Slashdot Mirror
Mozilla Developers Respond to Malware
An anonymous reader writes "Last week's well- publicised (and quickly fixed) security hole in Mozilla, Firefox and Thunderbird reminded the Slashdot faithful that Mozilla is not invincible and that it is now big enough for malware (virus and spyware) authors to target. MozillaZine has a short article on this topic, looking at the rise in attacks aimed at Mozilla and how the developers are responding."
wasn't this bug known for a while and was just recently issued a fix for it?
I'm quite happy to see that the Mozilla team is pro-active in fixing the bugs that could allow MalWare to install unchecked.
Yet, a base Mozilla 1.7 downloaded right after release will have this issue for a very long time. This situation is worse, in one big way, than the Internet Explorer issues; Mozilla users 'feel' safe. Non-techies that use Mozilla assume it's 'safe' because a geek once told them that this is the case.
I've been an Open Source supporter for quite a long while, but the days of relative desktop safety for F/OSS cross-over users is coming to a close.
And, I'm probably not the only one who "shivers", when reading, "... almost a carbon copy of the new Internet Explorer Information Bar ..."
There's no way to defend that.
Kinetic stupidity has a new brand leader: Allen Zadr.
Will be how fast the community can fix these types of issues compared to M$'s response time.
I think we all know that whatever is the popular software is what will be targeted so the big difference maybe how it's responded to.
"If any question why we died, Tell them because our fathers lied."
Some microsoft products were affected also.
this is precisely the reason the Firefox was equipped with thought guided missiles...to destroy unseen threats.
Linux is to the internet as Duct Tape is to the Universe.
This coupled with the fact moz/firefox is already more secure than IE means Moz users are not invunerable but we have a better chance than the IE crowd.
I think that there is a major disadvantage when it comes to attacking the Mozilla series of applications -- they are all on multiple operating systems. It's worth noting that this bug was only found on Windows systems operating Mozilla, and while this may be the largest base of people using the program, I get the impression that a lot Linux and OSX folks are using them as well. Yet everyone is so eager to jump on Mozilla for having a bug, even though it only affected one of the operating systems. I think that's a pretty good track record, espically with the speed that it's been fixed in. I'd like to see that with IE.
I know we all like to take jabs at Microsoft, but really people, we will take these comments more seriously if you don't make your little "witty" changes to the names. IE: no more "M$, Micro$oft, Internet Exploiter"..etc
if people are going to start targetting mozilla for exploits, then we can see the true difference between security/stability of OSS vs proprietary products. i have no doubt that mozilla will come out in the lead, because in being open source when there IS a problem, it is fixed in a timely manner :)
There is a fine line between easy to use and easy to exploit. Let's not repeat the mistakes of others.
UNIX/Linux Consulting
It was widely reported that a flaw was found in 'Mozilla' which was not correct. The flaw was in the Shell: protocol on Windows. That's why the alleged 'flaw' in Mozilla did not exist on non-Windows platforms. The only 'flaw' in Mozilla was its failure to block the use of the shell: stuff on Windows (which the patch now does).
Rest assured, if Firefox ever does make it big time, ~20-30% of browsers, malware writers WILL exploit any hole they can find.
Hopefully the developers will be quick enough to fix it, but will users be sharp enough to get the patches. I think automatic updates for firefox are what is needed to ensure users have less to worry about. I know myself that the patch for the shell exploit was not a simple matter of clicking search for updates, as the update program times 0out after 2 secs.
Firefox won't be immune to the legions of spammers, crackers, marketers and pornographers which have already begun to exploit it. With some kind of autoinstaller/updater or a faster update cycle users could be confident that whatever new tricks the spammers come up with, the fixes will be prompt. Hopefully anyway.
I know autoinstallers aren't in vouge, for many good reasons. But if it's just for one, largely selfcontained program, would it really be so bad.
Maybe at the very least mozilla could have a list of critical, anti-spam and other update categories. Or would that just confuse people
May the Maths Be with you!
These exploits are just the price of success in the browser business. I have no doubt that Mozilla products are more secure than IE, but even if significant holes are found, I'll put the turnaround time for the fix up against MS track record anyday.
"The problem with internet quotations is that many are not genuine" -Abraham Lincoln
Now let us hope that there are no spoofing mechanisms discovered that result in users believing they're on one of the whitelisted sites to allow such installations. As someone on that board had already pointed out, allowing all of mozilla.org as a means to install code can result in people taking advantage of bugzilla.mozilla.org and ftp.mozilla.org.
You know, I really appreciate hearing from developers who recognize a potential threat and are informing us how they are working to fight the problem. Their method might be taking a page out of Internet Explorer for SP2, but if it works than it's good.
This story comes at a perfect time for me. I'm a Mozilla diehard, and I just ran Ad Aware 6 to find that some malware bypassed security (even Norton Internet Security) to install itself. One of the progs I found was malware called Winfavorites, and although Symantec says this is detectable malware, I had run Norton Antivirus and it went undetected. Looks like it's smartest to run a combination of programs just in case!
I might add that I don't blame Mozilla for it. I blame the programmers who sell their soul for cash to these unscrupulous companies only looking to profit while hurting the systems they populate.
The dangers of knowledge trigger emotional distress in human beings.
As Mozilla browsers become more popular, and thus face credible threats on the scale that IE has been facing, this may well be the breaking point for OSS in general.
Business types are afraid of OSS mostly for the fact that it's "unsupported." To them, support doesn't mean having developers on hand to fix problems so much as it does having someone to blame when things go wrong. As long as someone else is fiscally responsible for their technology problems, their customers/shareholders are happy.
They won't admit to believing the above, but it's true: I have first hand experience with it. They'll say that they need the support to protect them from threats and vulnerabilities. They cite Microsoft's patches and updates as proof that the support is useful. They claim that OSS is only safer because no one targets it, and thus the threats aren't as severe. They don't believe any of that, but it's what they use to rationalize their decisions.
If Mozilla continually and expertly deals with these vulnerabilities, that argument will fall flat. They'll either have to admit just what they're -actually- paying for when they claim "support," or they'll at least begin to look into OSS alternatives.
At least, that's what I hope ^_~
GeekNights!
Late Night Radio for Geeks!
The shell: vulnerability is a bad example. Other things like buffer overflows are pertinant, but will not support the idea that open source is any more or less prone to attack. Bugs occur in any software.
What has not yet occured is a plug-in or extension for Mozilla/Firefox that is similar to the kinds of spyware/malware that has been developed for IE. If the "AOL crowd" starts dumpping IE for Mozilla/Firefox, spyware/malware authors will have a reason to invest their time and money into developing such applications. Seriously, how will the Mozilla team ensure somone doesn't intentionally install an extension because some website told the user that it will "accelerate their web experience for free?"
- Enable Javascript
- Enable install from XPI locally and globally
- Click on a Javascript link on a WWW page (which would be shown in status bar) (N.B. Mozilla does not execute XPI-related JS automatically--the user must have clicked the link)
- Wait a few seconds while watching a very large uncancellable dialog box saying "A website is requesting permission to install the following item", giving full details of the program it is installing (including its signatures in big red letters, its name and its URI), and saying in big bold letters, "Malicious software can damage your computer or violate your privacy. You can only install software from source you can trust."
- After waiting a few seconds you, you then had to press a button labelled "install now".
I'm guessing that even some ex-MSIE users might not go through all that on the request of a malicious WWW site they have found.I digress.
Joe Llywelyn Griffith Blakesley
[This post is in the public domain (copyright-free) unless otherwise stated]
How about "those greedy corporate cocksuckers with the strait-jacket EULA and dozens of politicians in their pocket"? M$ is just faster, I'm afraid...
The Slashdot Paradox: "100% Overrated"
Last week, right before this news, there was news that a lot of people switched to FireFox because of the vulnerabilities in IE.
Who's going to tell them now that they should upgrade their FireFox to the fixed version, because there was a problem?
It doesn't really matter that it was fixed quickly. The people that didn't install updates for IE, won't install the updates for their brand new FireFox either. Sadly.
I believe posters are recognized by their sig. So I made one.
The flaw certainly affected Firefox, but given that it also affected things like Microsoft Word, was Firefox itself necessarily targeted? That is, did the guy who came up with the exploit have Firefox in mind?
The difference may seem irrelevant, but if Firefox wasn't targeted, it means that the evil will of the cracker community has not yet been turned to finding the bugs in Firefox the way that they have in IE. I'm pretty sure Firefox will fare better than IE did, but when you've got so much effort aimed at a product, and with the source available, they will find any easily-findable bugs.
If they did target Firefox, then we begin to have some idea how many security bugs there really are in Firefox, by seeing the rate at which new exploits appear. Thus far, the answer is "quite slow", and I hope that's because people are targeting it and failing.
You just have to love how easy it is to install this Mozilla patch. What IE fix works this simply? Open page. Click link. If this were IE, there would be one, minor, takes-forever step now: Restart computer.
see http://secunia.com/advisories/12048/
Join Team Mozilla #38050 Folding@home
Whole of mozilla.org?
by dave532
Tuesday July 13th, 2004 1:30 AM
"Mozilla Firefox 0.9 just allows update.mozilla.org (though this has since being expanded to the whole of mozilla.org)."
Allowing the whole of mozilla.org is a bad idea because bugzilla.mozilla.org can allow anyone to upload a malicious XPI
To:
Re: Whole of mozilla.org?
by Ben_Goodger
Tuesday July 13th, 2004 3:44 AM
good point. fixed.
I will work to elevate you, just enough to bring you down
Serial Meta Moderator
I was hoping they would do something about the protocol problem, and default to not allowing unknown or unexpected OS-handled protocols or helper applications.
This new dialog would be a great place to add
'$webpage is attempting to display an image from exploit:format+c:\'
so that by default new registered protocols and helper applications would be blocked rather than permitted until the user explicitly whitelists them.
Helper apps, too:
'Should $file.pdf be opened with the Adobe Acrobat plugin? [always] [always for this site] [just this once] [no] [never for this site] [never]'
I'm tired of going in and re-removing 'automatically perform the associated action for each of the following file types' over and over and over again.
Disclaimer: My post is about the "let me make name changes I think are clever and funny" trend and not the parent poster.
As opposed to people massively using names like "Lunix" or "open sores"?
I've... never seen anything like that used here on Slashdot. Not ever.
That's not saying it hasn't been, but it's sure a hell of a lot less common.
As long as those MS zealots don't disappear, expect names like "M$".
Wouldn't you rather be the bigger person?
Personally, I'd rather have intelligent discussion about the strong and weak points of various OS/software/languages/etc. here than stupid name calling. Maybe it's just my own prejudices, but when I see a post with that kind of crap, I assume I'm as likely to get reasonable discourse out of the post as I am to get a fair and balanced opinion about non-Causasians from a member of the KKK. I skip to the next post.
(I also assume the poster lives in their parents' basement and has never touched a real girl, but I keep that to myself. That'd be unfair and non-constructive name-calling, too.)
IMHO, desktops (GNOME, KDE) are crossing the line and even X itself has some "features" that may lead to exploits if developers aren't careful - remember the window manager is just a program that can actually control other programs on the machine. No application should ever tell another what to do based on untrusted data, that's reserved for the user (clicking a link doesn't count as approval - the link may not do what it claims).
When you add a feature, consider what a criminal might use it for and who the burden will land on to prevent it. With shell: the burden lands on any application you might possibly launch and that's just unacceptable. With a window manager, consider that I may want to offer my display server to some untrusted application (airline reservation system) running on a remote machine - great possibilities and a great security risk. Because so much is accessible through X we don't use it that way.
I'm rambling now trying to gather too many thoughts in too little time.
Are you serious? You're saying that an operating system that let anybody use it by simply selecting 'Cancel' on the login screen (if even enabled), is more secure than Windows 2000/XP. Madness.
I don't believe OSS has ever encountered the concentrated, unrelenting targeting Microsoft has to endure.
You're mistaken in your belief.
People argue that Microsoft's getting unfairly blamed becauise they're the majority of the targets. And yet in areas where they haven't been the primary target they have still often had a significantly larger number of exploits for extended periods of time.
For example, for years IIS had a consistent 30% share in the webserver market, yet over the same period IIS served the vast majority of defaced websites.
Folks - this is not just a Mozilla/Windows problem. Just a few short weeks ago, a lot of noise was made about a very similar URI exploit on Mac OS X, both through any browser that runs on OS X (noise was made about Safari, and I verified that the exploit was also present in Camino) and OS X's help system.
Because of the seemingly general nature of this type of exploit - why are we letting browsers run code ?? The web SHOULD primarily be to exchange information (text, images, audio, video). Why are we allowing remote program execution?
experts
oh, you mean those guys who couldn't figure out a resolution to a link being sent via a aim message that had a virus in it. Instead of blocking that URL on the proxy, they instead choose to ban aim for a week. Or the same IT staff that responds to my solutions with "I have a MCSE, and I know you can't do that". Although never mind that I have real world exp. Or that prior to my programming position I ran office 4 times this size. The same IT department that can't keep exchange running for more then 7 hours without a reboot in the last 1 and 1/2 years.
Yea those guys know whats best.
Oh yea the same IT department that recomends we only use IE.
Why dont I work in IT? Because I get paid more, thats why.
This brings up an interesting concept. It has been the conjecture of most people on this forum that opensource is more secure because it's more freely examined. This doesn't hold true if the opensource code in question is never actually examined.
A number of years ago, an initiative was created to make FreeBSD the most secure operating system on the planet. OpenBSD is the result, and I have to say that they did a darn fine job of it.
I'd like to propose that the Opensource community do the same thing with Mozilla. Start a line-by-line security audit of the Mozilla code base. Leverage the opensource massively distributed model and create the first browser that can be called truely secure.
If you don't want to do it to create a truely awesome product, then just do it to rub Microsoft's nose in something that they are completely incapable of. *evil grin*
Wake up - the future is arriving faster than you think.
"Wouldn't you rather be the bigger person?"
Nope. Too many years of sitting in front of a computer all day have already made me the "bigger person".
I think most people prefer internet explorer because it's there. I NEVER used IE, i always used Netscape, (and now mozilla) and that was when the battle of the browsers was still big, but I think netscape was MORE popular. Microsoft cornered the cornered the market when in Windows98, When they merged IE with Windows Explorer, so to browse your files you HAD to use IE, (today thats still the problem, i wish i could use FireFox as my file manager) IE is only popular because of bundling I still think FireFox is a more seccure browser, simply cause it is, and there isn't so much "IE Friendly" HTML, i've noticed, that on pages not published with Frontpage or any other MS product, Firefox often looks better. and pages done with Frontpage often still look better in firefox. I still think firefox is a more secure browser because it isn't jammed with useless features like IE. I have the "view with IE" extention on firefox, i NEVER need to use it. The only thing i can think of that can't be used in firefox is Launch.com Oh well, stick with firefox