Slashdot Mirror
Hijacking Firefox Via Insecure Add-Ons
An anonymous reader writes "Many makers of extensions or add-ons for Firefox are introducing ways for bad guys to hijack the Web browser, new research suggests. A great many add-ons are updated over insecure (non https://) connections, providing an avenue for attackers to replace the extension with an evil update. Google's add-ons are particularly vulnerable, because they update automatically without notifying the user. From the story: '[I]f an attacker were to hijack a public Wi-Fi hot spot at a coffeehouse or bookstore — a fairly trivial attack given the myriad free, point-and-click hacking tools available today — he could also intercept this update process and replace a Firefox add-on with a malicious one.'" Here is security researcher Chris Soghoian's description of the vulnerability and a video of a simulated takeover.
They mention the google plugin. Doesn't google offer almost all of its firefox offerings as IE search bars, desktop agents, and stuff like that. So why is the update structure for firefox different than, say, google search bar on IE?
Is it sad that I am more likely to recognize you and your posts by your sig than your name or UID?
Slashdot Burying Stories About Slashdot Media Owned
How about setting your updates (yes, even for add-ons) to NOT download automatically? That way you can at least control when they download...
This is not about updates to Firefox - it's about updates for user-supplied add-ons.
c++;
The vast majority of the open source/hobbyist made Firefox extensions - those that are hosted at https://addons.mozilla.org/ - are not vulnerable to this attack. Users of popular Firefox extensions such as NoScript, Greasemonkey, and AdBlock Plus have nothing to worry about.
Since it's not mentioned in the summary, it's important to reiterate that this takes advantage of non-secure update mechanisms used by some addons. The addons.mozilla.org site will only host extensions that update from addons.mozilla.org through the built-in mechanism, which is not vulnerable to this attack. This is an extension-specific issue, and would most likely apply to any sort of addon for any software that doesn't verify security certificates.
My server
So ok, it is possible to do such an attack, but... is it viable enough as an attack vector? I mean, the attacker would have to sit 24/7 near an unsecure hotspot and/or an unsecure network to wait for a potential victim, and, as we know, firefox users aren't the majority, so this further narrows down the possibility of a successful attack. That's enough to call it improbable i think. Of course, since such an attack is possible, that can mean something, but, please, would anyone sit around coffee shops all day just to infect one person with spyware, when he could just, I dunno, send viruses or trojans through mail to computer illiterate people?
"We are the music makers, and we are the dreamers of dreams [...]."
Yes, one should be careful about the extensions, and use them carefully. And one should be careful about using WiFi in coffee shops and hotels. I am far more worried about our salesmen plugging in their lap top in some hotel network in Bangkok, pick up an infection and coming to corporate HQ and plug that laptop in our intranet, behind the firewall, in the trusted network. I have asked my sysadmin to set up a separate network for laptops that might be used outside our intranet that is not part of the trusted intra net.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
How to sign a Firefox Extension by Frederic Mercille.
It's not hard (for anyone who can make an add-on).
How we know is more important than what we know.
You laughed at IE for being full of stuff nobody uses.
You derided Opera's minuscule userbase.
You vied for the top dog spot.
Well, now you're on your way to getting there. You're gaining markt share. With growing market share come the demands of progressively dumber users - it's just the nature of the technology market. FF's code needs a good clean-up.
I never spellcheck and I freely admit it. Save your karma for more worthwhile "lol erorrs" replies
That means that this attack only works if the local area network is hijacked! Which reduces its danger substantially for the population at large as the huge majority of home connections is on its own link.
It is only a problem in the situation above (that are atypical nowadays) and in work or other large-network settings where it is possible to connect an untrusted computer to the network.
IT ALSO MEANS IT IS NOT FIREFOX SPECIFIC, as hijacking a connection can lead to many unpleasant things that may be as dangerous as that without requiring Firefox (ie grabbing passwords!).
OK, so it's about the "extensions provided by Firefox"? No, it's explicitly about extensions not provided by firefox but strapped on by some mechanism devised by the extension's developer, be it Google, Yahoo, whomever.
Extensions provided by Firefox are downloaded via a secure connection - it's your Google-toolbar that comes unprotected.
So, if you don't have a clue, read the article. If you still have any doubt that you fully understand it, don't comment on it.
Well, maybe someone exploited the security hole mentioned in this article to add a "goatse extension" to some Firefox installations, which automatically sends a goatse comment to each visited Slashdot story. :-)
The Tao of math: The numbers you can count are not the real numbers.