Slashdot Mirror
Can Mozilla-Based Browsers be Hijacked?
Chibi Merrow asks: "Matt Hartley in his latest GnomeReport speaks of supposed browser hijacker programs that are now targeting Mozilla FireFox instead of IE. While this is in a way cool (since that means the browser's now considered mainstream), it's also hard to believe. It doesn't help that his article is very light on details. Now there have been some discussion about spyware masquerading as valid extensions; but they require user intervention to install. Most people think of a browser hijack as something that automatically installs itself. Has anyone ever encountered an actual self installing browser hijacker/spyware program that has targeted Mozilla Firefox, or is this a bunch of FUD?"
One of the reasons that IE is so susceptible to this sort of thing is because of ActiveX - an inherent security hole. While xpinstall is similar, it will always require clear user input to get the extension installed.
And lets not forget the obvious - IE6 is always going to be bad for this. Mozilla gets updated each and every day and has a regular release schedule.
I know who I'd rely on for the latest and greatest security tech.
Free iPods - now in the UK!
I love Firefox and Thunderbird. But everytime I install an extension I really wonder: Why does noone bother to sign their extensions ? As the browser complains that the extension is not signed a mechanism to do that must be there.
IIS has a lower market share that Apache, yet it's attacked all the time. I think someone's trying to prove a point with the firefox extension malware.
Integration into the OS makes the scope of IE vulnerabilites larger, but it doesn't necessarily make IE less safe. Microsofts neglect towards known vulnerabilities is a problem, but a similar attitude would hit Mozilla just as hard.
An example: For a short time, several themers chose to distribute Mozilla skins in XPI form, because that allowed users to install them without additional files. The now preferred way of installing skins requires the help of a script, either in the browser (theme installer extension) or on a webpage. The latter method does not give skins access to JavaScript and is considered safe. XPIs can do a lot more: The installation process can run arbitrary code on the target system and even skins which are installed this way can later on access browser resources and relay them to an external attacker.
It's interesting to note that these security hacks and loop holes are not just restricted to "windows".
As other OS's and app's become more popular we will see a rise in breaches and attempted breaches of these systems.
No matter if your an Admin of a "microsoft", "Sun", "Linux" system. Security should still be on your agenda regardless of system.
For problems, seek only the simplest solution, complexity brings with it more problems.
"While this is in a way cool (since that means the browser's now considered mainstream)"
actually it just means that hackers are finally starting to realize that people using IE rarely have data worth accessing. If someone's using FireFox, chances are they're bright enough to have some cool data.
On our webserver, we're only getting about 1.5% of 50,000 hits per day that our Firebird/Firefox, so it's still far from mainstream.
Any program that is complex enough to have user input and system/user output is going to be possibly exploitable.
So yes, I believe it may be possible to exploit Mozilla.
But I also believe that the exploit will be known almost as soon as it hits the streets rather than being kept quiet until the devs get around to fixing it.
And if the devs don't quickly fix it I trust that the community will, because it is in their own interests.
The last 2 paragraphs are because Mozilla is open, IE is closed, plain and simple.
Not to mention that I don't believe that Mozilla is -as- vulnerable to exploits as IE nor will such exploits be as serious due to purposeful lack of OS integration.
It is more productive to voice thoughtful opinions (reply) than to judge (moderate) others.
> It's Unix philosphy
And "Windows Philosphy" would be to use the built-in HTTPS libs. The idea of shared code isn't exclusive to Unix.
The fact is that Netscape^WMozilla has always seeen themeselves as their own 'operating system' layer. Remember Andreeson and his quip about "reducing Windows to a bunch of poorly debugged device drivers" -- well, the same attitute lives on today at mozilla.org.
It's a good point that the current dialog box looks too much like a javascript "confirm()" prompt. Which probably make it too easy to just click OK without reading it.
One smart thing Microsoft did was make the ActiveX install dialog look unique and a little scary -- it says "Security Warning" and has it's own graphic.
The problem is that /. mangles URLs by randomly inserting spaces, so it is considered good etiquette to input links as HTML.
Lasers Controlled Games!
So what you're saying is:
Check all of these 3rd-party sites that I have chosen which list a bunch of security holes for Explorer. How evil! Now check a specific query that I have chosen. See! No bugs!
Well, duh. If you get to pick the evidence, you can prove whatever you want. I'll try my hand at this game. Try this page. 9 serious security issues in the November 2003 update. And I was even nice and kept it on Mozilla's own site. These are the vulnerabilities that were fixed in the last release. Good job, but that isn't any better than the IE story.
BTW, I wasn't very impressed with the vulnerabilities on the pages you linked to. Some of them are "vulnerabilities that must be executed in the My Computer domain" (um, the My Computer domain means you are a program on the local computer, so how is that a vulnerability?), others that exploit holes in 3rd party plugins, and others that require the user to click OK a couple of times. I'm really not sure how you can consider any of those as real problems with IE. Sure, they're opportunities for social engineering, but those aren't security flaws any more than any other program that allows you to download code from the Internet. Yep -- FTP is an insecure program, because if you type "GET program.exe", then double click on program.exe, it runs code on your computer!
The ones that actually seem to be dangerous and due to actual problems with Explorer and not false alarms or 3rd-party issues, well they don't seemt to work very well. Perhaps they've been patched?
Honestly, I use both IE and FireFox. They both have pros and cons. They both have security issues. But neither one has a clear advantage in terms of security. Hackers are creative, and they come up with new attacks every day. No code is perfect, but it seems that everybody is doing the best they can do.
Time flies like an arrow. Fruit flies like a banana.