Slashdot Mirror

← Back to Stories (view on slashdot.org)

Spyware for Firefox Coming This Year?

Posted by Zonk on from the deeply-unsettling dept.

EvilCowzGoMoo writes "One of the main reasons for the Firefox browser's successful seizure of market share from Microsoft's Internet Explorer is the desire to escape the inundation of PC-slowing spyware. However, spyware experts indicate that with its increased popularity, Firefox itself will become a target for spyware creators." From the article: "Basically, if you use Firefox today, you're not susceptible to any spyware, other than what you download when you're on Kazaa...The spyware writers target mostly Explorer users because that's the most fertile feeding ground for piranha-like (spyware) attacks. They'll watch as Firefox becomes mainstream, they'll see opportunity there and start targeting them."

12 of 630 comments (clear)

  1. Malicious XPI's exist already by flyingace · · Score: 5, Interesting

    Spyware already exists for firefox in XPI form. Please lookout of malicious XPI's More information on this can be found here. http://forums.mozillazine.org/viewtopic.php?t=6434 1

  2. IE and Firefox have different problems by Anonymous Coward · · Score: 5, Insightful

    IE's spyware problems were largely due to exploits. Someone not up to date with patches could visit a website and have something remotely installed pretty easily.

    For Firefox, though, it'll take social engineering. The place to look for the spyware threats is in the brand new extension you WANT to install. Most Firefox users have at least one extension, and many have a dozen. How do you know what each of those is doing behind your back? Most people don't bother to scan the code, and while some may do so and report problems publicly, will you find out about them? A firewall won't even help you in this situation since you've probably given Firefox free access to port 80 (plus 443, etc).

    Mozilla should probably create some sort of permission system for extensions. Can it connect to a remote server? Can it write to disk?

    1. Re:IE and Firefox have different problems by maskedbishounen · · Score: 5, Informative

      This is why Mozilla Update exists. A safe haven for users to find extentions that won't screw them over.

      Supposedly.

      If nothing else, at least it has a rating and feedback system, so you'll have a heads up from others.

      --
      "An infinite number of monkeys typing into GNU emacs would never make a good program."
    2. Re:IE and Firefox have different problems by j-turkey · · Score: 5, Insightful
      IE's spyware problems were largely due to exploits. Someone not up to date with patches could visit a website and have something remotely installed pretty easily.

      For you and I, I'd say that exploits are the issue...but in my experience, most average users don't get a malware infestation via browser exploits (mainly because when you and I see the words Gator or Newnet, we say hell no). They simply click "yes" when asked if they'd like to install a piece of software. I don't know if the mentality is "yeah I want more functionality" or "yeah yeah, just show me the damn webpage!". One way or the other (antecdotally), most of the users whom I deal with tend to install the malware themselves. FWIW, these users tend to be on the low end of the learning curve.

      It would be interesting to see a permission based system for this...maybe even registering approved plugins with a crypto signature/hash.

      --

      -Turkey

  3. What people don't understand is this... by Anonymous Coward · · Score: 5, Insightful

    Security is a process, not a product. There is no magical one product or suite of products that will protect you while online. Security is risk mitigation, plain and simple. Far less people would be vulnerable to the tricks of the miscreants out there trying to do people harm if they would just employ a little common sense. But, alas, common sense isn't that common.

  4. Re:...and.... by arkanes · · Score: 5, Informative
    Current versions of firefox don't allow this, unlike the (annoyingly easy to mis-click) ActiveX install dialog in IE. There's a whitelist for sites permitted to install extensions, which (by default) is limited to the offical Mozilla update site. Sites not in the whitelist won't even get a dialog, instead a yellow bar at the top of the screen appears, with a button you can use to access the whitelist and add the site. A site on the whitelist gets the standard dialog, which has a time-delay OK button to help prevent mis-clicks. There's no absolute way to prevent people from installing malicious extensions, but (assuming there's no bugs in, say, the whitelist implementation) Firefoxes current model is about as good as you could get.

    Note that older versions of Firefox (and Mozilla) don't have the whitelist, and even older ones don't even have the dialog and are in fact vulnerable.

  5. "Expert"? by Kupek · · Score: 5, Informative

    Their expert is the Vice President of Threat Research at Webroot. That much is from the article. The article doesn't take the next logical step, however, and point out that Webroot is in the business of developing and selling software to prevent, detect and eleminate spyware. So it's certainly in this guy's interest for people to think that spyware is still a problem.

    Their other expert is also from a company that makes similar software. So people who make anti-spyware software agree: you need anti-spyware software.

    I'll be more concerned when independent parties think spyware in Firefox is an issue.

  6. Why more than just two browsers is a good thing. by hkmwbz · · Score: 5, Insightful
    Sometimes it sounds like the new browser war is between Internet Explorer and Firefox, and only those. But people often forget that there are other browsers out there, such as Opera and Safari/Konqueror (when will we get a decent KHTML browser for Windows?).

    If the market is indeed split into two major parts, this is actually a bad thing, because it gives you only two huge targets. That makes it easier and less expensive to create viruses, or take over computers for monetary purposes.

    What we need is several browsers that each have a significant part of the market. Not just IE and Firefox/Gecko based browsers, but also Opera and KHTML based browsers. Maybe there would be room for even more as well.

    It is good that an alternative browser is growing rapidly, but monoculture or duoculture makes life easier for virus makers. With four browsers, it would take four times the effort to get as much "bang for your buck" for virus authors looking to make money by infecting people.

    --
    Clever signature text goes here.
  7. Re:NO way!! by maskedbishounen · · Score: 5, Funny

    Pfft.

    I use GNU/Linux, so the only spyware I install on my system is GNU/Spyware!

    --
    "An infinite number of monkeys typing into GNU emacs would never make a good program."
  8. Typographical Errors in High Places by handy_vandal · · Score: 5, Funny

    Let's not get carried away here. I voted for him over the other guy, but I don't think I would describe anything he's ever said as "immortal."

    Typographical error -- should read "immoral words" ....

    -kgj

    --
    -kgj
  9. He hit the nail on the head by beef+curtains · · Score: 5, Insightful

    Nevertheless, Stiennon also indicated the creators, maintainers, and even users of Firefox will quickly and aggressively step up their anti-spyware efforts along with the increased threat. "The people who use Firefox -- their reaction to any spyware-type attacks will be pretty vehement," he said. "There'll be fast reaction from both Firefox developers and users."

    I think this part sums up the beauty of Firefox, and the reason why I don't think this is any sort of cause for alarm:

    There is a whole community of brilliant frickin' people out there who have taken a personal interest in making sure Mozilla products are secure & as bug-free as possible. I don't think it would be an exaggeration to say that they might look at Firefox as "their baby."

    More importantly, some of these individuals are well-versed with the shadier aspects of software...so I predict Firefox security holes being patched as quickly as they're found.

    Not only that, but I don't see many Firefox users (especially not those that have used it since its early days) taking spyware/adware lightly...turning the other cheek or throwing hands up in frustration don't seem to be personality traits of bastards like us ;)

    --
    Just once I'd like someone to call me 'Sir' without adding 'You're making a scene.'
  10. Re:Explain yourself... by hab136 · · Score: 5, Insightful
    What's the reasoning behind your guess? The old argument that simply because the open-source community has more coders, they're bound to fix problems more quickly and get it right the first time?

    That and OSS has coders that aren't being hamstrung by marketing weasels. If something is awesome, but would take too long to develop ("cost too much"), an OSS developer can still do it if he wants.

    What guarantee do we have that the people looking at the code are even qualified to review? What insurance do we have against their work if it goes wrong?

    None, same as closed source developers. No company will pay you, either voluntarily or in a lawsuit, for bugs in their code; neither will OSS. Read your EULAs.

    Who's accountable?

    Nobody, same as closed source developers. Both have reputations to uphold, but commercial developers only care about their reputation as a means to profit. If they can make money without bothering to have a good reputation, they will.

    One advantage is that OSS developers have a reputation they would like to uphold. If they write crappy/insecure code, people stop using their code. Closed source developers will often say "well, it works, and it sells, so.." and let the developer stay on, making more bugs.