Slashdot Mirror
Hijacking Firefox Via Insecure Add-Ons
An anonymous reader writes "Many makers of extensions or add-ons for Firefox are introducing ways for bad guys to hijack the Web browser, new research suggests. A great many add-ons are updated over insecure (non https://) connections, providing an avenue for attackers to replace the extension with an evil update. Google's add-ons are particularly vulnerable, because they update automatically without notifying the user. From the story: '[I]f an attacker were to hijack a public Wi-Fi hot spot at a coffeehouse or bookstore — a fairly trivial attack given the myriad free, point-and-click hacking tools available today — he could also intercept this update process and replace a Firefox add-on with a malicious one.'" Here is security researcher Chris Soghoian's description of the vulnerability and a video of a simulated takeover.
You mean like the Google Toolbar for IE and about a bazillion other ActiveX applets?
This problem is not Firefox-specific.
However, it's important to note that Firefox does not allow updates from untrusted sources by default. It comes configured with updates allowed only from addons.mozilla.org and updates.mozilla.org.
Furthermore, for those of you with notebooks/WiFi -- for God's sake, turn off Automatically check for Updates to: Firefox, Installed Add-Ons and Search Engines from the 'Updates' tab in the 'Advanced' options, especially if you're going to be spending time in a coffee bar. And before you say: "Well, that's in the Advanced section and we shouldn't expect normal people to have to edit those options" I say horsepuckey. If you're bright enough to be using Firefox instead of IE, you should be bright enough to know how to configure it in a secure manner.
My blog
The vast majority of the open source/hobbyist made Firefox extensions - those that are hosted at https://addons.mozilla.org/ - are not vulnerable to this attack. Users of popular Firefox extensions such as NoScript, Greasemonkey, and AdBlock Plus have nothing to worry about.
Since it's not mentioned in the summary, it's important to reiterate that this takes advantage of non-secure update mechanisms used by some addons. The addons.mozilla.org site will only host extensions that update from addons.mozilla.org through the built-in mechanism, which is not vulnerable to this attack. This is an extension-specific issue, and would most likely apply to any sort of addon for any software that doesn't verify security certificates.
My server
How to sign a Firefox Extension by Frederic Mercille.
It's not hard (for anyone who can make an add-on).
How we know is more important than what we know.
Unfortunately, doing that would sort of imply Mozilla would need to vouch for the extension developers (hey, they're letting them use a cert; that's what it's for, right?). As it is they barely have enough people to just try installing extensions before approving for the main site...
If it's just extension updates anyway, and extensions already act as a part of Firefox (i.e. they're not sandboxed... which they can't be in the current architecture)... They might as well just require SSL for updates, and people who don't use the Mozilla update service can just ship their own (self-signed) cert with the extension. Of course, some authors will still work around that by doing their own thing anyway. (There were, at one point, very, very insecure extensions that... load the whole toolbar at runtime using eval() by pulling data from unsecured sites.)