Slashdot Mirror

← Back to Stories (view on slashdot.org)

Mozilla Developers Respond to Malware

Posted by CmdrTaco on from the something-to-think-about dept.

An anonymous reader writes "Last week's well- publicised (and quickly fixed) security hole in Mozilla, Firefox and Thunderbird reminded the Slashdot faithful that Mozilla is not invincible and that it is now big enough for malware (virus and spyware) authors to target. MozillaZine has a short article on this topic, looking at the rise in attacks aimed at Mozilla and how the developers are responding."

41 of 429 comments (clear)

  1. Mozilla "innovation" reaches new low? by Allen+Zadr · · Score: 5, Insightful

    I'm quite happy to see that the Mozilla team is pro-active in fixing the bugs that could allow MalWare to install unchecked.

    Yet, a base Mozilla 1.7 downloaded right after release will have this issue for a very long time. This situation is worse, in one big way, than the Internet Explorer issues; Mozilla users 'feel' safe. Non-techies that use Mozilla assume it's 'safe' because a geek once told them that this is the case.

    I've been an Open Source supporter for quite a long while, but the days of relative desktop safety for F/OSS cross-over users is coming to a close.

    And, I'm probably not the only one who "shivers", when reading, "... almost a carbon copy of the new Internet Explorer Information Bar ..."

    There's no way to defend that.

    --
    Kinetic stupidity has a new brand leader: Allen Zadr.
    1. Re:Mozilla "innovation" reaches new low? by TopShelf · · Score: 5, Funny

      Non-techies that use Mozilla assume it's 'safe' because a geek once told them that this is the case.

      For such users, they need to be taught that there is no such thing as truly "safe" browsing. The only "safe" choice is abstinence.

      *then watch as they slip a condom over their mouse and hope for the best*

      --
      Stop by my site where I write about ERP systems & more
    2. Re:Mozilla "innovation" reaches new low? by T-Keith · · Score: 4, Insightful

      "Non-techies that use Mozilla assume it's 'safe' because a geek once told them that this is the case." Non-techies are more likely to assume that the "Internet" that came with their computer is safe too. Which they really should. Unfortunately this is not the case.

    3. Re:Mozilla "innovation" reaches new low? by Blindman · · Score: 4, Insightful

      No software package can fix ignorance. Mozilla makes ignorance a little cheaper. Microsoft is trying to do the same with changing the defaults in Service Pack 2. However, the real problem won't be fixed as long as people choose not to think.

      --
      I don't practice what I preach because I'm not the kind of person that I'm preaching to.
    4. Re:Mozilla "innovation" reaches new low? by sigaar · · Score: 5, Insightful

      "This situation is worse, in one big way, than the Internet Explorer issues; Mozilla users 'feel' safe. Non-techies that use Mozilla assume it's 'safe' because a geek once told them that this is the case."

      Non-techies using IE, like my mother, feel safe too, just because Microsoft said it's OK. Such a big company with so many users can't be wrong, after all.

      Despite the fact that her computer's gotten infected a couple of times already. Despite the fact that she refuses to do her Windows update (it takes so damn long over the modem). Despite the fact that her son (me) who works for an IT security company, have told her repeatedly not to use IE, and have made sure that she always has the latest Mozilla/FireFox and Opera installed.

      On a slightly different but related topic. I am not a programmer, so this is just a guess. The same vulnerability that was discovered in Firefox and Mozilla, was discovered in IE too. Would the fact the vulnerability in Firefox and Mozilla only affected the Windows 2000/XP versions, and not the ones on other platforms, suggest that it might have been a vulnerability in windows rather than Mozilla? Sure, preventitive maintainance on Mozilla's side would prevent it from being expoited.

      I just find it to be a bit like mopping the floor because the bathtub is overflowing, instead of closing the tap.

      --
      sigaar
    5. Re:Mozilla "innovation" reaches new low? by That's+Unpossible! · · Score: 4, Informative

      I would like to point out that this is slightly misleading (as it implies Mozilla had a security flaw before the fix), because, even before the whitelist fix was added, you had to do the following to get infected by any malware...

      I don't think this is true. The specific exploit in XP allows shell: protocol links to run arbitrary code if crafted properly. Mozilla was passing these links right on to the OS.

      I think you are confusing this bug with the idea that people can install malware via XPI.

      --
      Ironically, the word ironically is often used incorrectly.
    6. Re:Mozilla "innovation" reaches new low? by Finuvir · · Score: 5, Interesting

      Would the fact the vulnerability in Firefox and Mozilla only affected the Windows 2000/XP versions, and not the ones on other platforms, suggest that it might have been a vulnerability in windows rather than Mozilla?

      Yes. The flaw was that Mozilla handled the protocols it knew and passed all unknown protocols to the OS to handle. Windows was (is) all too happy to launch programs with the shell protocol.

      --
      Why is anything anything?
    7. Re:Mozilla "innovation" reaches new low? by t1m0r4n · · Score: 5, Insightful

      The Mozilla team isn't proactive on security issues. The dangers of Windows URL schemes have been known to the Mozilla team since mid-2002

      I said last time around I said if I heard this comment one more time I would scream, and, well, I just scared my poor dog. Who the heck is this "Mozilla team" you are insulting? Last time I checked mozilla source code was readily available to you. Patch it. Done. If someone "official" doesn't want to include it in the nightly build, too bad. Put up a little website at geocities.com/securemozilla and post a message on your geek board of choice.

      Such is the burden of open source. You can't complain about the coding choice of another person if you are lazy and/or stupid. I don't see it as a failure of the Mozilla team, but a failure of Windows users who were too lame to fix it themselves.

    8. Re:Mozilla "innovation" reaches new low? by ajs · · Score: 5, Insightful

      Actually, you should look at the link (though you have to copy/paste it because Bugzilla is refusing connections that have a Slashdot URL as referer). The bug was reported by someone who wrote, tested and bug-fixed a patch. Two years later (TWO YEARS) someone from the Mozilla Team (and by that, I mean people with control over the released source) said that they thought it wasn't a good idea. A few months later the exploits were "discovered".

      This whole incident is a huge black-eye for Open Source's theory of many eyes. The eyes saw. The fingers fixed. The brain ignored.

      PS: I am still an open source advocate and I still believe in the many-eyes theory of security, but this incident shows that we cannot be abolutely confident in that theory producing better results that proprietary solutions.

  2. the interesting thing by koan · · Score: 5, Insightful

    Will be how fast the community can fix these types of issues compared to M$'s response time.
    I think we all know that whatever is the popular software is what will be targeted so the big difference maybe how it's responded to.

    --
    "If any question why we died, Tell them because our fathers lied."
  3. IE by shackma2 · · Score: 5, Informative
    It wasnt just Mozilla Firefox and the like.

    Some microsoft products were affected also.

    1. Re:IE by Anonymous Coward · · Score: 5, Insightful

      It wasnt just Mozilla Firefox and the like.

      And there's the rub. As was reported before, the problem with Mozilla was only on Win32 platforms. Then, it comes out that MSN IM and Word are also affected with this problem. So, truly the bug lies in Windows. Why this point isn't getting more press, I am not sure, but it really should.

    2. Re:IE by That's+Unpossible! · · Score: 4, Insightful

      Yeah, yeah. Point is, Mozilla shouldn't have been affected at all (like Opera, for example).

      Yeah, Opera never suffers from security problems!

      Gimme a break. No fancy software is secure.

      --
      Ironically, the word ironically is often used incorrectly.
  4. missiles by foxhound01 · · Score: 5, Funny

    this is precisely the reason the Firefox was equipped with thought guided missiles...to destroy unseen threats.

    --


    Linux is to the internet as Duct Tape is to the Universe.
  5. Quickly by L-s-L69 · · Score: 4, Interesting
    The large developer base responds quickly - gets things patched and released.

    This coupled with the fact moz/firefox is already more secure than IE means Moz users are not invunerable but we have a better chance than the IE crowd.

  6. Targeting Flaws by feilkin · · Score: 4, Interesting

    I think that there is a major disadvantage when it comes to attacking the Mozilla series of applications -- they are all on multiple operating systems. It's worth noting that this bug was only found on Windows systems operating Mozilla, and while this may be the largest base of people using the program, I get the impression that a lot Linux and OSX folks are using them as well. Yet everyone is so eager to jump on Mozilla for having a bug, even though it only affected one of the operating systems. I think that's a pretty good track record, espically with the speed that it's been fixed in. I'd like to see that with IE.

  7. OSS vs non-OSS by siplus · · Score: 4, Insightful

    if people are going to start targetting mozilla for exploits, then we can see the true difference between security/stability of OSS vs proprietary products. i have no doubt that mozilla will come out in the lead, because in being open source when there IS a problem, it is fixed in a timely manner :)

  8. Why should installing plugins be easy? by Neil+Watson · · Score: 4, Insightful
    Apart from initial install, how often does one need to install a browser plugin? Why should it be made easy? What kind of legitimate website needs a plugin to browse it?

    There is a fine line between easy to use and easy to exploit. Let's not repeat the mistakes of others.

    --
    UNIX/Linux Consulting
  9. It was a Windows flaw, not a Mozilla flaw by dtjohnson · · Score: 5, Insightful

    It was widely reported that a flaw was found in 'Mozilla' which was not correct. The flaw was in the Shell: protocol on Windows. That's why the alleged 'flaw' in Mozilla did not exist on non-Windows platforms. The only 'flaw' in Mozilla was its failure to block the use of the shell: stuff on Windows (which the patch now does).

  10. Autoupdate might be nice by ObsessiveMathsFreak · · Score: 4, Interesting

    Rest assured, if Firefox ever does make it big time, ~20-30% of browsers, malware writers WILL exploit any hole they can find.

    Hopefully the developers will be quick enough to fix it, but will users be sharp enough to get the patches. I think automatic updates for firefox are what is needed to ensure users have less to worry about. I know myself that the patch for the shell exploit was not a simple matter of clicking search for updates, as the update program times 0out after 2 secs.

    Firefox won't be immune to the legions of spammers, crackers, marketers and pornographers which have already begun to exploit it. With some kind of autoinstaller/updater or a faster update cycle users could be confident that whatever new tricks the spammers come up with, the fixes will be prompt. Hopefully anyway.

    I know autoinstallers aren't in vouge, for many good reasons. But if it's just for one, largely selfcontained program, would it really be so bad.

    Maybe at the very least mozilla could have a list of critical, anti-spam and other update categories. Or would that just confuse people

    --
    May the Maths Be with you!
  11. Re:not so fast of a fix by it0 · · Score: 5, Informative

    Wasn't it also that it was a shell bug in win2k/xp that actually only was an OS bug, that MS didn't fixed so they eventually did it?

  12. The price of success by twbecker · · Score: 4, Interesting

    These exploits are just the price of success in the browser business. I have no doubt that Mozilla products are more secure than IE, but even if significant holes are found, I'll put the turnaround time for the fix up against MS track record anyday.

    --
    "The problem with internet quotations is that many are not genuine" -Abraham Lincoln
  13. Spoofing by POWRSURG · · Score: 4, Interesting

    Now let us hope that there are no spoofing mechanisms discovered that result in users believing they're on one of the whitelisted sites to allow such installations. As someone on that board had already pointed out, allowing all of mozilla.org as a means to install code can result in people taking advantage of bugzilla.mozilla.org and ftp.mozilla.org.

    You know, I really appreciate hearing from developers who recognize a potential threat and are informing us how they are working to fight the problem. Their method might be taking a page out of Internet Explorer for SP2, but if it works than it's good.

  14. Malware by mfh · · Score: 4, Interesting

    This story comes at a perfect time for me. I'm a Mozilla diehard, and I just ran Ad Aware 6 to find that some malware bypassed security (even Norton Internet Security) to install itself. One of the progs I found was malware called Winfavorites, and although Symantec says this is detectable malware, I had run Norton Antivirus and it went undetected. Looks like it's smartest to run a combination of programs just in case!

    I might add that I don't blame Mozilla for it. I blame the programmers who sell their soul for cash to these unscrupulous companies only looking to profit while hurting the systems they populate.

    --
    The dangers of knowledge trigger emotional distress in human beings.
  15. This will be the true test. by Schezar · · Score: 5, Interesting

    As Mozilla browsers become more popular, and thus face credible threats on the scale that IE has been facing, this may well be the breaking point for OSS in general.

    Business types are afraid of OSS mostly for the fact that it's "unsupported." To them, support doesn't mean having developers on hand to fix problems so much as it does having someone to blame when things go wrong. As long as someone else is fiscally responsible for their technology problems, their customers/shareholders are happy.

    They won't admit to believing the above, but it's true: I have first hand experience with it. They'll say that they need the support to protect them from threats and vulnerabilities. They cite Microsoft's patches and updates as proof that the support is useful. They claim that OSS is only safer because no one targets it, and thus the threats aren't as severe. They don't believe any of that, but it's what they use to rationalize their decisions.

    If Mozilla continually and expertly deals with these vulnerabilities, that argument will fall flat. They'll either have to admit just what they're -actually- paying for when they claim "support," or they'll at least begin to look into OSS alternatives.

    At least, that's what I hope ^_~

    --
    GeekNights!
    Late Night Radio for Geeks!
    1. Re:This will be the true test. by riley · · Score: 4, Insightful
      Business types are afraid of OSS mostly for the fact that it's "unsupported." To them, support doesn't mean having developers on hand to fix problems so much as it does having someone to blame when things go wrong. As long as someone else is fiscally responsible for their technology problems, their customers/shareholders are happy.

      Here's the hole in that theory: no one has ever successfully sued Microsoft for technology problems with MS products. Worms, viruses, etc have all cost reported billions of dollars (real cost unknown, but obviously significant), yet MS does not bear the consequences of those losses.

      The question of whether it is possible for us (as a species) to build completely error free systems (thus making it feasable to hold vendors responsible for mistakes) is for another time. The possibility that software is more abstract and thus more complex for humans than any other form of commercial engineering maybe the case.

      This is not to let MS off the hook. In my dealings with them, the company in the past has tended to let the marketers write the program specifications, often over the objections of actual engineers. The difference in perspective between a salesperson and an engineer is significant with regards to long term security and reliability.

  16. Misleading by sepluv · · Score: 4, Informative
    reminded the Slashdot faithful that Mozilla is not invincible and that it is now big enough for malware (virus and spyware)
    I would like to point out that this is slightly misleading (as it implies Mozilla had a security flaw before the fix), because, even before the whitelist fix was added, you had to do the following to get infected by any malware:
    1. Enable Javascript
    2. Enable install from XPI locally and globally
    3. Click on a Javascript link on a WWW page (which would be shown in status bar) (N.B. Mozilla does not execute XPI-related JS automatically--the user must have clicked the link)
    4. Wait a few seconds while watching a very large uncancellable dialog box saying "A website is requesting permission to install the following item", giving full details of the program it is installing (including its signatures in big red letters, its name and its URI), and saying in big bold letters, "Malicious software can damage your computer or violate your privacy. You can only install software from source you can trust."
    5. After waiting a few seconds you, you then had to press a button labelled "install now".
    I'm guessing that even some ex-MSIE users might not go through all that on the request of a malicious WWW site they have found.

    I digress.

    --
    Joe Llywelyn Griffith Blakesley
    [This post is in the public domain (copyright-free) unless otherwise stated]
    1. Re:Misleading by Paulrothrock · · Score: 4, Insightful
      I'm guessing that even some ex-MSIE users might not go through all that on the request of a malicious WWW site they have found.

      That depends. Does the link promise free pr0n, money, or chocolate? Or does the link say it will find and destroy malware or pr0n on your system.

      Social engineering is the most effective exploit of any system.

      --
      I'm in the hole of the broadband donut.
  17. Re:I'd still rather by BenBenBen · · Score: 4, Funny

    How about "those greedy corporate cocksuckers with the strait-jacket EULA and dozens of politicians in their pocket"? M$ is just faster, I'm afraid...

    --
    The Slashdot Paradox: "100% Overrated"
  18. But who will upgrade? by Scarblac · · Score: 4, Interesting

    Last week, right before this news, there was news that a lot of people switched to FireFox because of the vulnerabilities in IE.

    Who's going to tell them now that they should upgrade their FireFox to the fixed version, because there was a problem?

    It doesn't really matter that it was fixed quickly. The people that didn't install updates for IE, won't install the updates for their brand new FireFox either. Sadly.

    --
    I believe posters are recognized by their sig. So I made one.
  19. Re:not so fast of a fix by Diabolical · · Score: 4, Informative

    Why is this modded interesting?

    First of all, it wasn't a bug at all, it was a problem in Windows' URI handler. Mozilla merely redirected unknown uri's to this handler as it was expected. The "bug" the op mentions was a discussion about whether this feature was safe or not.

    When it turned out that it wasn't safe, the Mozilla team was very quick to solve it.

    Very simple solution by the way, just turn the redirect off... now the user has to explicitly consent with this action instead of automagical launching of apps.

    By the way, this feature was a MS one, not Mozilla's idea. Recent bugs in the MS product family are actually the same. Just an exploit of the URI handling of Windows.

  20. Re:not so fast of a fix by Anonymous Coward · · Score: 5, Informative

    Wrong, generic bug about potentially hazardous protocol handlers was opened in 2002, and framework for dealing with them was created.

    The specific shell: protocol was pointed out as maybe dangerous one day before it was fixed (with just a configuration change, because that framework was already there).

    Very quickly fixed.

  21. Re:not so fast of a fix by That's+Unpossible! · · Score: 5, Insightful

    No, the bug was in Windows XP's handling of the shell: protocol. It can be exploited to run arbitrary code. When this was found out, Mozilla team released a patch to prevent shell: protocol links from working, cutting off access to the real culprit in Windows, which won't be fixed until SP2 for XP.

    The 'bug report' opened at Mozilla in 2002 was essentially trying to deal with the way Mozilla handles unknown protocols. The normal way was just to pass them to the OS.

    E.g. since aim: isn't recognized by Mozilla, an aim: link would be passed to the OS, and if you had AOL IM installed, it would have registered to handle that protocol. (Often used to install a new "buddy icon.")

    I believe Mozilla is now going to allow you to let certain protocols through, instead of allowing all.

    So it's QUITE a stretch to say that this exploit bug we're talking about is (a) in mozilla, and (b) around since 2002.

    --
    Ironically, the word ironically is often used incorrectly.
  22. Re:not so fast of a fix by EulerX07 · · Score: 4, Informative

    Want to know what the best part is?

    The original poster was right, and your uninformed bash at his comment caused the truth to be modded down. Maybe he doesn't like Microsoft, but even paranoid people get it right sometimes.

    You may want to read this interesting article. In it, you'll find that this "shell bug" he's talking about is exactly what the mozilla bug was, and that it also affects word and MSN messenger.

    Sorry to burst your bubble. And technically MS didn't fix it yet, they just disabled ADODB.Stream until they do.

  23. Re:I'd still rather by Mongoose+Disciple · · Score: 4, Insightful

    Disclaimer: My post is about the "let me make name changes I think are clever and funny" trend and not the parent poster.

    As opposed to people massively using names like "Lunix" or "open sores"?

    I've... never seen anything like that used here on Slashdot. Not ever.

    That's not saying it hasn't been, but it's sure a hell of a lot less common.

    As long as those MS zealots don't disappear, expect names like "M$".

    Wouldn't you rather be the bigger person?

    Personally, I'd rather have intelligent discussion about the strong and weak points of various OS/software/languages/etc. here than stupid name calling. Maybe it's just my own prejudices, but when I see a post with that kind of crap, I assume I'm as likely to get reasonable discourse out of the post as I am to get a fair and balanced opinion about non-Causasians from a member of the KKK. I skip to the next post.

    (I also assume the poster lives in their parents' basement and has never touched a real girl, but I keep that to myself. That'd be unfair and non-constructive name-calling, too.)

  24. Ignorant developers by gr8_phk · · Score: 5, Interesting
    The software should not allow a web site to initiate any action on the client side. Security 101 here people. Opening files using the default application is pushing the limit. Allowing the site to specify what you run was just plain stupid. The Mozilla team should not just disable that feature by default, but should remove it entirely. There are work arounds for the small fraction of users who have a legitimate use for that.

    IMHO, desktops (GNOME, KDE) are crossing the line and even X itself has some "features" that may lead to exploits if developers aren't careful - remember the window manager is just a program that can actually control other programs on the machine. No application should ever tell another what to do based on untrusted data, that's reserved for the user (clicking a link doesn't count as approval - the link may not do what it claims).

    When you add a feature, consider what a criminal might use it for and who the burden will land on to prevent it. With shell: the burden lands on any application you might possibly launch and that's just unacceptable. With a window manager, consider that I may want to offer my display server to some untrusted application (airline reservation system) running on a remote machine - great possibilities and a great security risk. Because so much is accessible through X we don't use it that way.

    I'm rambling now trying to gather too many thoughts in too little time.

  25. Re:Just to clear some things up... by RonnyJ · · Score: 4, Insightful
    Actually I think the biggest marketing achievement in the last 10 years was Microsoft convincing the public that Win2000/XP is more secure than Win9x.

    Are you serious? You're saying that an operating system that let anybody use it by simply selecting 'Cancel' on the login screen (if even enabled), is more secure than Windows 2000/XP. Madness.

  26. Re:Handling a full court press? by argent · · Score: 5, Insightful

    I don't believe OSS has ever encountered the concentrated, unrelenting targeting Microsoft has to endure.

    You're mistaken in your belief.

    People argue that Microsoft's getting unfairly blamed becauise they're the majority of the targets. And yet in areas where they haven't been the primary target they have still often had a significantly larger number of exploits for extended periods of time.

    For example, for years IIS had a consistent 30% share in the webserver market, yet over the same period IIS served the vast majority of defaced websites.

  27. NOT just a Windows/Mozilla problem by for_usenet · · Score: 5, Insightful

    Folks - this is not just a Mozilla/Windows problem. Just a few short weeks ago, a lot of noise was made about a very similar URI exploit on Mac OS X, both through any browser that runs on OS X (noise was made about Safari, and I verified that the exploit was also present in Camino) and OS X's help system.

    Because of the seemingly general nature of this type of exploit - why are we letting browsers run code ?? The web SHOULD primarily be to exchange information (text, images, audio, video). Why are we allowing remote program execution?

    1. Re:NOT just a Windows/Mozilla problem by argent · · Score: 4, Insightful

      Oh good, it's not just me who thinks the promiscuous use of protocol handlers and helper apps is a bad idea. Every time I bring it up on /. or anywhere else I get hit with platitudes like "it's a balance between security and convenience"[1], or "it's not Mozilla's job to debug Microsoft's bugs."

      IDGI. This should be an open and shut case. Feeding data you know can't be trusted to an application you don't know is secure without so much as asking the user if that's OK is so obviously a bad idea that I can't comprehend the confusion of the mind that considers it for a moment.

      [1] No, it isn't, you can build a system that's more secure and convenient if protocol handlers didn't have to double as security software because they don't know if they're being run from a browser or directly from local code... if a browser doesn't KNOW that it's safe to use a registered protocol or helper app, it shouldn't blithely go ahead and use it.

  28. Re:not so fast of a fix by _xeno_ · · Score: 4, Informative
    As many people have mentioned, this bug was found two years ago.

    Since Mozilla doesn't like people on Slashdot being able to trash-talk their browser by linking to bug reports, you'll have to copy the links to actually visit them, but:

    2002-08-20 - http://bugzilla.mozilla.org/show_bug.cgi?id=163767 - root of all these bugs, Mozilla passes unknown protocols to Windows
    2002-08-20 - http://bugzilla.mozilla.org/show_bug.cgi?id=163648 - same bug, spefically could launch IE and allow the execution of VBScript (possibly in the local security zone)
    2002-10-03 - http://bugzilla.mozilla.org/show_bug.cgi?id=172498 - same bug, hcp: protocol could delete any file on your computer (wildcards allowed)
    2002-10-07 - http://bugzilla.mozilla.org/show_bug.cgi?id=173010 - requested a whitelist to avoid future instances of the same bug

    This bug has been known about for two years. It still hasn't been fixed. When SP2 adds the "delete:" protocol or similar, then Mozilla is going to be vulnerable to that, too. And it looks like the developers have decided not to bother fixing it.

    This isn't a triumph of open source - it's an example of how open source falls prey to exactly the same problems closed source does. Except publically, so you can point to these discussions to demonstrate that they knew about the issues for two years.

    --
    You are in a maze of twisty little relative jumps, all alike.