Slashdot Mirror
Microsoft Update Quietly Installs Firefox Extension
hemantm writes "A routine security update for a Microsoft Windows component installed on tens of millions of computers has quietly installed an extra add-on for an untold number of users surfing the Web with Mozilla's Firefox Web browser."
What, you think you know better than MICROSOFT what should be on your machine?
The new extension allows Firefox to experience the same rich vulnerabilities that IE users have come to expect!
this is old news.. That extension was "added" at least a year ago i think..
Microsoft .NET Framework Assistant 1.0 .NET framework versions to the web server.
Adds ClickOnce support and the ability to report installed
I do not like the sound of that nor does Annoyances.org as the article notes. I don't like the idea of sending anything about software on my computer to a web server without me knowing about it. I really don't like the sound of ClickOnce either! Isn't this the mentality that has gotten IE users in trouble time and time again?!
.NET framework ... as long as we're not heading back to blurring the line between what the browser should have access to (certain user space files) and what the browser inadvertently has access to (.NET libraries right in the kernel).
I don't have a problem with the
My work here is dung.
Tools > Add-Ons > Plugins > Disable all Microsoft plugins.. and Adobe Acrobat's, QuickTimes & anythiing else that looks suspicious
Several companies have pulled this stunt where they stealh in an addon and disable the uninstall button. Firefox makes this too easy and needs to change how it handles addons which are not installed expressly via the user.
If this was part of a "routine security update" then it's getting easier to understand why there are so many unpatched Windows machines out there. Things like this may seem minor but they really erode the trust that must be present in order to allow a vendor to automatically push system updates. It always did amaze me that whenever major worms come out and infect millions of PCs, they do it using vulnerabilities that have already been patched some time ago. I'm wondering how much this lack of trustworthiness has to do with it.
It is a miracle that curiosity survives formal education. - Einstein
Man, this is so unfair to us Ubuntu users
.xpi
Someone please send me the
Ah, finally found the link. Sadly enough, Slashdot's search engine didn't find it but Google's did.
http://tech.slashdot.org/article.pl?sid=09/02/01/2143218
(would have posted sooner, but have to wait 5 minutes between posts)
See my journal for slashdot ID's by year. Mine created in 2005. http://slashdot.org/journal/289875/slashdot-ids-by-year
at the same time it was Firefox that quietly allowed it to happen. "I admit that maybe I missed the point", he said as he rushed home to check his Windows machine.
http://www.annoyances.org/exec/show/article08-600
Note that Oracle (nee Sun) is also doing this with a Java extension.
Rich And Stupid is not so bad as Working For Rich And Stupid.
http://blogs.msdn.com/brada/archive/2009/02/27/uninstalling-the-clickonce-support-for-firefox.aspx
I noticed this on a work machine and read about it last week. Instead of trying to manually remove the extension (the Uninstall button is disabled for this one and only extension) I simply disabled it. Starting that same day, the machine (2.3 Ghz dual core Vista with 4 GB RAM) has begun locking up hard when using Firefox. This doesn't happen with IE or any other software. It locked up 5 times on me with Firefox within 1 hour, and has not locked up at all since then, as I have not used Firefox. It is abundantly clear the problem is related to Firefox, and the only thing I did with Firefox was disable the extension and restart.
Has anyone else experienced anything like this after disabling the .NET extension? I'm curious how deeply this extension hooks into the OS and if it is capable of freezing up the entire OS. Firefox, on its own, should not be capable of locking up the entire machine.
Better known as 318230.
Would everyone who voted this old news to the front page kindly line up...thank you.
*SLAP*
*SLAP*
*SLAP*
*SLAP*
(etc...)
Now, don't do it again!
ClickOnce makes it possible to install applications over the web (WoWAceUpdater was an example of this) at the user's demand, it will not automagically download .NET-capable trojans to send back personal information. If you're truly paranoid and wish to disable it, the instructions are pretty simple and can be found by googling.
On that note, Java's JRE does the exact same thing (adds a firefox extension without the using knowing about it, and reports back version).
Adds ClickOnce support and the ability to report installed .NET framework versions to the web server.
I do not like the sound of that nor does Annoyances.org as the article notes. I don't like the idea of sending anything about software on my computer to a web server without me knowing about it.
But do you know what your browser is already sending? Mine is sending this:
"Windows NT 5.1" is Windows XP, and "Gecko" is the HTML/CSS engine used by Firefox, Iceweasel, SeaMonkey, Fennec, etc. Sites can query the versions of various addons that handle an object type, such as Java SE and Flash Player, by embedding such an object. What's so different between querying the .NET Framework version through this add-on and doing so through the Silverlight addon?
Not exactly..
You have to explicitly acquire the JRE and install it, and the first version you install includes the firefox extension, subsequent updates may update functionality you already installed.
It's not like the JRE shipped by default with the OS, and the original version didn't include the firefox extension while subsequent updates bring this new functionality.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
I sure hope they come up with a way to run ActiveX in Firefox, I want seamless integration of my botnet...
Brett
In my system I also have the "Java Quick Starter" (from Sun), and I already removed the Skype add-on.
As a Firefox extension developer, I've received several complaints about disappearing toolbar buttons, and the answer is always the same: check for the Skype extension that was installed without your consent, and uninstall it. Plus, navigating the browser history was a lot slower, and removing that add-on solved the problem (the Skype extension will scan the page contents to substitute phone numbers by Skype actions).
This is not limited to Firefox, as this stuff has been happening in Internet Explorer for a long, long time. Still, it would be nice if Firefox would protect its users from non-authorized extensions, warning of what was installed, and providing a easy way to uninstall/disable it.
Speed Dial for Firefox
Sadly enough, Slashdot's search engine didn't find it but Google's did.
Hey, be fair. Slashdot has only had a search feature for about 10 years - it takes time to make these things useful.
And their development team (Sid) has been feverishly at work all those years in order to bring us world-beating innovations the giant green "Reply to This" and "Parent" buttons (we has such a hard time finding those links before the advent of those buttons) and features to break certain browsers. Add to that the Herculean efforts to change the wait between AC posts (the "Slow Down, Cowboy" feature) from 2 minutes to an amount of time generated by a random number generator and added to 2 hours while telling us things like "it has only been 96 days and 14 minutes since you your last post - you must wait at least 2 minutes before posting" and you can see that Sid (who does this in his spare time between grade-school classes) has had a pretty full plate.
Oh, and Sid has discovered girls, so his mind is elsewhere these days (he has to adapt - he never had exposure to girls while working for Slashdot).
So, a little less of the bitching, if you please.
This allows an extension to be installed:
- Without notification
- Without the option to "uninstall"
- (apparently, from the article) With the ability to install more things to your PC (which I thought Extensions were forbidden to do, and only Plugins [eg: Flash] could do)
This is clearly a bug in Firefox, and a fix should be released immediately.
I'd think that firstly Firefox should default to considering the extension "unauthorized" and put up a big scary warning like "Unauthorized extension detected: An external program has installed an extension in a manner which bypasses Firefox's normal security features. It is recommended that you click "uninstall" below, unless you are absolutely sure you know what you are doing"
But there's no framework in Firefox (that I am aware of) for such an authorized/unauthorized check to be established. (It would mean defaulting everything except this Microsoft extension to "trusted")
Sounds like a move by Microsoft to say "see! Open source isn't safe! Look what we could do!" once Firefox releases a fix that says "Warning: Unauthorized extension signed by 'Microsoft Corp' detected!"
-- 'The' Lord and Master Bitman On High, Master Of All
What is annoying is that it's installed without warnings or questions asked. The good part may be that it provides (or could provide) some functionality and M$ is finally acknowledging the percentage of Firefox users out there.
i had "windows presentation foundation" installed too, with no details at all what it did or any obvious way of deleting it
eventually i navigated to
C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation
and deleted everything in it and it was all gone
Mozilla needs to put a stop to this being possible and at least advise the user on the info screen what DLL is responsible and a way to forcibly remove it
...If you're not already using a FOSS operating system, (Linux or FreeBSD) you probably should be.
Microsoft bet on people not wanting to exercise personal responsibility; that is how they make their money. Windows makes life easier for you by providing you with a scenario where you don't need to take a month or so of your time to customise an open source operating system in order for it to be exactly the way you want it.
However, understand that like with anything else, an exchange is happening here. You want them to provide you with convenience, to make it easy for you, and to basically do pretty much everything for you. They therefore have every right (because you've given it to them) to screw you in whatever manner they feel like. If you uncompromisingly, unthinkingly give them responsibility for your welfare, don't be surprised when they do something which isn't in your best interests.
You can't have it both ways. You can't buy a fast food operating system and relinquish responsibility to a corporation in that manner on the one hand, and then expect it is going to be entirely and exclusively beneficial to you on the other.
It is a law of the universe; there is no free lunch, and in one way or another, you pay for everything.
I'm grinding and gnashing my teeth, but not for the reasons everyone else is.
OK, I hate to defend Microsoft, but they absolutely stated this Firefox extension was to be installed in the release notes for the patch; http://www.microsoft.com/downloads/details.aspx?FamilyID=CECC62DC-96A7-4657-AF91-6383BA034EAB&displaylang=en
Also, as I recall this patch was one of those ones that requires you to click "Agree" or somesuch before installation despite setting to automatically download and install updates.
All of this crap occurs because people don't bother to read release notes any more. They would rather someone else take responsibility for their machines. Well you know what? Microsoft does just that, on a requested and as-needed basis. If you'd rather manage your own patches, then damn it... do it. But do it properly; read the bloody release notes so you know what's going on your machine. If you would rather Microsoft take that responsibility for your machine from you, then do that... but don't bitch when they do something you don't expect because you asked them to just take care of it for you.
Now, I'm not saying there's not other issues at play here; like installing a patch into a competing product and the potential ethical concerns therein... but can this not be construed as (a) a tacit approval of Firefox as a "valid" third-party browser and (b) an attempt to ensure that the user who requested that Microsoft take charge of their experience get the best experience possible?
OK, I will say before I get lynched that I don't really like this too much, myself... I don't much appreciate when people do stuff to my machines that I don't like... but I also accept that this is inevitable. If you turn ANY part of your systems management over to a third party, sometimes they're going to do things that you disagree with. This is only even vaguely newsworthy because it doesn't happen that often. At least, not as often as it could.
If you really don't like it, disable it. And if you don't want this happening again, then start doing your patching the old fashioned way; by downloading the patches by hand and installing them. But don't start crying when they do something unexpected because you didn't read the agreement you agreed to, or read the release notes to understand what the patch is doing.
This is NOT a failure of Microsoft OR Firefox. This is a failure of the user community who would rather hand off their systems management to a third party, and the "advanced" user community who just blindly install patches and updates with no attempt to research the implications of said update.
Me? I'm primarily a Mac and Gentoo user... and yes, I understand that on my Mac I'll get updates from Apple that do much the same stuff as this... but I also read the release notes that are handily downloaded with the patches... that way I know what to expect. With Gentoo, I do the same. I use Windows at work, and manage a large network of systems... and yes, this patch was deployed to my client base... and yes, the Firefox users have the .NET plugin... and yes, they can disable it if they like. In our regression testing, the plugin appeared to have little to no impact on the client system other than adding yet another add on to the list.
"Windows 7 isn't done until Firefox won't run."
Knowledge is power. Knowledge shared is power multiplied.
To save you all the trouble of reading the previous Slashdot discussion, I have summarized it below.
What does this Firefox extension do?
1.) It installs a BHO (Browser Helper Object) .Net Framework Assistant also changes the User-Agent string of the Firefox browser, adding "(.NET CLR 3.5.30729)"
2.) The
A Browser Helper Object (BHO) is a DLL module designed as a plugin for Microsoft's Internet Explorer web browser to provide added functionality.
"BHO can be used to install additional features or functions that are useful, it can also be exploited to install features or functions that are malicious. Some applications, such as the Google or Yahoo toolbars, are examples of good BHO's. But, there are also many examples of BHO's which are used to hijack your Web browser home page, spy on your Internet activities and other malicious actions."
The author on this site goes on to say: "If you are really concerned about bad BHO's and their affect on the overall security of your computer, you can just switch browsers. BHO's are unique to Microsoft's Internet Explorer and do not impact other Web browser applications such as Firefox."
Now that Microsoft has infected Firefox with this extension, his advice in the line above is obsolete!
The following phrases were copied and pasted wholesale, directly from the previous Slashdot discussion without attribution (except in one case where I copied the entire text of one submitter's comment).
The .Net Framework Assistant also changes the User-Agent string of the Firefox browser, adding "(.NET CLR 3.5.30729)", so infected sites can better detect which MS vulnerability to exploit.
The .NET framework is not required for Firefox to run. Why would any sane person assume installing a totally unrelated framework would scribble all over Firefox?
It most definitely IS unexpected, because I was never notified anywhere that a MICROSOFT update would entail installing an addon to a completely NON-Microsoft product.
How are they allowed to get away with this? Isn't installing BHOs that are not asked for and cannot be uninstalled without hacking pretty much the definition of malware?
Microsoft modified *another company's products*. What's next? MS is going to start adding updates to VLC player or Utorrent or OpenOffice or WordPerfect?!?!? They shouldn't be messing with non-microsoft products.
Microsoft is doing this in an update without notifying its users (as far as has been reported) that this update will be modifying third party software with no easy way to prevent or uninstall the change.
The true question here is not how to uninstall it. The question everyone should be asking is: is it messing with other settings in firefox, reporting back to MS what other extensions I use, monitoring my web traffic, going to break my browser, new security holes?
Ok Microsoft, you are making automatic changes to software written by other companies without permission or request of the user. I don't care if you say it's just an extension, you didn't ask me!
The precedent has already been established that the OS can be configured to require the local administrator to give explicit permission for each patch to be applied; the outrage here is that this time, that choice was not offered, and the affected software was neither part of the operating system nor even a Microsoft product.
For those of you who are assuming it's probably safe (and admittedly, you're probably right), there's another good reason to get rid of it. Microsoft changing your browser string to indicate that this piece of software is installed in your browser. The purpose of this, most likely, is to increase the installed base for this software, and use that as an argument
I'm just thinking that if this update is making Registry changes, then the plug-in is Windows-only, and it means that Firefox users on Windows will now have a different browsing experience than Firefox users of other platforms.
So, the plug-in accomplishes two things for Microsoft: 1) it promotes the .NET platform to a wider audience, and 2) it promotes Windows as being the superior OS to run Firefox in.
It's a win-win scenario for Microsoft. Firefox can continue to gain marketshare, but Microsoft will have their tentacles in it, making sure that the adoption of Firefox does not lead to a platform-agnostic world. And it rewards the .NET developers for investing in Microsoft-only technologies.