Can Mozilla-Based Browsers be Hijacked?

Chibi Merrow asks: "Matt Hartley in his latest GnomeReport speaks of supposed browser hijacker programs that are now targeting Mozilla FireFox instead of IE. While this is in a way cool (since that means the browser's now considered mainstream), it's also hard to believe. It doesn't help that his article is very light on details. Now there have been some discussion about spyware masquerading as valid extensions; but they require user intervention to install. Most people think of a browser hijack as something that automatically installs itself. Has anyone ever encountered an actual self installing browser hijacker/spyware program that has targeted Mozilla Firefox, or is this a bunch of FUD?"

Comments

Re:No ActiveX

[Anonymous Coward]

IE's default security settings will only install signed ActiveX controls, and that's AFTER the user agrees to it. It's no different than with Mozilla's.

IE is part of Windows

[Gary Destruction]

That in of itself makes it more insecure. I mean, it uses Windows' SSL whereas Mozilla has its own SSL. It has Windows remember passwords whereas Mozilla has a password manager. Mozilla just being a stand alone app makes it safer in that regard. And even a recent exploit caused by an issue with file extension spoofing vulnerability was an issue only with IE. Mozilla still showed the file's name in its entirety.

Re:IE is part of Windows

[Curtman]

• Why not just make a plugin that has an installer or a self-extract zip file or something of that nature?

Haha. That's exactly what they did do. To quote the manual:

An XPI file is nothing more than a ZIP file with its own installation script. Using a ZIP utility, you can archive the xfly directory and preserve the subdirectory structure so it's installed in the user's chrome directory as it is in your own. Make sure that the ZIP file, whatever it's called, contains the top-level xfly subdirectory as part of this structure. If it is a JAR file you are distributing for your package, make the JAR file (xfly.jar) the top level, with the content, skin, and locale directories contained within

Re:IE is part of Windows

[Curtman]

Who ever said the packaging for ActiveX should be more complicated?

I love that bit where they say

• The .cab file format is a nonproprietary compression format, also known as MSZIP, that is based on the Lempel-Ziv data-compression algorithm. (Other compression formats might also be supported later.)

I'd hate to see what Microsoft considers to be proprietary, because .cab and 'MSZIP' would fit my definition pretty closely.

Re:IE is part of Windows

[Curtman]

First off, Mozilla does support signed components, and has for a long time.
And are you fucking kidding me? MSZIP? And you don't think that's proprietary? Lets take a stroll down memory lane:

• CAB History
• 
  
  In 1977, Abraham Lempel and Jacob Ziv devised and published a paper on their new compression method, LZ77. In 1982, James Storer and Thomas Szymarski released their LZSS variant. In the early 1980s, Microsoft required some form of data compression for their installation media to cut down on the number of disks needed to install MS-DOS and Microsoft Windows, so they took Haruhiko Okumura's implementation of LZSS. Their compressed files had a SZDD signature.
  
  In 1989, Phil Katz put the deflate method in the public domain. Microsoft started using the algorithm to compress their installation media. The signature changed to KWAJ.
  
  In the early 1990s, various people invented new forms of disk formatting for the IBM PC, increasing the amount of space on a disk despite the PC's inflexible floppy disk controller. Once again, Microsoft products were getting bigger and bigger, so Microsoft took one of these disk formats and called it DMF, or Windows formatted disks.
  
  For most of the early 1990s, Jonathan Forbes had been writing fast versions of LZH archivers on the Amiga. In 1995, he and Tomi Poutanen devised an LZH adaption known as LZX. Its main benefits beyond deflate were a compact way of encoding large match offsets, and ramping up the size of the LZ sliding window. Furthermore, their Amiga implementation included file merging (known as solid archiving in RAR), where file data was grouped into large blocks, instead of files being individually compressed. This file merging technique also appeared in other new archivers around that time. By coincidence, Microsoft devised a new installation media which used file merging! This time, they were cabinet files or CABs. They included two compression methods - MSZIP (aka deflate) and Quantum, a large-window LZ compressor using arithmetic coding, licensed from its author David Stafford.
  
  In 1997, Jonathan Forbes went to work for Microsoft. Soon enough, cabinet files started supporting a modified form of LZX. But finally, Microsoft published an official specification for cabinet files, MSZIP and LZX. They did not detail Quantum, and their LZX specification contained errors to such extent that it was not possible to create a working compressor or decompressor from the specification.
  
  In 2000, Stuart Caie embarked on writing a CAB unpacker for Dirk Stöcker's XAD system. He discovers all of the above, including the LZX specification errors, but eventually comes up with a working LZX extractor. Being a generous devil, and wanting help with the remaining Quantum extractor, he converts his XAD client into a command-line CAB decompressor. In 2002, Matthew Russotto kindly researches and writes the Quantum extractor.
  
  In 2003, Stuart Caie launches a new library designed to support all major Microsoft compression formats, called libmspack.

Now what definition of proprietary can you concoct to make MSZIP non-proprietary?

Yes, i've seen it

[Joff_NZ]

www.crack-locater.com tries to get you to install a couple of .xpi extensions into Mozilla... I naturally clicked "Cancel", so I couldn't tell you what they did...

Re:Yes, i've seen it

[Joff_NZ]

Yes, you're right.. it was a misspelling, the site in question is www.crack-locator.com
Guess I should have checked that

Re:Yes, i've seen it

[Curtman]

Hah, all I got was this.

Re:Yes, i've seen it

[gazbo]

Here we go: I manually downloaded and unpacked the XPI file, to see the JS installer and an exe. Here's what AVG had to say about it.

Only thing I've seen...

[J'raxis]

I've only come across a couple of porn sites that try to install something using the XPI facility, but you get prompted to install it. It was amidst a rats' nest of other dialogs popping up (not "popup" windows, just dialogs asking me to install extensions to handle all kinds of exotic filetypes and JavaScript alert() boxes), so I almost missed it.

Re:Difference between Linux and Windows

[Gary Destruction]

Theoretically, running as a non-privileged user on an NT-based system would prevent damage to system files or the registry. It would also prevent raw socket access which is only available to the administrator account. But most developers don't take the security into account and most people don't run 2000/XP as non-admin. O&O software is the first software maker I've seen that takes non-admin user accounts into consideration. They actually ask during setup who you want to have access to the program and its settings.

Re:No ActiveX

[Curtman]

• IE gets updated whenever a security flaw is found. And the user is prompted to download the update. I don't get alerts when FireFox needs an update -- I go to the website once in a while. You tell me which method is more likely to keep my dad's computer secure.

You're wrong. Mozilla, and Firefox both inform you about about updates. take a look at the URL 'about:config' and filter for 'update_notifications'. Unless you changed something, update_notifications.enabled will be set to true, and when a new version is released, you'll be brought to the moz homepage when a new version is available. You'll also see a setting there for frequency to check for updates, and a time of the last check.

Re: E gets updated whenever a security flaw is fou

[orbman]

Take a look at
http://www.safecenter.net/UMBRELLAWEBV4/ie_unp atch ed/index.html
http://pivx.com/larholm/unpatched/
http://www.malware.com/index2.html
http://www.ee ye.com/html/Research/Upcoming/index.h tml
http://www.guninski.com/browsers.html

And for Mozilla, see
http://bugzilla.mozilla.org/
(search for "security" and sort by Severity)

How many bugs of type "silent delivery & execution of code" can you find for MS IE? How many in for Mozilla?

Re:No ActiveX

[ccady]

ActiveX itself doesn't offer any way to auto-install software without the user's agreement, unless the user changes the Internet Security settings.

AFAIK Mozilla never allows you to auto-install without a warning.

IE gets updated whenever a security flaw is found.

B.S.

Wow, talk about timing!

[GeckoX]

OK, well, AVG on my main system was screaming at me this morning, found a trojan browser-hijacker.

So what right?
Well, I haven't had a virus in _years_ now, AND, (here's the kicker), I do NOT run IE, EVER. Firefox exclusively and previous incarnations for years previous.

And no, it most deffinately did not come in through email.

So apparently, the article is correct.

(As well, I NEVER click ok or the like unless I KNOW i initiated installation of something myself, and I haven't seen anything like that anyways in the past few weeks.)

I'd love some more details and a patch ;)

Related info

[eyepeepackets]

I run Opera (IDs as IE) on a Slackware-based IBM laptop. Here is today's hijack string my Opera user got in his shell as I was browsing sites for heat pipes from a Google search:

Warning: Actions not found: addBookmark, viewBookmark, copy, undefined-key, find, findAgain, history, loadImages, openURL, mailNew, new, openFile, print, exit, reload, saveAs, paste, delete, cut, undo, historyItem, back, forward, abort, PageUp, PageDown

Didn't bother to determine which site did this as it doesn't bother me, but it was interesting to see.

Re:Difference between Linux and Windows

[mikehoskins]

And then there is the issue of NTFS vs. FAT-32. With FAT-based filesystems, even on NT/2000/XP, everything runs as root. On NTFS-based filesystems, there is something of a security layer.

The next time you see a bootable C:\ drive formatted to FAT-32, note this: The OS, IE, and most apps are unprotected and can be compromised. In other words, in this configuration, IE is STILL running as root/administrator.

It's very odd that for backward compatibility reasons that M$ chose to leave FAT-32 insecure and that a file system can make an app insecure. This is most certainly not how Unix/Linux native filesystems behave.

Now why do people have FAT-32 on their bootup partitions on NT-based filesystems? Simple: It makes it really easy to image and to backup/resore to/from lots of software -- even old imaging and backup/restore apps based on non-NT OSes work with FAT-32. You could, in effect, use Windows 98/Me to image a bunch of NT/2000/XP machines in this configuration.

For example, the company I work for bought a COMPAQ desktop machine preloaded with XP. It came with a single partion (C:\) that was bootable and was formatted with FAT-32.

So, do you plan to buy that new NT-based operating system preinstalled? You had better check to see if any of your partitions that run software or store data use FAT-32.

Fortunately, there is a built-in utility to convert from FAT-32 to NTFS:

C:\WINNT\system32>convert /?
Converts FAT volumes to NTFS.

CONVERT volume /FS:NTFS [/V]

volume Specifies the drive letter (followed by a colon),
mount point, or volume name.
/FS:NTFS Specifies that the volume to be converted to NTFS.
/V Specifies that Convert should be run in verbose mode.

C:\WINNT\system32>