Slashdot Mirror
Spyware for Firefox Coming This Year?
EvilCowzGoMoo writes "One of the main reasons for the Firefox browser's successful seizure of market share from Microsoft's Internet Explorer is the desire to escape the inundation of PC-slowing spyware. However, spyware experts indicate that with its increased popularity, Firefox itself will become a target for spyware creators." From the article: "Basically, if you use Firefox today, you're not susceptible to any spyware, other than what you download when you're on Kazaa...The spyware writers target mostly Explorer users because that's the most fertile feeding ground for piranha-like (spyware) attacks. They'll watch as Firefox becomes mainstream, they'll see opportunity there and start targeting them."
Spyware already exists for firefox in XPI form. Please lookout of malicious XPI's More information on this can be found here. http://forums.mozillazine.org/viewtopic.php?t=6434 1
Can someone explain how this is possible?
On IE there is the mess that is called ActiveX. Are we talking up XUL? Or perhaps malicious plug-ins?
What about all those signed java applets out there all ready?
The user only needs to press 'OK'(which they usually do) and the applet gets full system access(because of the signing).
Doesn't look very safe to me.
I know you can configure this, but normal users doesn't do that
How about a program that takes the cryptohash of the virgin final installed code, and checks against that hash periodically (every 5 minutes, every new website, every app launch)? When spyware strikes, it changes the app fingerprint, and this sentinel could keep a log of recent traffic for analysis, and offer to reinstall. Our desktop immune system should take advantage of our "known good" info to detect these cancers when they start, and track them to their source.
--
make install -not war
Sure, there will probably be companies like that. That's the risk you take when you use open source software.
At least I have a better chance of less exploits created because there are so many eyes on the code.
I've heard that openBSD developers have founded and fixed other security bugs while working to fix exploits, so I still don't see an inherent disadvantage to using FireFox vs. Explorer.
Security holes _will_ be found (some have been found already see the url spoofing). And some firefox users specially non-savvy ones (a portion that will grow as firefox goes mainstream), will not upgrade.
Spywares will exploit this
The security of Firefox is an illusion. Security through obscurity is not a viable plan for security permanence - if your product is good enough and marketed aggressively enough (and I do count word-of-mouth marketing in this), it will spread and be targeted. It is that simple. It's not until you have the full force of virus/spyware writers coming against you that you know whether all your previous big-talking statements about your security will stand up for crap. My belief? Firefox is going to find itself besieged and it will be a huge test for the OSS community, to see if they can really handle these problems as well as they always say they can.
IMHO that's a lot of FUD. Firefox is not nearly as vulnerable to spyware as IE is. Firefox by default has XPI installation disabled except by approved sites.
Installing spyware on Firefox would be much more about social engineering (if you want to see this website, follow these instructions: download, choose "save as...". Then double click on it, yadda yadda..."
Of course, with people falling for phishing attacks, it wouldn't surprise me they'd be so stupid to do this. In that case, Firefox should issue a warning about "evil XPI files". At least that way when some moron says "bwaaa they told me firefox was spyware-free", we can ask: "Did you follow the evil website's instructions when they told you to install this XPI?"
Then all we have to do is repeat the worldy-famous Nelson quote.
What about those guys who offered $15,000 to anybody who could hack their Mac web server back in the 90s? Nobody ever collected the prize.
Real security is something which can be accomplished.
*BSD is secure because it was designed to be secure, not simply because it's less common than other solutions. Likewise, if Internet Explorer 6.0 only represented about 15% of the market, it would still be hacked with shocking regularity, because Microsoft's security is a joke.
I'm not saying that all this means Firefox is as secure as some of the other technolgies I just mentioned. I'm no expert on the codebase for Firefox. It might be downright vulnerable. I will say, however, that it's hard to imagine it being worse than IE.
Information wants to be anthropomorphized.
To be fair to Windows, I've found that FF 1.0 installs extensions into the users' profile folder, even when I'm in as Administrator.
They click "Yes" because they simply are doing whatever they think will get them to the next screen. It is no different for the 30+ data entry people that I work with. All they are doing is completing as much as needed, as fast as they can, to get to the next screen
I truely believe you are only half right
Yes, we will see more Firefox/Linux/Mac viruses/exploits in the future.
However, the 'barriers to entry' will be higher, because these systems simply are MORE secure.
Evidence? Server marketshare. Linux has comparable marketshare to Windows, yet Linux is compromised less often.
Not never. Linux IS indeed compromised, and at statistically significant levels.
But given the comparable marketshare, linux is compromised quite a bit less.
I suspect the desktop landscape will become similar. Linux/Mac marketshare will approach windows. Linux/Mac viruses/exploits will become more popular.
But they will never reach the levels of Windows exploits in their heyday.
WhiteWolf666 an exBush supporter. All you new-school,compassionate,save the children Republicans can rot in hell
Let's let them continue to forget, so that I can browse the web in peace, huh?
If the market is indeed split into two major parts, this is actually a bad thing, because it gives you only two huge targets. That makes it easier and less expensive to create viruses, or take over computers for monetary purposes.
This is very true, that our security is well served by heterogeneity. And not just in browsers, but in platforms. I'd bet we'll find that some of the attempts to infect Firefox are targeted specifically at Windows exploits, and even don't work on Linux/OSX. Maybe they'll come up with an extension/toolbar that reports searches and browsing habits back to some marketing team, but that in itself doesn't bother me so much.
The shear fact of spyware, that some software reports some kind of information back to someone, that's one issue, but at least users can choose that for themselves. It's the self-installing programs, impossible to remove, inflicting damage on your system as you force-remove them, installing other spyware as it goes, reinstalling itself as it's removed, etc.-- those facets of spyware are what trouble me. And I doubt it will be terrifically easy to create platform-agnostic spyware that exhibits those properties, even if you have a common browser.
I have to say we are in good hands for the time being. Mozilla has been pretty quick to release patches and fixes to bugs that were found. Additionally we have to consider one important thing -- Firefox does not integrate with your operating system, like IE does. This is why when you log onto the net 'unpatched', you can get infected just by being online (which is amazing to me). The future of spyware may be aimed more towards Firefox but in a way, it's helpful to Firefox for spyware/malware writers to target it -- it helps them close security holes that aren't known about and help prevent and protect against other things. And since the Mozilla community (oh yea, open source!) is very good in turnaround time to support the browser, the patches will be relatively swift.
So while the author may be right that malware and spyware authors may target Firefox as it gains popularity -- Mozilla and its hordes of programming legions (the open source community) will work together to close the holes that open and see they can't be opened in different ways. In IE, if you closed one hole, you opened another, very similar one. Not that IE is bad, but it was really just abandoned and now that Firefox has the head start -- it's going to stay ahead for the foreseeable future. We will see what Longhorn brings to the table, with the next iteration of IE though.
Either way, I am the type of person that's convinced we will see the end of SPAM in the foreseeable future... I don't see why continual development can stop spam entirely.
The price is always right if someone else is paying.
when using Firefox or Mozilla is the Java virtual machine, most often the Sun JRE is used. There are some security holes in the JRE and this has nothing to do with Firefox. I mean, if you think you're safe with Firefox - update your JVM first. Or don't use any. Bizarrely, nobody ever talks about the Sun JRE. It's very far from perfect though, and must certainly be taken into account.
The hoped-for result would be that people would be discouraged from switching because they believed it didn't matter. They'd think I was going to get them one way or the other, so they might as well stick with what they're used to. The hoped-for result would be that people stay on IE and keep my job easier.
I'm not saying that this is what's happening, but I wouldn't be surprised if it were to happen.
Exactly
Chances are any spyware for FF will launch popups and whatnot when you run FF.. Whereas IE spyware can launch popups even if IE isn't running (cause it actually is always running)
Worst that can happen is you delete firefox and reinstall it. All better
With IE, worst that can happen is you format and reinstall windows.
Yay FF! =P
[an error occurred while processing this directive]
IDN Allows Bypass of Mozilla's "Allowed Sites" List
Background:
DN[International Domain Name] support in Mozilla allows bypass of 'Allow Sites'. Problem is caused in the way Mozilla handles IDN when used to handle checking of the list of allowed sites.
Example:
<a href='http://update.xn--mozill-8nf.org/ malicious.xpi'>Friendly Extension Name</a >Update.mozilla.org will be checked against the whitelist instead of update.xn--mozill-8nf.org.
Threat:
Exploit could be used to trick users into installing malicious extensions.
Solution:
Don't trust 'Software Install Prompts' Use a different browser
Author: Todd Lehr
Have you ever been to a turkish prison?