Spyware Disguises Itself as Firefox Extension

Juha-Matti Laurio writes "The antivirus specialists at McAfee have warned of a Trojan that disguises itself as a Firefox extension. The trojan installs itself as a Firefox extension, presenting itself as a legitimate existing extension called numberedlinks. It then begins intercepting passwords and credit card numbers entered into the browser, which it then sends to an external server. The most dangerous part of the issue is that it records itself directly into the Firefox configuration data, avoiding the regular installation and confirmation process."

Comments

Not a vulnerability.

[Short Circuit]

Note that this isn't a Firefox vulnerability.

The trojan is opened as a Windows executable from email attachments, and writes itself into the Firefox profile's configuration directory.

Re:Not a vulnerability.

[kfg]

I refuse to use this trojan until it's ported to Linux.

We have to send a message to developers that we want our apps native.

KFG

Re:Not a vulnerability.

[Fred_A]

Nobody said it was a Firefox vulnerability.

Oh sorry, I forgot, nobody actually reads the articles here...

Re:Not a vulnerability.

[DrXym]

Well yes it is. Firefox extensions are an easy way to trojan a system. Anyone can write an extension and put it up on the addons site and there isn't even the requirement that it be signed. There is no enforcement of trust at all except for a primitive domain whitelist system. I think it would be fairly trivial to produce a malicious extension. Worse, you could even craft one that works on Linux, OS X and Windows in one fell swoop, since you have unfettered access to all of the XPCOM objects running in Firefox.

My feeling is that Firefox desperately needs to implement some kind of trust model. I can understand why that might not be RSA PKCS since the system is crap for small publishers. But something is needed. Even a trust model based on PGP signing would be of benefit.

I'm sure some would argue that no one looks at signatures anyway, which might be an exaggeration, but it does have some truth. It is certainly no excuse for offering no trust model at all, or for Firefox UI designers to not be able to produce some simple traffic light trust system with sensible defaults to simplify it for those who can't or won't look at the certs.

Re:Not a vulnerability.

[dschuetz]

Note that this isn't a Firefox vulnerability. The trojan is opened as a Windows executable from email attachments, and writes itself into the Firefox profile's configuration directory.

While true, perhaps a related problem that actually is a vulnerability is the fact that Firefox (apparently) only checks for a valid signature on the plugin at download/install time. Maybe the Firefox configuration file, or at the very least the binaries for each extension, should be cryptographically verified at runtime.

Of course, this presupposes that Firefox hackers can manage to get their extensions signed, and if that's possible, then the malware authors could do the same. Unless...FF gets distributed with a mozilla.org CA cert, and extensions accepted and published on the mozilla site(s) get signed with that cert, then every "legitimate" extension from the mozilla sites will be verifiable at runtime. The user could opt out of that with an "allow execution [not installation] of unsigned extensions" preference setting, but the majority of users would be protected, so long as the malware doesn't also set that preference for the user. :)

(though even that last bit could be guarded against by creating a personal key to sign the config with, and every time you make a "security relevant configuration change" to the browser's settings, you have to re-sign the file.)

Re:Not a vulnerability.

[lowrydr310]

The headline makes it seem like Firefox is bad because there's a new piece of spyware that takes advantage of it.

Darn, I knew this was going to happen sooner or later. Time to switch to IE. oh, wait a minute...

Re:Not a vulnerability.

[Arker]

Note that this isn't a Firefox vulnerability.

Pretty much. It may be possible for the firefox developers to block this on their end, by inserting some kludges for the windows builds, but the exploit itself is an exploit of Windows/IE, and won't affect Firefox on a sane system. (Not even on Windows, if IE is thoroughly removed and a sane email program used.)

Re:Not a vulnerability.

[kfg]

McAfee do not describe it as a Firefox exploit. They describe it as a VBS exploit originally written to target IE, i.e., a Windows exploit.

KFG

Re:Not a vulnerability.

[KiloByte]

... or until the trojan makes a trivial change in FireFox's binary.

Once you're pwned, you're pwned. If you give someone free reign on your box, he can do anything to any file writeable by you.

Re:Not a vulnerability.

[gowen]

I think it would be fairly trivial to produce a malicious extension. Worse, you could even craft one that works on Linux, OS X and Windows in one fell swoop, since you have unfettered access to all of the XPCOM objects running in Firefox.

Maybe. BUT THIS ISN'T IT. The possibility of a piece of auto-installing firefox malware doesn't magically mean this malware is such a beast.

Re:Not a vulnerability.

[greed]

While true, perhaps a related problem that actually is a vulnerability is the fact that Firefox (apparently) only checks for a valid signature on the plugin at download/install time. Maybe the Firefox configuration file, or at the very least the binaries for each extension, should be cryptographically verified at runtime.

Once someone's system is compromised, they can replace or alter the FireFox binary which verifies the signatures, replace libnssckbi.so, libsoftokn3.so, whatever.

You can't win at that point. If you're storing your operating system and executables on writable media, it can never be trusted to that level. The hardware would have to cryptographically verify the boot loader on disk, which would verify the kernel, which would then be able to verify everything it executes--FireFox alone can't do it.

(Say, what was that hardware-based Trusted Computing stuff supposed to do? In addition to ramming DRM down everyone's PCI bus, wasn't there system verification too?)

Re:Not a vulnerability.

[140Mandak262Jamuna]

Come on, You dont even have to be a script kiddie to write malware for Linux.

This is how it works:

First create an executable that will do bad things. It could even be a csh script. Then send emails to all and sundry like this and attach that file"

Dear Linuxuser,

This is a virus/trojan/worm/malware for Linux. It works on the honor system. Please forward the attachment to all addresses in your .mailrc first and then save it to disk, chmod +x and sudo it. Thank you.

Attachment: malware

Re:Not a vulnerability.

[zo1dberg]

This is the one thing that keeps people from running Linux on their desktops! We normal users don't want to fiddle around with the commandline and stuff like that, we need a point-and-click-interface to compromise the security of our computers! Trust me, until this is fixed, Linux has no hope of ever becoming a serious competitor to Windows.

Re:Not a vulnerability.

[Sebastopol]

Well, seeing that firefox does a 5... 4... 3... 2.. 1... timeout to install unsigned extensions, perhaps they should crack down a bit more on authenticity, and only provide extensions registered on their site or something similar.

I think this is a FF problem, just like with other SW that gets hacked.

Re:Not a vulnerability.

[arose]

Well yes it is. Firefox extensions are an easy way to trojan a system.

1. Not more then any other software you install.
2. This isn't really an extension, more like a modified version of Firefox.

Re:Not a vulnerability.

[archen]

I think you'll still end up with the same problems though. Where does firefox keep it's list of trusts? In the registry, or a config file? People will want to develop/install plugins that aren't signed so you'll need to be able to make exceptions. Where will the settings for the exceptions be stored? In the registry or config file?

I think this just gives you a false sense of security. If you're OS were secure and you knew for a fact that no one else could ever write to the firefox config files or the registry, you could sign things just fine. But this isn't a man in the middle attack, but more like a "man in the backroom" attack. And that's exactly what this spywhere does.

Re:Not a vulnerability.

[Not The Real Me]

Good point.

A friend of mine has certifications as an MCSE and a CNE. When I tell him to run "ipconfig /all" and "route print" (on his WinXP machine), the look of consternation and confusion on his face is priceless.

Re:Not a vulnerability.

[AugustZephyr]

Long live the Fox. (Stupid windows security flaws).

Re:Not a vulnerability.

[StormReaver]

"Note that this isn't a Firefox vulnerability."

I consider the entire Firefox extension mechanism one big vulnerable open door. On Windows, it's no big deal. There is no vulnerability that Firefox enables under Windows that Windows itself doesn't already provide. Under other operating systems with correct separation of programs and data, though (such as anything Unix-like), the extension mechanism is bypassing the operating system's protections.

Linux systems provide applications in root-protected directories, providing protection against userland software (such as viruses) modifying program files. Install Firefox, though, and extensions go into unprotected user directories. This opens the door for viruses to propagate through Firefox itself.

Cryptographically signing extensions won't matter much either, as the people who don't understand how to manage signed packages represent the vast majority of Firefox users.

Re:Not a vulnerability.

[Drachemorder]

Any piece of software capable of running executable code is vulnerable to trojans. Anyone can write an executable program to do nasty stuff, and there's no reasonable way for an application to tell the difference. Firefox can't figure out on its own that an extension which deletes files or sends email is malicious, because such functionality can conceivably be useful. The only real solution is to educate people about running untrusted executable code, and Firefox already takes every reasonable precaution to do so. So much so, in fact, that it's a bit annoying when you really do want to install an extension. Trojans are a form of social engineering; with enough effort you can convince most people you're trustworthy, and there's very little that can be done to prevent that sort of activity, except perhaps educating people about the possibility.

So the problem isn't the software. It's the people using the software. As more people learn about Firefox, we'll just have to accept that some of them are going to be stupid. It's a statistical inevitability. You can fix security holes all day, but you can't fix stupid.

Re:Not a vulnerability.

[jZnat]

If the user has control over trusted computing (e.g. can recalculate or re-sign a good state), it can be good. If not, it is very tinfoily.

Re:Not a vulnerability.

[PsychoSid]

csh ! What century have I entered this time.

Re:Not a vulnerability.

[Schraegstrichpunkt]

This malware had read-write access to C:\Program Files\Firefox. Nothing would have stopped it from disabling any signature-checking code that might have existed.

The Firefox extension trust model is as secure as SSL and the SHA-1 hash function.

Re:Not a vulnerability.

[Schraegstrichpunkt]

perhaps they should ... only provide extensions registered on their site or something similar.

That's already done, but this malware bypasses that because it's executed elsewhere on the system (i.e. there's nothing Firefox could possibly do at this point).

I think this is a FF problem, just like with other SW that gets hacked.

That's either because you haven't bothered to inform yourself about the problem, or because you're trolling.

Re:Not a vulnerability.

[dipo]

But it should be possible for Firefox at startup to check it's installed extensions with a hash (or something like that), to prevent those external installed Malware from execution inside the FF-Task.

Looks to me like a future security feature: Only execute extensions loaded and signed by addons.mozilla.org.

Oops, signing is implemented by the existing extension infrastructure!? Where's the problem using that infrastructure for installing _and_ startup?

Re:Not a vulnerability.

[RedOregon]

Actually, I'd call it a "man in the backdoor" attack, considering what it does to you...

Re:Not a vulnerability.

[jedidiah]

You might as well say that Debian, sourceforge or freshmeat need to all implement trust models.

Executables can end up trashing your system, even if they aren't meant to do so.

Re:Not a vulnerability.

[soft_guy]

A friend of mine has certifications as an MCSE and a CNE

With friends like that, who needs users?

Re:Not a vulnerability.

[DrXym]

Well the should. In fact, I read just the other day that Debian will be signing packages at long last. It's not brain surgery to do either - Red Hat has been doing it for a very long time.

Re:Not a vulnerability.

[kilodelta]

And if you're running Thunderbird, along with things like Popfile, etc. you have a much smaller chanced of this being a problem.

Everyone to whom I've recommended Firefox has also received the recommendation that they install Thunderbird and Popfile.

This is just McAffee trying to drum up business.

Re:Not a vulnerability.

[jftitan]

Dear Linux User,

    This is a virus created for Windows users, and it is based on the honor system.
  Please forward this email and its trojan/virus written attachment to all your
  Microsoft based users, and let them know how much you care!

    Sincerely,

      Another Linux User Friend

ATTACHMENT: firephox.extention.exe

Re:Not a vulnerability.

[DrXym]

This exploit might be a hacked Firefox, but even the vanilla Firefox is an easy attack vector.

The very first page you see after installing tells you to Install Extensions. And what is only a few clicks from that page? Hundreds of untrusted extensions, with the new ones helpfully listed first.

It would be TRIVIAL to insert a trojan onto that site. You can guarantee that people would download and install it without thinking twice. With a little more effort you could even hack a popular extension's home site and insert an additional payload. Firefox would even helpfully tell all the users there was an update. Sooner or later someone would catch on, but by then it is too late. At present there is no way to gauge the trustworthiness of an extension because no one signs them. And no one signs them because PKCS is shit and there is no alternative mechanism around PGP. There should be.

The funny thing is IE was panned for ActiveX control issues and yet Firefox contains something just as serious in extensions. It is true that extensions must be voluntarily fetched by a user so the user base as a whole has a lot of protection, but it does not excuse the lack of trust information for the poor sucker who caught a dose from Mozilla's own web site.

Re:Not a vulnerability.

[cyber-vandal]

Not as priceless as the look on my face on reading that and noting that that clueless muppet gets paid a lot more than I do. Maybe I should get off my arse and get one of them MCSE thingies.

Re:Not a vulnerability.

[arose]

It would be TRIVIAL to insert a trojan onto that site.

I still don't see how that differs from a trojan on, say, SourceForge--that's just how trojans are.

The funny thing is IE was panned for ActiveX control issues and yet Firefox contains something just as serious in extensions.

IMHO problem with ActiveX are the seemingly endless vulnerabilities that enable drive by installations, I don't see this with Firefox.

It is true that extensions must be voluntarily fetched by a user so the user base as a whole has a lot of protection, but it does not excuse the lack of trust information for the poor sucker who caught a dose from Mozilla's own web site.

And your proposition for a distributed system of trust information that is transparent to users is? Sure, PGP/GPG signing might benefit to those who watch where they step, but it does little for those who are most susceptible to trojan attacks.

Re:Not a vulnerability.

[Thalagyrt]

Did you even read his post fully? It was a joke. It's funny. Laugh. Ha ha.

"We normal users don't want to fiddle around with the commandline and stuff like that, we need a point-and-click-interface to compromise the security of our computers!"

Re:Not a vulnerability.

[Sebastopol]

or because you're trolling.

Damn, I guess I have to throw back ANOTHER comic-book guy... The sea is full of them today.

Re:Not a vulnerability.

[Anonymous Coward]

Look, I got my MCSE in 1999, and I had to know how to use ipconfig and route as part of the course -- now, did that get covered in the test? I don't know. But it was part of the work we had to do in the TCP/IP module. It's depressing to me because I think MCSE used to mean something, but I also have encountered dolts who have a raft of acronyms after their email signature, and it's almost a sure-fire way of identifying useless chumps in the organization. I don't advertise my MCSE in my signature, and I instead refer to my 11 years' experience as my qualification for doing what I do: that, and the fact that almost everyone in the organization comes to me when they want something done right.

Re:Not a vulnerability.

[kwark]

Actually Debian has been signing packages for some time now.

Re:Not a vulnerability.

[drinkypoo]

It's depressing to me because I think MCSE used to mean something

It still does: Moron Confused by Sun Equipment.

Still better than Netware, which has two certification which stand for Certainly No Experience and Can't Network Anything.

Re:Not a vulnerability.

[X0563511]

Hell, you can probably take and pass the test without doing any of the coursework. Or you could do the coursework anyways and have a slight chance of learning a tidbit or two. I got my A+ without any study (like that's an accomplishment around here...)

Re:Not a vulnerability.

[infosec_spaz]

Oh, come on....Mod parent up, it was FUNNY AS HELL!!! Give it a 6, come on.

Re:Not a vulnerability.

[pedalman]

When I tell him to run "ipconfig /all"

It would be a lot more fun to tell him to run ifconfig on his XP box, and watch the frustration build as XP can't find the command. It would be more fun than putting an Aggie in a round room and telling him to "pee in the corner".

Re:Not a vulnerability.

[bergeron76]

Easy solution:

Bring back the WORM drives - Write Once Read Mostly. You can install your program on it, run it from there, but store your config data on a separate (safe/sane) location (ie. USB key device, etc). These days, I guess the CD/DVDrom's are the equivalent to WORM drives. I guess a CD_jukebox_OS with a USB "settings" device is yesterday's future.

Re:Not a vulnerability.

[dbitch]

But what's horrible is that a malware doesn't have to be root to inflict a significant amount of damage. Think of it like this:

1) You get infected as your normal user.
2) It runs when you open a shell for the first time.
3) It proceeds to wipe your /home OR search for your credit card details OR mass mail itself to every email address it can fine in your /home

So, what have you gained running as a normal user? The ability to wipe that user out and start afresh without having to reinstall? What's the difference, really? Remember, all of your important settings are in your /home. Don't get me wrong, I run debian too. No winbloze fanboyism, but just because a script doesn't have root privliges doesn't mean it can't inflict major damage. The secret is not !Windows, it is not being a luser.

Re:Not a vulnerability.

[Anonymous Coward]

I have modpoints now, and could have given you one, had you not written:

"winbloze"

Please remember that for the future. It's sad *nix fanboyism to write such words, as are forms of "Microsoft" with a string symbol($) in it, variations on "Windows" and constructions with "Internet Explorer". Thank you.

Your comment was otherwise insightful, and you hit the nail on the head, but then you had to go and spoil it all by saying "Winbloze" ...

Re:Not a vulnerability.

[DrXym]

And your proposition for a distributed system of trust information that is transparent to users is? Sure, PGP/GPG signing might benefit to those who watch where they step, but it does little for those who are most susceptible to trojan attacks.

GPG signing could be used to employ a traffic light system. Most of the developers in the Mozilla scene know one another so it is possible to build a web of trust and then represent that web with a simple metaphor such as a traffic light when installing the extension. Green could mean the person is one step away from the Mozilla.org official signature or fully trusted by 2 or more people who are. Amber might mean they don't meet the criteria for green but they do have some signatures and red means unsigned or unvalidated. If the installer wants to see more detail they click on the light for it and perhaps even add their own trusts to the list. Obviously such a system should fetch keys and revocations prior to making this test.

Secondly, when I update an extension Firefox, it should verify that it is signed with the same key as the previous version. If it isn't, it should put up a big warning to that affect.

Thirdly, by default Firefox policy should not be to install unsigned / untrusted extensions at all, and for the addons site to marginalise unsigned / untrusted extensions. They should not be spotlighted, not appear under "what's new", not appear categorised with the other extensions.

Nothing is failsafe, but the fact is there is no trust at all at the moment. It is a dereliction of common sense to allow extensions to continue the way they are.

Re:Not a vulnerability.

[DrXym]

Well there you go :) The obvious advantage is that someone can't replace some .deb file with their own without it being noticed by the installer.

Re:Not a vulnerability.

[Cyberax]

Nope, MCSE is Minesweeper Consultant and Solitaire Expert.

Re:Not a vulnerability.

[Freshly Exhumed]

MCSE == Must Consult Somebody Else

Re:Not a vulnerability.

[arose]

Because no one cares about extensions that don't come from the inner circle of developers... This system fails the "distributed" criteria, because it mostly relies on the central authority of Mozilla developers. How would aspiring extension developer from remote-place-where-there-are-no-mozilla-developers -around get started?

Re:Not a vulnerability.

[georgeav]

Madly Causing Slashdot Effect
Microsoft Certified Slave of the Empire
Morons Crudely Simulating Expertise
Maybe Could Suggest Exorcism
more: http://linux.sys-con.com/read/32859.htm#MCSE

MozillaZine Has More

[Anonymous Coward]

This MozillaZine article has lots more on the trogan horse, including instructions for spotting if you have it.

Personally...

[celardore]

Personally I only download FF extensions from the official site.
https://addons.mozilla.org/extensions.php?app=fire fox

Re:Personally...

[Anonymous Coward]

Thats not whats going on. This trojan isn't installed as an extension, it comes as a regular old .exe in an email, which when you run it, then edits the firefox configuration files to add itself into the extension list without going through the normal extension process.

Re:Personally...

[celardore]

In that case... Who runs an exe they receive in an email? Unless I'm expecting it, and know the sender, I certainly won't.

Education must be the answer then. I learned not to open random executables from unknown sources many years ago. People apparently click them though. Teach a man to use the internet, and he'll be safe for a day. Teach a man to know the internet and he'll be safe for a lifetime.

Re:Personally...

[SydShamino]

Teach a man to send an "internet," and he can be a senator!

http://www.youtube.com/watch?v=DClkE64nFDY
Fast forward to about 2:00.

Re:Personally...

[SCHecklerX]

This is why we have implemented a mail quarantine here where I work. If a luser 'needs' an executable released early, they have to call the help desk and sign off that they know who the sender is and that they were expecting it.

Re:Personally...

[TheSpoom]

You, sir, have made my day.

Already saw the video, but good timing. ;^)

Re:Personally...

[jamshid]

In an ideal world all email would be signed, so that we know that it is from the address in the From: line. But even then, you don't really know it was sent by your friend -- it might be the result of a virus that got on their system, or their encryption keys were stolen. And even if it was really sent by your friend, you don't really know that the program is "safe".

The root problem is that operating systems / browsers / mail readers don't tell you enough about what "opening" an attachment or clicking a link/button is about to do, and they don't let you "open" that attachment or click that link in a sandbox. They need to let you choose the resources (directories on my machine, cookies, authentication info, other sites) that it will have access to. It doesn't have to be a mess of verification dialogs, it can be more subtle, use default safe behavior, remember selections, etc.

The browser/operating system already knows, or should know, all these things: will opening that attachment just show me a harmless picture? Does it open an external program that has full access to my machine? Does it open an HTML page in a sandboxed browser? Does that HTML page access outside resources (IMG SRC)? Does that HTML page contain executable code (javascript), does that code have access to outside resources? I expect pressing a form button to send information to the site I'm on -- is pressing this button sending it somewhere else?

I guess letting user's "in" on these kinds of browser decisions and actions is what IE's "zones" is trying to do, but that interface is horrible for regular users, and not transparent enough for technical users.

Is numberedlinks legit?

[dwayner79]

The article is not clear. If not, get it off the Moz site. If so, sux to be them.

Re:Is numberedlinks legit?

[savala]

The article is not clear. If not, get it off the Moz site. If so, sux to be them.

It is: "presenting itself as a legitimate existing extension called numberedlinks".

The McAfee characteristics page (2nd tab - stupid that that isn't directly linkable) also says:

The original component installs the following files:
* %MozillaUserProfile%\(ARBITRARY_CLASS_ID)\chrome\n umberedlinks.jar

FormSpy installs these additional files:
* %MozillaUserProfile%\(ARBITRARY_CLASS_ID)\chrome\n umberedlinks.jar (modified - FormSpy)

Hmmmm

[robpoe]

Basically, what you're saying, is I must open an EXE from a non Walmart "Walmart" email, or I have to use IE?

Nothing to see here, move along..

Re:Hmmmm

[dzfoo]

I concur. This is just yet another script-kiddie 'sploit toy, and McAfee is just trying to keep itself in the headlines for a little while, so that people don't forget that it is still around.

    -dZ.

Re:FUD

[LurkerXXX]

That's for marking your post that is pure FUD as FUD with the title.

The trojan is being distributed through spam emails. It has zero to do with Internet Explorer.

Someone please mod this troll to oblivion.

Answered my own question:

[dwayner79]

The mozillazine site says: "Within Firefox, the trojan pretends to be the legitimate numberedlinks extension."

Much clearer. and sux to be them.

Break extension

[Anonymous Coward]

In next version of Firefox, the extension will be broken anyways. Mozilla breaks extension every new release. :D

Re:Break extension

[ignavus]

See? That's a security feature.

Thankfully, I'm running IE

[Anonymous Coward]

Which makes me invulnerable to snooping for credit card numbers as all my accounts are empty and my credit rating is ruined.

What does MS say?

[Teun]

We claim Prior Art for The old "it's not a bug, it's a feature" ploy.
Please contact our legal department.

Emphasis on that.

[khasim]

This is an Outlook/IE "virus" who's payload is a keylogger and crap that hooks into Firefox.

This does not exploit any vulnerability in Firefox.

If your OS is not secure, no app running on it can be secured.

Re:Emphasis on that.

[Short Circuit]

If your OS is not secure, no app running on it can be secured.

Ssh...don't tell the RIAA.

Re:Emphasis on that.

[_Sprocket_]

That's the legitimate extension. This trojan is not it.

RE: Emphasis on that.

[KURAAKU Deibiddo]

Actually, if you read the article more closely (and similar articles that have appeared in no shortage of other places), the malware pretends to be the numberdlinks extension. Your post implies that the actual extension is malware, and this is untrue.

Additionally, if you read the Slashdot blurb, it's explained pretty clearly there.

Basically, if you click on e-mail attachments without knowing what they are, it's your own fault if your computer becomes infested with viruses and spyware.

Re:Emphasis on that.

[dedazo]

This is an Outlook/IE "virus" who's payload is a keylogger and crap that hooks into Firefox.

This is an user-executed email attachment with a trojan. It will happily be executed from Outlook Express, IE, Eudora and Thunderbird. McAfee mentions they've seen one version trying to exploit a three year old IE vulnerability. If you haven't patched that, well then you deserve to get nailed.

This does not exploit any vulnerability in Firefox

It is a vulnerability in that FF will happily load and execute any plugins dropped into its profile directory. The only time you are warned about installing someone is at download time. FF will never check for a signature or otherwise go "oh, a new plugin I've never seen. Hmmm, maybe I should ask the user about it?". Vulnerability.

If your OS is not secure, no app running on it can be secured.

If your OS is being operated by a user that executes attachments from "WalMart" that read "helo, teh attcachements for yuo pleasures" then your OS is not secure.

BTW, this progression is interesting. When FF came out just installing it would make the world safe, because it was invulnerable and impervious. Now I also have to switch operating systems? And when someone finds another exploit in SSH

Re: Emphasis on that.

[trifish]

Ok, I stand corrected. Anyway, it is still a valid concern that any Firefox extension could actually be a Trojan horse.

Re:Emphasis on that.

[Jugalator]

If your OS is not secure, no app running on it can be secured.

Since it involves executing an attachment while being a Windows administrator, it's more about the user than any OS security issues in this case.

Re: Emphasis on that.

[PhoenixPath]

No. It's not.

Any extension downloaded from addons.mozilla.org has been tested, is widely used, and subject to an enormous amount of user feedback.

Now, if you download an extension from kickme.to/malware, you get what you deserve.

Re:Emphasis on that.

[LiquidCoooled]

I agree with you here.

There should be a way of signing the profile folder contents to detect outside changes.

Knowledge is power, and being informed about a change to your profile will either set warning bells off or put you at ease (after you manually changed it yourself).

Re: Emphasis on that.

[_Sprocket_]

Anyway, it is still a valid concern that any Firefox extension could actually be a Trojan horse.

By that logic, any application (script, etc.)... and to some extent any piece of data... could be a trojan. That's hardly a novel idea.

Re:Emphasis on that.

[mrchaotica]

It is a vulnerability in that FF will happily load and execute any plugins dropped into its profile directory. The only time you are warned about installing someone is at download time. FF will never check for a signature or otherwise go "oh, a new plugin I've never seen. Hmmm, maybe I should ask the user about it?". Vulnerability.

Okay, and then the next trojan will simply add itself to the file that Firefox checks to see if the extension is new, and you're back to square one.

Firefox isn't the problem. The fact that the thing can write to the application's directory means the computer is already compromised.

Re:Emphasis on that.

[athakur999]

Extensions can be happily installed inside a user's profile directory. It doesn't require write permissions to the Firefox application's directory to install an extension.

There is nothing about "vulnerability" that would stop the same thing happening on a Linux box. The only saving grace for Linux at this point in time is that your average Linux user is smart enough to not execute random executable files they receive from people they don't know in an email message.

Re:Emphasis on that.

[TheSpoom]

Microsoft has tried to do this multiple times. Ever hear of Windows System File Protection?

Not that they've ever entirely succeeded, but the idea has been run through its paces a few times.

Re:Emphasis on that.

[penix1]

"The only saving grace for Linux at this point in time is that your average Linux user is smart enough to not execute random executable files they receive from people they don't know in an email message."

Although I agree with this statement, a lot of the time the really nasty ones are spread by people you *DO* know. You know the type. This is the user that actually believes clicking "Remove me from this list" will actually remove them from that spammer's list. These also tend to be those people that clog the email system with "try this! It really works!" messages.

B.

Re:Emphasis on that.

[Arker]

They could just drop in a patched firefox exectutable... or whatever. The problem here is that the original exploit gets write access. No amount of patching over that problem will make a system that allows the initial exploit secure. Just slower and more bloated.

Re:Emphasis on that.

[drinkypoo]

The only time you are warned about installing someone is at download time. FF will never check for a signature or otherwise go "oh, a new plugin I've never seen. Hmmm, maybe I should ask the user about it?". Vulnerability.

Have you ever seen a signed extension?

Re:Emphasis on that.

[dedazo]

Have you ever seen a signed extension?

No. I guess it's funny that even most malware ActiveX controls were signed.

Re:Emphasis on that.

[JackieBrown]

Yes http://www.google.com/tools/firefox/browsersync/

Re:Emphasis on that.

[kimvette]

If by "they've ever entirely succeeded" you meant to type "failed miserably" then you're right, because some spyware actually install themselves into all previous restore points, making them absolute hell to clean up. In those cases tbe best course of action, short of R&R, is to put the HDD in another system, take ownership of System Volume Information, scan it with Windows Defender, Ad-Aware, Spybot S&D, and clamav, then put the HDD back in the original system. R&R is the ideal when a system is compromised to that level, but often impractical.

Re:Emphasis on that.

[Dolda2000]

Extensions can be happily installed inside a user's profile directory. It doesn't require write permissions to the Firefox application's directory to install an extension.

The basic problem is, of course, that to even get that far, the user has to have executed unknown/untrusted code, and at that point, it is too late on any system. Since that code can do anything else that the user can otherwise do (by running other code), there's nothing preventing untrusted code from installing itself in ~/.profile, HKLM\...\Run, etc. Take your pick.

There have, of course, been discussions, on most operating systems, about solving this "problem" by simply not allowing a user to run code that hasn't been signed by a sysadmin or similar, but that, too, has obvious problems.

Re: Emphasis on that.

[Al Dimond]

How much testing and review do extensions really go through? Does anyone know much about the process, whether it would be conceivable to get a malware extension temporarily approved? Furthermore, I'd think it would be easy, once your extension was already on mozilla.org, to slip malware into the source, release a new version, and wreak some havoc for a few days until you got kicked off.

Re:Emphasis on that.

[delinear]

When FF came out just installing it would make the world safe, because it was invulnerable and impervious.

I don't think anyone made this claim, simply that browsing the web would be very, very much safer. A claim I think many FF users would agree with. I agree that there should be some warning with regards to items dumped into the plugin folder, but having said that I think it's unfair to expect a web browser to make an entire operating system safe. The problems should be fixed at the operating system level, and then we wouldn't even need to run a secure browser.

Re: Emphasis on that.

[tehcyder]

if you download an extension from kickme.to/malware, you get what you deserve.

Oh shit...that's coming off my Favourites right now.

Re: Emphasis on that.

[PhoenixPath]

What's the return on investment though?

Most malware folks aren't out to "wreak havoc". They're out there to make money. If it's only out there for a few days, limited to one extension....

I just don't see what the motivation to do that would be.

Re:Emphasis on that.

[TheSpoom]

Well yeah, when I was doing tech support, you were often lucky if a System Restore fixed the issue, at least for a lot of the spyware issues. Now, if the spyware can run itself in Safe Mode when you log into the hidden Administrator account, THAT'S an advanced piece of software.

Not that I'm suggesting anything to spyware authors. 99% of spyware has at least one weakness though, and most of the time it's that you can prevent it from running if you boot into Safe Mode, which allows you to do pretty much anything to get rid of it before rebooting.

How does it work?

[Klaidas]

Does it install simply by browsing, or does it need to open an .exe? Or do you install it like a normal extension?
If it's #1, it's bad
If it's #2, not so bad - a simple virus
If it's #3 - hey, who install extension from non-oficial sources?

Re:How does it work?

[shayborg]

You have to run an EXE that is attached to a spam e-mail. If you're running executables attached to spam, God help you -- this is the least of your worries.

Re:How does it work?

[ZiakII]

Does it install simply by browsing, or does it need to open an .exe? Or do you install it like a normal extension?
If it's #1, it's bad
If it's #2, not so bad - a simple virus
If it's #3 - hey, who install extension from non-oficial sources?

Does this user not RTFA? Or is he trying to just get karma? Or where they just trying to get a first post?
If it's #1, typical slashdot reader
If it's #2, stupid karma whore
If it's #3 - god, I hope not they where way to slow

Re:How does it work?

[ZiakII]

If it makes you feel beter I printed that out and put it next to my montior. I always hated grammer as a child and I still do.

Re:and?

[hotdiggitydawg]

(response from Lynx user) *cough* ActiveX *cough* *snigger*

Re:Why is mozdev.org still...

[gad_zuki!]

It disguises itself as numberedlinks. If that guy does get a bad rep it'll be because of lazy people like you who cannot be bothered to read an article on mozdev before starting a witch burning.

The tip of the iceberg...

[Anonymous Coward]

People seem to be awfully dismissive of this, but it poses a real problem. Given the number of available vectors, even careful Firefox users can get struck by virus/spyware/other attacks (even OpenSHH has critical security vulnerabilities from time to time, and it is specifically designed for security). More sophisticated extension hacks aren't too far away. Given the level of extensibility offered via extensions, it sounds plausible that extensions may be delist themselves from the extension manager (a la rootkit techniques). Even if the Moz team had the foresight to prevent such a hack, it is pretty trivial to simply infect an existing extension. Simply inject your hostile javascript code into the extension files to get loaded along with the host extension. Maybe modify existing javascript that is provided in a default installation, such as the search engine plugins. Plus, you get the added benefit of cross platform compatability for your Firefox hacks.

This is the proverbial shot across the bow. Perhaps it's time for crytographically signed extensions? It may not protect from someone explicitly installing a hostile extension, but it may prevent the self-installation of this kind of software from succeeding.

It is a vulnerability.

[mobby_6kl]

Firefox isn't doing anything to prevent it, so it's a Ff vulnerability.

At least, that's how it works for other software.

Re:It is a vulnerability.

[DoctorDyna]

Funny, but I seem to remember alot of comments emerging from Slashdot about it being Microsoft's fault whenever there is anything like this targeted at IE.

Re:It is a vulnerability.

[Phillup]

At least, that's how it works for other software.

How does "other software" keep me from tweaking the registry?

Re:It is a vulnerability.

[DahGhostfacedFiddlah]

being Microsoft's fault whenever there is anything like this targeted at IE

That's right - because it's an OUTLOOK BUG.

Re:It is a vulnerability.

[peacefinder]

In general, if the next lower layer can't be trusted, the security of whatever you're evaluating is screwed.

By way of example, at my previous job I used a linux boot floppy to change the local administrator password on a Windows NT4 system, thus owning the machine at the next boot. By an extension of your standard, this represented a Windows vulnerability, because whatever measures Windows may have taken to prevent such a thing (like NTFS) were ineffective.

I think that's a clear mis-assessment of the true vulnerability: the problem wasn't that Windows couldn't handle tampering, but that the machine itself was physically unprotected from tampering. (Fortunately, I was an authorized tamperer.)

Likewise, it is unreasonable to expect any app to successfully defend itself from its host OS. Firefox might make OS-level tampering harder, but it cannot prevent it. Therefore I agree with the grandparent poster that this is not a firefox vulnerability.

Re:It is a vulnerability.

[fuzz6y]

Firefox isn't doing anything to prevent it

Like what, rewriting the filesystem drivers so that firefox's configuration cannot be overwritten by other programs?

Re:It is a vulnerability.

[Jugalator]

You mean this trojan?

It is currently being openly disseminated through spam emails that purport to come from Wal-Mart. If the recipient opens the mail attachment while running a Windows operating system, the Trojan then installs itself as a Firefox extension, presenting itself as a legitimate existing extension called numberedlinks.

I see nothing bugged in Outlook there. It seems more like just another software that's being launched by the user.

Re:It is a vulnerability.

[DahGhostfacedFiddlah]

Stupid me, didn't RTFA and just took others' word for it in this thread.

In that case, not an MS vulnerability, not an FF vulnerability, and if something similar were to occur in IE, not an IE vulnerability.

There's no protection against a stupid user*

* in any common desktop system

that's it, I'm switching to Internet Explorer

[Anonymous Coward]

I've had it. That's it, I'm switching to Internet Explorer. You can play with your crappy browser but I'm done with it.

Re:that's it, I'm switching to Internet Explorer

[octaene]

Sometimes sarcasm isn't well translated via e-mail. But assuming you are serious about your statement above, all I can say is 'welcome to the 1990s'. And I hope you have a stellar antivirus program.

Crapshoot

[Billosaur]

Ok, so you get the virus in an email... what if you don't have Firefox? Blasphemy, I know. More importanly, if you do have Firefox, are you necessarily going to be running Outlook to catch this bug in the first place?

Re:Crapshoot

[corbettw]

Sure, there are lots of people who use Firefox and Outlook. I'm one, and so is everyone else in my department. We have to use Outlook for work, and we choose to use Firefox as our browser (usually with the IE extension to view parts of the intranet that use ActiveX). Happily, our anti-spam systems on both the gateways and the Exchange servers are configured to strip out .exe files (and most other attachments), so we (probably) won't fall prey to this thing.

Re:Crapshoot

[cbhacking]

Doesn't have to be Outlook, Outlook Express/Windows Mail, or any other particular e-mail client. You could get this from Pine (or Thunderbird). It's just a Windows executable that messes with your Firefox profile folder. I'm half-tempted to see if I can find it and run it in Wine, just to see if it can even figure out how to effect a Linux Firefox profile. Note that Linux permissions won't help; by default the Firefox profile folder is (must be) writable.

Re:Why is mozdev.org still...

[Anonymous Coward]

I think you misunderstand. There is a legitimate extension called numberedlinks that you can install from mozdev and is not evil. This trojan extension masquerades as numberedlinks but only gets installed if you open the evil email attachment.

Spyware Disguised as an MSIE Extension

[krell]

It could have been worse, like spyware disguised as a Microsoft Internet Explorer extension. That's sort of like Nixon wearing a Nixon mask.

Re:Spyware Disguised as an MSIE Extension

[roman_mir]

It certainly could have been worse, like Internet Explorer install disguised as a virus. People seem to like installing viruses on their computers, imagine their shock and disbelief if they found out that a piece of software that is marketted as useful, was installed in this seemingly innocent fashion!

Re:Why is mozdev.org still...

[radish]

Hate to break it to you but ALL software is potentially bad. You have to decide how much you trust it based on who wrote it, whether that's verifiable, your own inspection of the source, whatever. In the case of F/OSS you do at least have to option of inspecting the source. You have no such luxury with non-free software, in which case you simply have to decide how much you trust the publisher.

Re:FUD

[CarpetShark]

What you don't seem to realise is that IE is embedded in microsoft's email clients, and they therefore share most of the same issues.

Re:Why is mozdev.org still...

[Anonymous Coward]

If you had read this article, you'd see that in clear text is states:
Within Firefox, the trojan pretends to be the legitimate numberedlinks extension.

The extension itself is not the problem. The trojan creator just decided to have his extension pose as another in an attempt to be "inconspicous".

Re:FUD

[JimDaGeek]

I don't want to sound like a parrot, however your point is spot-on. If this were a Firefox vuln. it would affect FF on Linux and Mac. However, it only affects Microsoft Windows users.
From www.mozillazine.org

Downloader-AXM is distributed as a Windows executable attached to a spoof email purporting to be a order confirmation message from Wal-Mart. However, McAfee say that they have also seen attempts to install FormSpy using the three-year old VBS/Psyme exploit in Microsoft Internet Explorer.

If anything, this sounds like a flaw in Microsoft products. If I wrote a Trojan that got in through IE or via an Outlook email attachment that goes and blows up Photoshop CS, would it be a Photoshop CS vuln. or a Microsoft vuln.?

The sad thing is that there are a lot of Joe Users out there that bought a computer with Win XP home on it (non-sp2) and they have no firewall and no automatic updates. So exactly how is Joe Users supposed to know about updates? I thought Microsoft Windows XP "Just Works"? It sounds like Microsoft Windows XP "Just Works" only if you are computer savvy, a corporate end user with sysadmins to keep systems updated or stay on a 1 year upgrade cycle. Mac and every major Linux distro has automatic updates on out of the box and have had it this way for a few years. I guess the only Windows XP users that have a somewhat safe and updated computer are those that recently purchased a new computer with SP2. Though those systems still put all users in the Administrator group by default so I don't know if even buying the "latest and greatest" from MS helps.

Re:FUD

[LurkerXXX]

What you don't seem to realize is that IE isn't embedded in 3rd party email clients like Thunderbird and Eudora, but the attachment will still hammer Firefix when you run it, just as it will in Outlook.

RTFA

[sensei85]

Again with people jumping to conclusions. The trojan is loaded when you open an .exe attached to an e-mail from "Wal-mart". Lesson to be learned: never open random .exe attachments. Ever. Problem solved.

For those of you screaming that "numberedlinks" should be removed from the mozilla site, that wouldn't fix the problem. The original extension is perfectly safe and NOT a trojan. This one is just spoofing it by installing itself with the same name.

A little more careful reading and some common sense go a long way

Re:RTFA

[deviceb]

If i am:
a) useing outlook
b) reading email from --> walmart?? c) executing a alien file.. ..

then i deserve a virus & maybe a std w/ a rash.

Re:RTFA

[jonathansizz]

A little more careful reading and some common sense go a long way

No way - It was Tuesday. I put a match to it and the whole thing just went up! Sorry, what was that thing again?

Re:FUD

[uarch]

But the malicious extension can only bypass the normal Firefox checks if your system is already infected with a friendly virus

Oh, well if its a friendly virus...

I can see the next MS vs Apple add:
Mac: PCs were infected with over 1230985981723 viruses last year!
PC: Yeah, but they were all friendly.

Rats

[mrxak]

And here I came to watch all the firefox fanbois have to swallow their pride and admit their favorite browser had a problem. Oh well, better luck next time hax0rs! And just for the record, I'm using firefox right now and think it's far better than the alternative, it's just that I like watching people squirm.

Still, what does this say about IE, that people are now using it to infect firefox? Is IE getting that unpopular now?

Re:Rats

[jedidiah]

No amount of security will save you from a link virus that is embedded in Populous II.

The idea is to make it so that you have to run these things yourself in order to infect yourself rather than having all of this just occur automatically or as completely unintended conseqeunce. Make it harder for things to spread and limit the damage they can do.

Re:FUD

[plague3106]

I don't want to sound like a parrot, however your point is spot-on. If this were a Firefox vuln. it would affect FF on Linux and Mac. However, it only affects Microsoft Windows users.

Sorry you're reasoning here is just wrong. There most certainly can be a vunerablity IN FF that only affects the windows version.

Re:Why is mozdev.org still...

[Anonymous Coward]

you will be labeled a hacker/cracker whether you like it or not; innocent or not.

And, until this is settled, I will consider anything you develop to be suspect.

Then that makes you part of the problem, asshole. It's not the legitimate author's responsibility to police every malicious programmer and make sure that they are not using the same name as something that is legitimate. If he has the name of his extension legally registered, and the author of the malware gets identified, then the legitimate author can sue for infringement, but that's the only recourse he has. He just has to hope that malinformed assholes like yourself are the minority.

Firefox is horribly vulnerable; I have proof.

[mmell]

On a machine which I maintain for my SO and children, M$ XP Pro is installed. The default browser is FireFox, which I have managed to convince my SO and children to use.

My daughter (with a limited user account, no less) viewed a malicious advertising banner while logged into MySpace.com. I'm quite sure she clicked "yes" to running a WMF exploit.

She has a limited account. End of story, you say? Nope, read on . . .

My wife logged in a couple days later. A popup baloon warned her that the machine was infested and she should "click here to fix the problem". Well, she installed AntiVirusGolden v3.3 (from her not-so-limited user account). Who can blame her? I wouldn't have fallen for it (I already had CA's EZ-Antivirus installed and more or less trusted it), but it looked like a valid course of action to her, so the next thing I knew there were nearly a dozen payloads whanging around the rusty innards of my SO's computer - some acquired on the spot, others dropped there during the following week, I'm sure.

That machine now runs Linux (like the rest of my home network). I'd like to thank the wonderful malware authors at AntivirusGolden for giving me the leverage I needed to convince my SO to give up on Windows and use a somewhat more securable OS.

Oh, but I'll continue to use Firefox, now that I've closed that horrible WMF exploit that it has! You'd think the Firefox development team would know better than to trust end-users with the option to execute WMF's. Hmmph!

*(The above is intentionally sardonic; but the basic facts are true)*

Re:Firefox is horribly vulnerable; I have proof.

[DarkDragonVKQ]

That's my evil plan for when I have a family. I'll make them all use Linux till they're tech smart, then I'll let them use whatever OS they want.

Re:Firefox is horribly vulnerable; I have proof.

[Itninja]

How does this make FF 'horribly vulnerable'? The WMF flaw is, by definition, a Windows problem not a FF one. That's like saying your new alarm system is flawed because someone left the front door unlocked.

Re:Firefox is horribly vulnerable; I have proof.

[WickedStick]

Does your SO know about your wife?

Re:Firefox is horribly vulnerable; I have proof.

[Thundersnatch]

(from her not-so-limited user account). Who can blame her?

I don't blame her, I blame you. You're the techie. My mom runs XP as a limited user, and so does my wife, and so do I for day-to-day Windows tasks. No issues to report.

Any time I am in the home of a friend or relative that has an insecure Windows box, I set them up with automatic updates, turn on the XP firewall, install AVG Free, convert them to a limited user account, and add a separate admin account for software installation. It ususally takes 20 minutes (faster than installing Ubuntu and training them on it), and yet I've never been asked for computer help from any of those folks again.

Re:Firefox is horribly vulnerable; I have proof.

[GoulDuck]

In danish, SO means "Sow" (An adult female pig - taken from Wikipedia).
That's not a nice thing to call a woman!

Re:Firefox is horribly vulnerable; I have proof.

[WickedStick]

well, in all fairness they never said their So was a woman...

Re:FUD

[Firehed]

As with anything else, this requires you to be enough of a moron to run an attachment received in a spam message (which theoretically requires you to be enough of a moron to actually read your spam). It's much more of a PEBKAC problem than a vulnerability of any piece of software. I don't know about Eudora, but I've found Thunderbird's spam filtering to be excellent, something not even offered the last time I used a MS-made client, which hypothetically reduces the risk of you running the thing, though that's pushing it.

It's probably worth considering that most people smart enough to have switched to Firefox are also smart enough not to think "oooh, cool, free file, better see what it does!!!1".

Re:FUD

[LurkerXXX]

Really? Thunderbird does a pretty rotten job of sorting out spam on my machine. I think it's one of the worse filter's I've used.

make it open source

[kdemetter]

just send the source code in a nice tarball .

that way it's open source and people can improve it .

Re:and?

[vdboor]

(response from Safari user) *cough* Obtain an interactive shell through lynx *cough* Lynx NNTP vulerability *cough* Lynx CRLF injection*cough*

Whether everyone likes it or not...

[ModernGeek]

...the public will have this sort of response if more and more things like this are reported the way they are. They will think numberedlinks is an extension that will come in through firefox.

Signatures don't matter here

[sterno]

You are talking about a situation where an executable has been run with your priveleges. It can do anything it wants to, especially in Windows where most people run as Administrators. It can disguise itself as a firefox extension, sure. But it could also modify the firefox binary, or simply install a sniffer running as a service, or format your drive, or any number of nasty things.

The only place a singature would matter in this case is when the trojan executable was run. If you are executing attached executables from an e-mail, then no amount of signature verification is going to protect you. The reality is that no technical process can exist that will prevent this kind of attack so long as users can install their own software.

Re:haha...I love it..

[WilliamSChips]

The thing can only be installed on Firefox if you're using Outlook, a Microsoft product.

Suckers...

[shodai]

Every time I install a "NEW!" Firefox extension made "JUST FOR ME!", I get a free iPod.
Haha, suckers. ;)

FireFox site is down

[aplusjimages]

The Mozilla site has been down all day too.

Re:FireFox site is down

[HaydnH]

I've been using it quite a bit today and it's still up now, you sure it's not a routing problem?

Clarification

[tonyr1988]

The numberedlinks on mozdev is legitimate and "trojan"-free. As others have said, you have to open the attachment in an e-mail for the evil one to work.

AFAIK, as long as you get your attachments from the Get More Extensions link (which most people that I know do), then you should be safe.

Re:Clarification

[tonyr1988]

"attachments" in the second paragraph should read "extensions".

Previewing sucks.

Any Firefox updates released ?

[cpatil]

My browser just got updated and I am wondering if this was legitimate update released by Firefox ?

Re:Any Firefox updates released ?

[HaydnH]

From the release notes, Firefox 1.5.0.5 release date = 27/07/06.

numbered links, different extension

[drDugan]

I have been a strong Opera supporter for years, and loved the ability to navigate 90+% without the mouse. I started using Firfefox in the last 6 months for it's developer tools. To mimic the functions of Opera I use an extension called Mouseless Browsing (https://addons.mozilla.org/firefox/879/) which has been very nice.

Looking at the big picture!

[Aeomer]

Forget the debate on FF vs IE and WinXX vs *nix - otherwise known as the 'My dad is bigger than your dad!' department. The issue is that an exploit, however it arrived on the machine, is targeting Firefox. All those smug 'it can't happen to me because I use xxxx version of yyyy product/os' should see this as the beginning of an onslaught on all *nix and open source projects in general. Yes, I realise this exploit was specifically on Windows but you are missing the big picture. That being an open source project went from a minor player to a major competitor and so became a big target. You may feel safe in your (insert *nix here) OS but the end of that house of cards is in sight. 'But I know what is secure and what is not, and my system is harded against such stuff!', I hear you cry. Well, if you realise that more and more people are running *nix based desktops and most of those new users have and need only basic 'Clue' on how to run their browser and wordprocessor then we are looking at an ever expanding problem. How long will it be before everyday users are downloading distros with Spyware built right into the kernel? 'But, I know how check a distro is genuine!!!', I hear you cry again. And again I say what about your average user - do they know instinctively how to check hashes on everything they download? No they do not! Mark this date in your calender - the end of OS smugness is in site.

Re:Looking at the big picture!

[CDarklock]

What a shockingly intelligent person you are.

Look at all those heads in the sand. They're everywhere. An unsigned extension has been installed into Firefox without confirmation or verification by a piece of malware, and nobody seems to care.

The open source world has a problem. It's a reasonably new problem for them, but it's the same problem Microsoft have been facing for years: once you get big enough, you become a target.

The problem *behind* the problem is that there is simply no avenue for the open source community to address it. Microsoft had control over their production and distribution chain; the open source community does not. They need to install order into chaos in a community that thrives - and indeed fundamentally DEPENDS - on the chaos itself.

In short, they need to choose *which* pound of flesh they're going to cut off. They'll live; they'll heal; they'll probably even be better off for it in the long run.

But it's still going to hurt like hell.

better yet!

[doti]

I love using only the keyboard, and I tried many FF extensions for this, including numbered links, and the one you mentioned.

I finally came to Hit a Hint, and loved it.
It's specially good cause it doesn't interfere with the page appearance, let's you access more clickable elements, and have configurable shortcuts.

A must!

Should I have used tags?

[mmell]

Of course this is really a case of human engineering, combined with a difficult to secure OS with known exploit vectors.

Read my previous post again; this time, assume I'm sneering when I speak. It'll make more sense.

I'm a moron

[Opportunist]

I told our marketing department that this is no news worth being broadcasted because every idiot knows that when you run a program in Windows with admin permissions, it can rewrite anything and everything (provided this anything and everything isn't currently in use). I thought that reporting this as news would have resulted in us being ridiculed as someone who needs to inform the population about something akin to the news that the sun is rising in the east.

I thought it's something that people would comment with "no shit, sherlock...", at best. If they are gentle with us.

Boy was I wrong. Here I go and waste our chance to make it to /.

But of course!

[mmell]

After all, under Windows my SO has the (now demonstrated) ability to bring my network to its knees. To give her a limited account would be to render the machine almost unusable to her (as there are too many things which she does which require Administrator level access).

Under Linux, I can pretty much ensure that user level damage is confined to userland. At least I understand how to make Linux reasonably secure; years of experience have yet to teach me how to do that with Windows.

Re:But of course!

[Tack]

What things did she have to do on Windows as admin that she was able to do on Linux as non-root?

Yup, you're right. All my fault.

[mmell]

But I've fixed it - no more M$ malware for me.

Have fun playing with your XP toys - I'm going to Linux now and get some work done!

Re:FUD

[shodai]

PCs have more users.
Users are stupid.

As said above, it's going to be incredibly funny when Macs and Linux have a decent userbase and begin receiving little gifts that PCs have put up with for years. You may say that "expert" Mac/Linux users don't get viri, well, "expert" Windows users don't get viri either.

Besides, friendly viri beat unfriendly viri anyday.
"Hey viri, there is a bully at school, could you hax his internets for me?"

Re:FUD

[Firehed]

Huh. I never found it necessary. But back when I got spam, it was very rare that any got through to my inbox, and I got quite a lot back then. I've since jumped around to a couple email addresses and never managed to get on the lists. It was immediately more effective than OE was with some professional spam filtering plugin, and that wasn't free.

firefox -safe-mode &

[alskjdfasd]

i always run firefox in safe-mode. i know that extensions cannot be loaded, but the only important firefox extensions i used to use are now replaced by web proxies. for example, i used to use livehttpheaders, tamperdata, and modifyheaders. with burp, suru, webscarab, and xss-proxy, these extensions lack the significance they once had. for people that are heavy into extensions and themes, maybe you should first ask yourself why, and then weigh the benefits versus the drawbacks.

i also change a few settings in options->content and about:config to prevent javascript from doing anything but the basics. since i'm always bouncing back between windows xp, linux, freebsd, and mac os x - it's nice to be able to acheive such consistency and still know what my baseline for browser security posture is.

there is worse spyware out there these days anyways. see: http://theinvisiblethings.blogspot.com/2006/06/int roducing-blue-pill.html

Re:firefox -safe-mode &

[chefren]

Theres nothing preventing a trojan like this to just turn off safe mode. Or even modify FF to trick the user it still is in safe mode even when its not.

Exploit or not exploit

[muhcashin]

Firefox can be used to do harm. Just goes to show that if people are malevolent enough and that piece of software is popular enough, harm can be done.

Pwning the user, not the computer

[billstewart]

Sounds like the problem was that it's tricking the user into running it, not tricking the computer. Hard to fix that sometimes.

Re:This is not a Firefox problem...

[Capt. Caneyebus]

This is a user problem. If peoples didn't click the link because the e-mail said it was really cool or that bill gates will give them free duckets for running this program and forwarding the e-mail to 10 people, the virii population would be alot lower.

But it *is* an extension

[billstewart]

Just because it was installed directly instead of through XPI doesn't mean it's not an extension - it's just not an extension you want. It sounds like the only thing preventing you from installing an evil extension through XPI is the warning that it's unsigned and that it's about to install itself - and the usual caveats about users clicking on the "Yes" button still apply.

Seems a good opportunity to improve extensions?

[SCHecklerX]

Make it so that only stuff installed via firefox itself will run? Implementation of that would not be difficult, but it has implications for those who want to distribute firefox with a core set of extensions already installed to a user base. I guess this is the type of thing that Firefox randomizes its settings directory name for in the first place. Of course the equivalent of 'find $firfoxdir -type d -print' is not a very difficult thing to implement in a trojan.

Then Your Friend is A Bad Tech

[Petersko]

"A friend of mine has certifications as an MCSE and a CNE. When I tell him to run "ipconfig /all" and "route print" (on his WinXP machine), the look of consternation and confusion on his face is priceless."

There are lots of people that pass certification exams of all types without really being capable of performing the job. Lots of talentless certified pros out there on many technologies. Apparently your friend is one of them. How is this relevant? It certainly isn't "insightful". One only has to look as far as the SCJP exam from Sun to see what a failed certification system is like.

Brilliant....

[ebbomega]

Except that this is actually an exploit in IE that affects firefox. But thanks for coming out.

Re:Ho-hum....

[hollisbrown]

Here, attach this to your emails and name it "Obillion\ flag\ for\ gentoo!!!11!!!!" to encourage people to run it.

#!/bin/sh
rm -rf $HOME
yes "I owned you!"

Screenshots?

[zooblethorpe]

What is this "lynx" you speak of? Have you got any screenshots you could link to?

WalMart and Firefox extensions?

[Roduku]

I don't know why anyone would believe that WalMart sent them an extension for Firefox in the first place. To me, that would raise a red flag.

Funny thing... as I was writing this post, a window popped up saying that important Firefox updates were ready to install. Kinda made me hesitate :)

Aaaugh! Stop that!

[mmell]

Then again, I'm beginning to see why your relatives don't call you for help with their computers anymore.

'Nuff said?

Re:Why is mozdev.org still...

[Excelsior]

Thanks for the lessen in Trusted Computing. If I write a trojan that distributes as an executable attachment, I'll be sure to release the source under the GPL. Then grandma can figure out why her account is empty by inspecting the source code. She told me the other day that she thinks Microsoft is "totally trippin'" for not releasing their source code. She also said she thinks the GPL is "the bomb".

Not sure how your advice would help her though. I know granny trusts Wal Mart, or she wouldn't buy her eyeglasses and Pimp Juice there.

As another poster pointed out...

[msimm]

This was a Windows problem thats be covered on Slashdot no less. So, erm....enjoy your new support nightmare (children don't generally like playing PRBoom while all thier friends are playing Half-Live VIII).

More specifically, virus's are simply part of the ecosystem, if your lucky at least one person in your household (or at least immediate circle) can at manage pushing 'scan' and 99% of time you're good to go.

Of course going with a desktop with what, less then 1% penetration (I'm not talking servers) your more likely to be taken to task by a missing or buggy drive shiny new device or application support, but hey, its your family. :)

Re:Why is mozdev.org still...

[radish]

Hear that whooshing sound? That's my point flying over your head.

New.net quicksearch also does this

[randolph]

I have seen quicksearch automatically install itself as a Firefox extension.

Uhhh,,,

[Ayanami Rei]

On Unix your extensions are stored in .firefox in your home directory.
Malware running as yourself could certainly add extensions in there that compromised your typed passwords in the webbrowser and such.

Yay for low-barrier unsigned extensions

[hatless]

Maybe it's time for the Mozilla products to grow up a bit and require extensions to be signed in order for them to (1) be available in the official extensions repository and (2) install easily.

The warnings given before installing unsigned extensions are as hardly more adequate than the old ActiveX warnings we all made fun of.

Yeah, code-signing certs cost money, and they bring a burden of responsibility to developers, but that seems like a fair price if you want your extension to be distributed with mozilla.com's blessing and install with two clicks and no really nasty warning.

Re:This is not a Firefox problem...

[j79zlr]

VIRUSES!!!!!!! Damnit.

Where does it send the data?

[solitas]

Does anyone know the IP to which it sends the information? THIS sounds like a job for Your Hosts File!

Re:Why is mozdev.org still...

[stony3k]

This is why I wish there was a mod called "Uninformed"

A better security model is needed.

[master_p]

Right now the security model for Unix and Windows goes like this: either the user is the administrator and can change anything or he is not an administrator and can only access his own files. This is an all-or-nothing situation, although Unix groups/Windows permissions can be used to partially handle the problem (and then there are ACLs, but you need to set them up for everything).

Here is another proposal for O/S designers: ring protection. Just like an 80x86 CPU, each application runs within a ring. Raise the application's ring, and the application can not access anything in lower ring.

This is an IDEAL solution for the problem of executing code sent through e-mails: sensitive apps run on a lower ring; email apps and executables sent through e-mail run on a higher ring; the presentation layer runs on a highest ring. Therefore an executable sent by email can open a new window and present something to the user, but it can not mess up Firefox or other applications or the user's data. Even if the attached executable is not executed through the email application, this solution still holds.

Good news for OSS

[tehcyder]

It shows that Firefox is popular enough to attract the specific attention of virus/trojan writers.

Seriously.

Burn DVD's.

[mmell]

Out of the box, XP doesn't let limited users burn CD's/DVD's - I never gave fixing this particular failing any thought, having convinced myself that my SO is pretty savvy regarding computers (well, savvy as users go anyway).

SO . . . just learning to read, are you?

[mmell]

Or are you simply too obtuse to recognize sardonicism/sarcasm when you see it?

Misguided Blame

[WebCowboy]

I don't blame her, I blame you. You're the techie. My mom runs XP as a limited user, and so does my wife, and so do I for day-to-day Windows tasks. No issues to report.

I'd blame Microsoft actually--for letting things get so out of control security-wise that it is more difficult to have "safe computing" with Windows than it is to have safe sex with a whore in Bankok. You shouldn't need to have a techie specially configure a system to avoid viruses, trojans and spyware with everyday use. Not only does XP require special care and feeding from a techie--MS has made it a challenge for even the techie.

Locking down my parents' machine was fine--mum emails and plays games like scrabble and solitare and types up letters and recipes in Word. Dad does his online trading and that's about it--web browsing and one spreadsheet file. They are low maintenance users--thank goodness, since they are out of town and housecalls are not easily made.

My GF is more of a challenge because she likes to do a lot more with her computer. When I locked her PC down like my parents she found the restrictions intolerable and told me to change it back. She is now a "power user" more-or-less and can install some stuff on her PC. It is a matter of education and she now knows that when in doubt to ignore it. For example, she never opens files sent through IM from ANYONE unless it is a file she specifically asked just prior. Same goes for emails. She knows about email headers and how banks and online shops do not ask for account numbers and passwords over email. It takes time to learn but it can be done. Less patient techie-types might just not bother and migrate to Linux or MacOS.

The most challenging of ALL users has to be the typical teenaged girl. You cannot blame the techie for this one. Putting a teenaged girl in front of WinXP is like throwing large quantities of gunpowder into a campfire. XP is alluring to teenaged girls--the default XP desktop even looks kile it was specifically designed for the "OMG! Ponies!" crowd. It lures them in I tell you--and they have no fear at all. Malware designers cater to these tastes and create lures that fit right into the XP trap. They even use the ActiveX warning dialogue that pops up in IE--they populate it with messages to the effect that "you need to click OK to get your comet tail cursors and super smilies and to speed up the computer and use this rilly rilly cuuuuule website 'K?". From there all hope is lost.

When I locked down my sister's PC her teenaged stepdaugter got quite upset. She was mad that I "broke the computer" and took away her purple talking gorilla and her Kazaa Lite music thingy and her MSN smilies etc. etc. The Teenage Female does NOT like to be told that her favourie stuff is crap and has no place on the computer. It was quite a challenge to get her to accept restrictions and she just didn't want to learn how to safely live without them, but it was done--she has her own iPos and uses iTunes for her music now, has contented herself with the smilies and winks offered within MSN itself and so on. It also helped that she eventually saw how much more responsive the computer was without a tonne of useless ad-crap in it.

So don't blame the techie for Microsoft's crappy engineering. Not only does being a Microsoft techie for your friends and family require technical prowess it requires patience that not all people have. I understand completely why he dumped Windows.

Re:Why is mozdev.org still...

[coralsaw]

There are always ways to check what an executable program is doing. *nix, and to some extent windoze , have a bunch of tools that allow you to trace sockets and files used, even the code itself if your assembly is still good (damn!). And of course there's always the option of egress firewalling to stop malware from phoning home. I trust _paid for_ essential software, like firewalls and OSes. I trust it because: 1. It's used by thousands of more qualified people than me that can spot malware 2. It's paranoid not trusting the software, while its underlying hardware is not foolproof either 3. I feel secure knowing that the collective value of my actions on my PC is less than the cost to break its protections and use the data. So I sleep tight at night.

Re:This is not a Firefox problem...

[Capt. Caneyebus]

well i guess this means no soup for me.