Slashdot Mirror
Mozilla Developers Respond to Malware
An anonymous reader writes "Last week's well- publicised (and quickly fixed) security hole in Mozilla, Firefox and Thunderbird reminded the Slashdot faithful that Mozilla is not invincible and that it is now big enough for malware (virus and spyware) authors to target. MozillaZine has a short article on this topic, looking at the rise in attacks aimed at Mozilla and how the developers are responding."
wasn't this bug known for a while and was just recently issued a fix for it?
Some microsoft products were affected also.
- Enable Javascript
- Enable install from XPI locally and globally
- Click on a Javascript link on a WWW page (which would be shown in status bar) (N.B. Mozilla does not execute XPI-related JS automatically--the user must have clicked the link)
- Wait a few seconds while watching a very large uncancellable dialog box saying "A website is requesting permission to install the following item", giving full details of the program it is installing (including its signatures in big red letters, its name and its URI), and saying in big bold letters, "Malicious software can damage your computer or violate your privacy. You can only install software from source you can trust."
- After waiting a few seconds you, you then had to press a button labelled "install now".
I'm guessing that even some ex-MSIE users might not go through all that on the request of a malicious WWW site they have found.I digress.
Joe Llywelyn Griffith Blakesley
[This post is in the public domain (copyright-free) unless otherwise stated]
Also please note the steps on had to take to get infected by malware before the fix (whitelisting domains):
I would like to point out that this is slightly misleading (as it implies Mozilla had a security flaw before the fix), because, even before the whitelist fix was added, you had to do the following to get infected by any malware:- Enable Javascript (enabled by default)
- Enable install from XPI locally and globally (enabled by default??)
- Click on a Javascript link on a WWW page (which would be shown in status bar) (N.B. Mozilla does not execute XPI-related JS automatically--the user must have clicked the link)
- Wait a few seconds while watching a very large uncancellable dialog box saying "A website is requesting permission to install the following item", giving full details of the program it is installing (including its signatures in big red letters, its name and its URI), and saying in big bold letters, "Malicious software can damage your computer or violate your privacy. You can only install software from source you can trust."
- After waiting a few seconds you, you then had to press a button labelled "install now".
I'm guessing that even some ex-MSIE users might not go through all that on the request of a malicious WWW site they have found.I digress.
Joe Llywelyn Griffith Blakesley
[This post is in the public domain (copyright-free) unless otherwise stated]
Of course, you could take those lumbering ME boxes and put Mandrake on them and fix all the problems, but so many foolishly opt for XP. 'Tis a shame...
see http://secunia.com/advisories/12048/
Join Team Mozilla #38050 Folding@home
Serial Meta Moderator
Tell you what, you look at the Mozilla source code and find out about the recently discussed problems.
Here's the catch: the problem was caused by undocumented behaviour in the Microsoft Windows APIs for handling URLs. No source audit by somebody who didn't know about that behaviour would have found it, because those APIs are closed source.
I would like to point out that this is slightly misleading (as it implies Mozilla had a security flaw before the fix), because, even before the whitelist fix was added, you had to do the following to get infected by any malware...
I don't think this is true. The specific exploit in XP allows shell: protocol links to run arbitrary code if crafted properly. Mozilla was passing these links right on to the OS.
I think you are confusing this bug with the idea that people can install malware via XPI.
Ironically, the word ironically is often used incorrectly.
Firefox will have auto-update (optional, on by default) in version 1.0.
Why is anything anything?
Eh? Opera's equivalent technology is described here.
This problem is identical to a serious vulnerability recently discovered in Safari where a nafarious site could make use of the disk:// URI handler and the default automatic custom URI installer to download and execute arbitrary code. Has anyone checked to see if Mozilla/FireFox are also vulnerable to this?
They were, until the problem was worked around in Firefox and fixed in Mac OS X.
The shareholder is always right.
My solution to adware/spyware/malware is to run both spybot and ad-aware regularly (teatimer is running) and to occasionally run Mike Lin's Startup Control Panel and look to see if anything unusual has cropped up. There's no solution like watching those registry locations yourself so you can recognize what is and what is not malware.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
I have a response to your leaving F/OSS in my Journal
I invite anybody to read and reply to it.
--
I would like to also point out that this is also a case of "his issue, not mine", that has been the bane of all software (and much hardware) in both Open and Proprietary shops since the Epoch.
This issue is a vulnerability in a Microsoft technology, that just happens to - also - be accessible through Mozilla. Some people chose to ignore this issue simply because they believed that Microsoft would fix the underlying problem.
Two years later, they are realizing that Microsoft is not prone to attempt to fix this problem - and that something really needs to be done. This is the right direction. Because all security issues are every vendor's/project's problem. Not Microsoft or Mozilla, but both. Now that Mozilla is willing to look at it that way, then, the Mozilla project has made a great stride towards future improvement.
Kinetic stupidity has a new brand leader: Allen Zadr.
Have you tried going into userprefs.js and adjusting the timeout? For example, to increase it to five minutes:
user_pref("network.http.connect.timeout", 300);
That the story submitter buys into the "it's insecure because it's popular" myth is one thing; for Slashdot to willy-nilly accept it is another. Very odd.
That the "shell://" hole in Mozilla (thereby Firefox and Thunderbird) exists is true; but it is not truly a Mozilla whole; Mozilla passes the unhandled scheme to Windows and Windows serves the hole. It's a Windows hole. MS Word (among others) also is vulnerable to the "shell://" exploit.
This exploit is specific to Windows. Windows is being targeted, not Mozilla.
So, don't just move to a more secure browser, jump to Mac OS X, Linux, and or *BSD for a better Internet Experience.
-- @rjamestaylor on Ello