) greatly reduced this risk. As I read the bug/patch, it makes it impossible for a page to "automatically" ask you to download an XPI; you have to actually click a link or take some other real action. I'm sure clever spyware authors will get around this new protection eventually, but it's a step in the right direction. It was checked in about a month ago, so it'll be in Mozilla 1.7 and beyond and I would assume Firefox 0.9 and beyond.

Re: E gets updated whenever a security flaw is fou

[orbman]

There are many old/new tricks for MS IE that allows
malicious scripts to cross MS IE security zones too.

MS IE is an increasing target for the attackers, just
like MS Outlook was/is. Just wait and see.

Re: E gets updated whenever a security flaw is fou

[cookd]

There are many old/new tricks for Mozilla that allows (sic)
malicious scripts to cross Mozilla security zones too.
(Well, they aren't called security zones, but some scripts get more privileges than others.)

Mozilla is an increasing target for the attackers, just
like every other program that touches a network was/is. Just wait and see.

(Grin.)