Hijacking Firefox Via Insecure Add-Ons

An anonymous reader writes "Many makers of extensions or add-ons for Firefox are introducing ways for bad guys to hijack the Web browser, new research suggests. A great many add-ons are updated over insecure (non https://) connections, providing an avenue for attackers to replace the extension with an evil update. Google's add-ons are particularly vulnerable, because they update automatically without notifying the user. From the story: '[I]f an attacker were to hijack a public Wi-Fi hot spot at a coffeehouse or bookstore — a fairly trivial attack given the myriad free, point-and-click hacking tools available today — he could also intercept this update process and replace a Firefox add-on with a malicious one.'" Here is security researcher Chris Soghoian's description of the vulnerability and a video of a simulated takeover.

Comments

fud?

[TinBromide]

They mention the google plugin. Doesn't google offer almost all of its firefox offerings as IE search bars, desktop agents, and stuff like that. So why is the update structure for firefox different than, say, google search bar on IE?

Re:fud?

[mhall119]

Any developer can create their own SSL Certificates for free. It's getting a certificate that's been signed by a vendor already in Firefox's whitelist that they are paying for. I would rather each developer create their own self-signed certificate, then I get to decide who to trust, not Verisign.

But using HTTPS wouldn't solve this problem either, because Verisign will sell a certificate to anyone with money. What should be happening is that developers sign their packages like they do for DEB and RPM package distros. That way you always know that you're getting your updates from the same person, no matter what your internet connection.

Firefox extensions are insecure

[140Mandak262Jamuna]

Right from day one I realized that the extensions provided by Firefox could become an security issue. I use very few of them. Scriptblock, Adblock and almost nothing else. And I disable auto updates. But on the other hand, Firefox is not so closely tied to the OS that they could take this breach, elevate privileges and take over a system, like ActiveX vulnerabilities.

Yes, one should be careful about the extensions, and use them carefully. And one should be careful about using WiFi in coffee shops and hotels. I am far more worried about our salesmen plugging in their lap top in some hotel network in Bangkok, pick up an infection and coming to corporate HQ and plug that laptop in our intranet, behind the firewall, in the trusted network. I have asked my sysadmin to set up a separate network for laptops that might be used outside our intranet that is not part of the trusted intra net.

Welcome to the wonderful world of Bloatware

[BlackCobra43]

You laughed at IE for being full of stuff nobody uses.

You derided Opera's minuscule userbase.

You vied for the top dog spot.


Well, now you're on your way to getting there. You're gaining markt share. With growing market share come the demands of progressively dumber users - it's just the nature of the technology market. FF's code needs a good clean-up.