Slashdot Mirror
Mozilla Developers Respond to Malware
An anonymous reader writes "Last week's well- publicised (and quickly fixed) security hole in Mozilla, Firefox and Thunderbird reminded the Slashdot faithful that Mozilla is not invincible and that it is now big enough for malware (virus and spyware) authors to target. MozillaZine has a short article on this topic, looking at the rise in attacks aimed at Mozilla and how the developers are responding."
wasn't this bug known for a while and was just recently issued a fix for it?
I'd still rather use a marginally flawed Mozilla browser than a fully dysfunctional Intercourse Exploiter browser
--- I'm going to get a score of -1 for this post because the mods are fuckers.
I'm quite happy to see that the Mozilla team is pro-active in fixing the bugs that could allow MalWare to install unchecked.
Yet, a base Mozilla 1.7 downloaded right after release will have this issue for a very long time. This situation is worse, in one big way, than the Internet Explorer issues; Mozilla users 'feel' safe. Non-techies that use Mozilla assume it's 'safe' because a geek once told them that this is the case.
I've been an Open Source supporter for quite a long while, but the days of relative desktop safety for F/OSS cross-over users is coming to a close.
And, I'm probably not the only one who "shivers", when reading, "... almost a carbon copy of the new Internet Explorer Information Bar ..."
There's no way to defend that.
Kinetic stupidity has a new brand leader: Allen Zadr.
Will be how fast the community can fix these types of issues compared to M$'s response time.
I think we all know that whatever is the popular software is what will be targeted so the big difference maybe how it's responded to.
"If any question why we died, Tell them because our fathers lied."
Some microsoft products were affected also.
this is precisely the reason the Firefox was equipped with thought guided missiles...to destroy unseen threats.
Linux is to the internet as Duct Tape is to the Universe.
This coupled with the fact moz/firefox is already more secure than IE means Moz users are not invunerable but we have a better chance than the IE crowd.
If moz gets too bad, I'll just switch to Opera. What we need in the long run, is to have a totally new browser developed about 6 times a year. If everyone switches browsers every other month, these malware stooges will be put in their place.
I think that there is a major disadvantage when it comes to attacking the Mozilla series of applications -- they are all on multiple operating systems. It's worth noting that this bug was only found on Windows systems operating Mozilla, and while this may be the largest base of people using the program, I get the impression that a lot Linux and OSX folks are using them as well. Yet everyone is so eager to jump on Mozilla for having a bug, even though it only affected one of the operating systems. I think that's a pretty good track record, espically with the speed that it's been fixed in. I'd like to see that with IE.
If that's not good enough... just install the Internet Explorer skin for firefox.
if people are going to start targetting mozilla for exploits, then we can see the true difference between security/stability of OSS vs proprietary products. i have no doubt that mozilla will come out in the lead, because in being open source when there IS a problem, it is fixed in a timely manner :)
There is a fine line between easy to use and easy to exploit. Let's not repeat the mistakes of others.
UNIX/Linux Consulting
It was widely reported that a flaw was found in 'Mozilla' which was not correct. The flaw was in the Shell: protocol on Windows. That's why the alleged 'flaw' in Mozilla did not exist on non-Windows platforms. The only 'flaw' in Mozilla was its failure to block the use of the shell: stuff on Windows (which the patch now does).
"Note that this only affects users of Mozilla and Firefox on Windows XP or Windows 2000."
Actually I think the biggest marketing achievement in the last 10 years was Microsoft convincing the public that Win2000/XP is more secure than Win9x.
Rest assured, if Firefox ever does make it big time, ~20-30% of browsers, malware writers WILL exploit any hole they can find.
Hopefully the developers will be quick enough to fix it, but will users be sharp enough to get the patches. I think automatic updates for firefox are what is needed to ensure users have less to worry about. I know myself that the patch for the shell exploit was not a simple matter of clicking search for updates, as the update program times 0out after 2 secs.
Firefox won't be immune to the legions of spammers, crackers, marketers and pornographers which have already begun to exploit it. With some kind of autoinstaller/updater or a faster update cycle users could be confident that whatever new tricks the spammers come up with, the fixes will be prompt. Hopefully anyway.
I know autoinstallers aren't in vouge, for many good reasons. But if it's just for one, largely selfcontained program, would it really be so bad.
Maybe at the very least mozilla could have a list of critical, anti-spam and other update categories. Or would that just confuse people
May the Maths Be with you!
These exploits are just the price of success in the browser business. I have no doubt that Mozilla products are more secure than IE, but even if significant holes are found, I'll put the turnaround time for the fix up against MS track record anyday.
"The problem with internet quotations is that many are not genuine" -Abraham Lincoln
I thought Mozilla WAS the response to malware.
Now let us hope that there are no spoofing mechanisms discovered that result in users believing they're on one of the whitelisted sites to allow such installations. As someone on that board had already pointed out, allowing all of mozilla.org as a means to install code can result in people taking advantage of bugzilla.mozilla.org and ftp.mozilla.org.
You know, I really appreciate hearing from developers who recognize a potential threat and are informing us how they are working to fight the problem. Their method might be taking a page out of Internet Explorer for SP2, but if it works than it's good.
This story comes at a perfect time for me. I'm a Mozilla diehard, and I just ran Ad Aware 6 to find that some malware bypassed security (even Norton Internet Security) to install itself. One of the progs I found was malware called Winfavorites, and although Symantec says this is detectable malware, I had run Norton Antivirus and it went undetected. Looks like it's smartest to run a combination of programs just in case!
I might add that I don't blame Mozilla for it. I blame the programmers who sell their soul for cash to these unscrupulous companies only looking to profit while hurting the systems they populate.
The dangers of knowledge trigger emotional distress in human beings.
As Mozilla browsers become more popular, and thus face credible threats on the scale that IE has been facing, this may well be the breaking point for OSS in general.
Business types are afraid of OSS mostly for the fact that it's "unsupported." To them, support doesn't mean having developers on hand to fix problems so much as it does having someone to blame when things go wrong. As long as someone else is fiscally responsible for their technology problems, their customers/shareholders are happy.
They won't admit to believing the above, but it's true: I have first hand experience with it. They'll say that they need the support to protect them from threats and vulnerabilities. They cite Microsoft's patches and updates as proof that the support is useful. They claim that OSS is only safer because no one targets it, and thus the threats aren't as severe. They don't believe any of that, but it's what they use to rationalize their decisions.
If Mozilla continually and expertly deals with these vulnerabilities, that argument will fall flat. They'll either have to admit just what they're -actually- paying for when they claim "support," or they'll at least begin to look into OSS alternatives.
At least, that's what I hope ^_~
GeekNights!
Late Night Radio for Geeks!
The shell: vulnerability is a bad example. Other things like buffer overflows are pertinant, but will not support the idea that open source is any more or less prone to attack. Bugs occur in any software.
What has not yet occured is a plug-in or extension for Mozilla/Firefox that is similar to the kinds of spyware/malware that has been developed for IE. If the "AOL crowd" starts dumpping IE for Mozilla/Firefox, spyware/malware authors will have a reason to invest their time and money into developing such applications. Seriously, how will the Mozilla team ensure somone doesn't intentionally install an extension because some website told the user that it will "accelerate their web experience for free?"
- Enable Javascript
- Enable install from XPI locally and globally
- Click on a Javascript link on a WWW page (which would be shown in status bar) (N.B. Mozilla does not execute XPI-related JS automatically--the user must have clicked the link)
- Wait a few seconds while watching a very large uncancellable dialog box saying "A website is requesting permission to install the following item", giving full details of the program it is installing (including its signatures in big red letters, its name and its URI), and saying in big bold letters, "Malicious software can damage your computer or violate your privacy. You can only install software from source you can trust."
- After waiting a few seconds you, you then had to press a button labelled "install now".
I'm guessing that even some ex-MSIE users might not go through all that on the request of a malicious WWW site they have found.I digress.
Joe Llywelyn Griffith Blakesley
[This post is in the public domain (copyright-free) unless otherwise stated]
Last week, right before this news, there was news that a lot of people switched to FireFox because of the vulnerabilities in IE.
Who's going to tell them now that they should upgrade their FireFox to the fixed version, because there was a problem?
It doesn't really matter that it was fixed quickly. The people that didn't install updates for IE, won't install the updates for their brand new FireFox either. Sadly.
I believe posters are recognized by their sig. So I made one.
I can't speak for them, but if I were the public relations for the project, I'd say, "we're going to trust Windows' protocol handlers a lot less." Just like how Windows' flawed design makes it dangerous to use Windows' shell functions to decide what to do with various filetypes, the Moz devs are going to have to include special testing procedures for their Windows releases to determine how underlying design flaws can make a third-party product vulnerable.
I think Mozilla Project got a bum rap on this one. When an XP service pack fixes the same issue in all effected products (including IE and Word), I'm inclined to think that it was a Windows problem to begin with.
Fred
"A fool and his freedom are soon parted"
-RMS
Clearly, those in the press who live in the pocket of the redmondians would have us believe that this is a good reason not to stop using I.E. After all, you may go to all the trouble of switching and still not have nirvana.
Well, even if the beta versions of Mozilla aren't instant nirvana; they're already more secure, more stable, faster, smaller, and better looking.
The mozilla browser also comes with better karma, and I've heard some people have regrown hair, enlarged body parts, and improved their sex lives simply by switching.
The problem with quotes on the internet, is that nobody bothers to check their veracity. -- Abraham Lincoln
The flaw certainly affected Firefox, but given that it also affected things like Microsoft Word, was Firefox itself necessarily targeted? That is, did the guy who came up with the exploit have Firefox in mind?
The difference may seem irrelevant, but if Firefox wasn't targeted, it means that the evil will of the cracker community has not yet been turned to finding the bugs in Firefox the way that they have in IE. I'm pretty sure Firefox will fare better than IE did, but when you've got so much effort aimed at a product, and with the source available, they will find any easily-findable bugs.
If they did target Firefox, then we begin to have some idea how many security bugs there really are in Firefox, by seeing the rate at which new exploits appear. Thus far, the answer is "quite slow", and I hope that's because people are targeting it and failing.
You just have to love how easy it is to install this Mozilla patch. What IE fix works this simply? Open page. Click link. If this were IE, there would be one, minor, takes-forever step now: Restart computer.
see http://secunia.com/advisories/12048/
Join Team Mozilla #38050 Folding@home
Whole of mozilla.org?
by dave532
Tuesday July 13th, 2004 1:30 AM
"Mozilla Firefox 0.9 just allows update.mozilla.org (though this has since being expanded to the whole of mozilla.org)."
Allowing the whole of mozilla.org is a bad idea because bugzilla.mozilla.org can allow anyone to upload a malicious XPI
To:
Re: Whole of mozilla.org?
by Ben_Goodger
Tuesday July 13th, 2004 3:44 AM
good point. fixed.
I will work to elevate you, just enough to bring you down
Serial Meta Moderator
Tell you what, you look at the Mozilla source code and find out about the recently discussed problems.
Here's the catch: the problem was caused by undocumented behaviour in the Microsoft Windows APIs for handling URLs. No source audit by somebody who didn't know about that behaviour would have found it, because those APIs are closed source.
K-meleon, Moz based browser I use (and have for 3 years both at home and here at work on winders) was fixed by the users with a simple User_Pref
Which is exactly how it's actually fixed on normal Mozilla and Firefox as well. What's your point? That there absolutely shouldn't be a fix easy enough for non-techies to use just because it can be done by fudzing around the hidden config system?
Who needs a 20Mb download, huh?
The people who couldn't possibly understand even about:config, or well, not really, they could always just install the 512 byte shellblock.xpi
I was hoping they would do something about the protocol problem, and default to not allowing unknown or unexpected OS-handled protocols or helper applications.
This new dialog would be a great place to add
'$webpage is attempting to display an image from exploit:format+c:\'
so that by default new registered protocols and helper applications would be blocked rather than permitted until the user explicitly whitelists them.
Helper apps, too:
'Should $file.pdf be opened with the Adobe Acrobat plugin? [always] [always for this site] [just this once] [no] [never for this site] [never]'
I'm tired of going in and re-removing 'automatically perform the associated action for each of the following file types' over and over and over again.
What browser is it that script kiddies and virus writers using if not Mozilla? I never would have conceived of them going after someone that's NOT MS.
So what, should I switch to Lynx? or is there an undisclosed hole in that too?
I'm sure I'm not the first to say this... but... how about people who release plugins actually sign them? Then we can build our trust network around that, not where you are downloading it from.
My 2cents
Kurt
Eh? Opera's equivalent technology is described here.
The most important thing to be in abrowser is speed and ease of use. I've got IE, an old Netscape, Firefox, and a handful of other esoteric small project browsers. It may be full of holes, but IE is the best when it comes to browsing. I'd love Firefox a lot more if it wouldn't keep telling me "Connection Refused" five or six times before I -finally- get the lucky refresh that lets the page load. IE'll do that right away. Maybe IE just doesn't tell me the connection was refused and keeps retrying for me, but that's -nice-. It's -helpful-. It's damn near -considerate-. I don't want to be George Jetson, pushing a button all the time, just to websurf.
Tho I do like the tabbed browsing. Lets me open a page five times so I can finally get one that doesn't say "Not responding".
If you develop for Windows, you have to develop for it as it is. That is, you have to expect that things aren't secure in the way you like them to be or don't work the way you might like them to work.
The attitude Mozilla should have that they should only call library and OS interfaces on each OS that they can have a reasonable expectation to be safe and secure in practice. That is, they need to orient themselves not only based on what they think an API ought to do or how the API ought to behave, but what it actually does. If they don't, then some of the blame for security holes will fall on Mozilla.
In this case, the Mozilla developers knew what the API they were calling did. As I understand it, they had even known of the possibility of the shell: exploit for quite some time. Furthermore, the security hole could have been fixed in Mozilla, yet the Mozilla chose not to do anything about it. The secure thing for Mozilla to have done would have been only to hand over a few known protocols to the OS for handling (mailto: and maybe ftp:), and only if Mozilla first verified that the entire URI was, in fact, valid and harmless.
IMHO, desktops (GNOME, KDE) are crossing the line and even X itself has some "features" that may lead to exploits if developers aren't careful - remember the window manager is just a program that can actually control other programs on the machine. No application should ever tell another what to do based on untrusted data, that's reserved for the user (clicking a link doesn't count as approval - the link may not do what it claims).
When you add a feature, consider what a criminal might use it for and who the burden will land on to prevent it. With shell: the burden lands on any application you might possibly launch and that's just unacceptable. With a window manager, consider that I may want to offer my display server to some untrusted application (airline reservation system) running on a remote machine - great possibilities and a great security risk. Because so much is accessible through X we don't use it that way.
I'm rambling now trying to gather too many thoughts in too little time.
I don't believe OSS has ever encountered the concentrated, unrelenting targeting Microsoft has to endure.
You're mistaken in your belief.
People argue that Microsoft's getting unfairly blamed becauise they're the majority of the targets. And yet in areas where they haven't been the primary target they have still often had a significantly larger number of exploits for extended periods of time.
For example, for years IIS had a consistent 30% share in the webserver market, yet over the same period IIS served the vast majority of defaced websites.
Folks - this is not just a Mozilla/Windows problem. Just a few short weeks ago, a lot of noise was made about a very similar URI exploit on Mac OS X, both through any browser that runs on OS X (noise was made about Safari, and I verified that the exploit was also present in Camino) and OS X's help system.
Because of the seemingly general nature of this type of exploit - why are we letting browsers run code ?? The web SHOULD primarily be to exchange information (text, images, audio, video). Why are we allowing remote program execution?
This brings up an interesting concept. It has been the conjecture of most people on this forum that opensource is more secure because it's more freely examined. This doesn't hold true if the opensource code in question is never actually examined.
A number of years ago, an initiative was created to make FreeBSD the most secure operating system on the planet. OpenBSD is the result, and I have to say that they did a darn fine job of it.
I'd like to propose that the Opensource community do the same thing with Mozilla. Start a line-by-line security audit of the Mozilla code base. Leverage the opensource massively distributed model and create the first browser that can be called truely secure.
If you don't want to do it to create a truely awesome product, then just do it to rub Microsoft's nose in something that they are completely incapable of. *evil grin*
Wake up - the future is arriving faster than you think.
Slate, a Microsoft magazine urged users to use mozilla as well, however, I dont think this was a charitable request, instead, make users use this alternative, microsoft will sit back and watch as mozilla gets exploited by malware, make a big shit about it every time, (possibly even write their own as well) then come out with a version of IE that isnt exposed the the type of malware that mozilla is exposed to, and use choice marketing words to get people to download it (even buy it)
Microsoft is gonna use Mozilla as a pawn in the browser wars to re-affirm their grounds in the Browser Monopoly.
Lots of users have already made this adjustment in thinking, when it comes to email: it has become common sense among laymen (even if they don't always practice it) that you're not supposed to "open attachments" from untrusted sources. That's actually normally a safe thing to do -- assuming your mailreader isn't buggy. Merely looking at something shouldn't be unsafe. But can you really trust a huge complex app to not be buggy? MS Outlook users say No, Sylpheed users say Yes. But that's an arbitrary distinction and the joke may be on us Sylpheed users someday.
Sandboxing for defense in depth is starting to look more attractive. I'm skeptical that it's going to be quite as easy as just chrooting the app or running it as a different user, though. My mailreader needs to run gpg with access to my local keyring; my web browser needs to be able to at least be able to display any local html file that I have access to; etc. I think designing a good system to sandbox this stuff is going to require a lot of thought. Maybe a number of different processes, some of them running as me and some running as nobody, connected with pipes or something. I don't know.
I like your httpd analogy, because it reminds me that this is actually a very old problem. We've gotten used to the need to secure servers, we now need to extend that thinking to clients.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
That the story submitter buys into the "it's insecure because it's popular" myth is one thing; for Slashdot to willy-nilly accept it is another. Very odd.
That the "shell://" hole in Mozilla (thereby Firefox and Thunderbird) exists is true; but it is not truly a Mozilla whole; Mozilla passes the unhandled scheme to Windows and Windows serves the hole. It's a Windows hole. MS Word (among others) also is vulnerable to the "shell://" exploit.
This exploit is specific to Windows. Windows is being targeted, not Mozilla.
So, don't just move to a more secure browser, jump to Mac OS X, Linux, and or *BSD for a better Internet Experience.
-- @rjamestaylor on Ello
I think most people prefer internet explorer because it's there. I NEVER used IE, i always used Netscape, (and now mozilla) and that was when the battle of the browsers was still big, but I think netscape was MORE popular. Microsoft cornered the cornered the market when in Windows98, When they merged IE with Windows Explorer, so to browse your files you HAD to use IE, (today thats still the problem, i wish i could use FireFox as my file manager) IE is only popular because of bundling I still think FireFox is a more seccure browser, simply cause it is, and there isn't so much "IE Friendly" HTML, i've noticed, that on pages not published with Frontpage or any other MS product, Firefox often looks better. and pages done with Frontpage often still look better in firefox. I still think firefox is a more secure browser because it isn't jammed with useless features like IE. I have the "view with IE" extention on firefox, i NEVER need to use it. The only thing i can think of that can't be used in firefox is Launch.com Oh well, stick with firefox