Sneaky Microsoft Add-On Put Firefox Users At Risk

CWmike writes to mention that the "Windows Presentation Foundation" plugin that Microsoft slipped into Firefox last February apparently left the popular browser open to attack. This was among the many things recently addressed in the massive Tuesday patch. "What was particularly galling to users was that once installed, the .NET add-on was virtually impossible to remove from Firefox. The usual 'Disable' and 'Uninstall' buttons in Firefox's add-on list were grayed out on all versions of Windows except Windows 7, leaving most users no alternative other than to root through the Windows registry, a potentially dangerous chore, since a misstep could cripple the PC. Several sites posted complicated directions on how to scrub the .NET add-on from Firefox, including Annoyances.org."

Comments

except Windows 7

[nurb432]

Best upgrade then ya lusers!.. Here is an online form to order your shiny new pc with Windows 7..

Re:except Windows 7

[Penguinisto]

...depends - the Windows 7 beta and RC had that nasty little habit as well. The RTM is (so far) not doing it.

In either case, wouldn't simply disabling the add-on also work? (this is what I did, and it left me alone after that).

To be honest though, parking a crap add-on and then blaming Firefox for any security issues over it would sound par for the course as per Microsoft... just look at how they're blaming ORacle and Sun for the Sidekick data loss (in spite of the fact that it was lost because their management apparently forgot how to spell "backup").

Re:except Windows 7

[edwardsdl]

I don't understand the question.

Re:except Windows 7

[PopeRatzo]

I don't understand the question.

That's OK, neither did he.

Re:except Windows 7

[SilverHatHacker]

Removing the ubufox package is supposed to leave you with a vanilla Firefox, as far as I know. I don't know anything about the 'Ubuntu Firefox Modifications' add-on; I have nothing of the sort on my Ubuntu Jaunty system as far as I can tell.

Re:except Windows 7

[Anonymous Coward]

or ... here's a novel idea ... get ready ...

maybe microsoft could try making good quality products that people want to use instead of spending all their money on subversive, childish, and frankly idiotic, endeavors to stem the flow of users away from their products.

they have been doing the same crap for years with every piece of software in the market that's not theirs. they release an update that makes it insecure or unstable.

not that they care, but i have no respect whatsoever for the poor excuses for businessmen that run Microsoft.

nothing new though i guess ... rather than come out with something useful that makes the world better they just keep churning out the same old crap and bulldoze anyone who gets in their way just like the insurance industry, petroleum industry etc. /sigh

Re:except Windows 7

[VGPowerlord]

In either case, wouldn't simply disabling the add-on also work? (this is what I did, and it left me alone after that).

FTFS:

What was particularly galling to users was that once installed, the .NET add-on was virtually impossible to remove from Firefox. The usual "Disable" and "Uninstall" buttons in Firefox's add-on list were grayed out on all versions of Windows except Windows 7

Emphasis mine.

You should learn to read the article, too.

FTFA:

Microsoft reacted to criticism about the method it used to install the Firefox add-on by issuing another update in early May that made it possible to uninstall or disable the .NET Framework Assistant.

Emphasis mine.

Also, note that this plugin update was pushed out via Windows Update.

Re:except Windows 7

[KrimZon]

Or if Ubuntu is the unstable and annoying one out of distros, the rest must be utterly amazing.

Re:except Windows 7

[shentino]

Which is exactly what makes it outrageous.

What the fuck kind of business does MS have with patching someone else's friggin software?

I'd say that MS is illegally making a derivative binary work and should get nailed for infringing on mozilla copyrights.

Additionally, I also say that MS is engaging in anti-competitive behavior by sabotaging a rival product.

Re:except Windows 7

[zach_the_lizard]

Don't know about you, but "Disable" is not grayed out on my Ubuntu box for that add-on.

Re:except Windows 7

[srmalloy]

To be honest though, parking a crap add-on and then blaming Firefox for any security issues over it would sound par for the course as per Microsoft...

Well, of course it is... After all, isn't being unable to prevent the company that controls the OS your program runs under from automatically installing unremovable exploit code a severe security hole in your program? So clearly it's a problem with Mozilla, and has nothing to do with Microsoft at all.

Re:except Windows 7

[CrossChris]

Those MS bastards also did it to two of my products (Stacker) back in the 1990s. My company sued them, and they tied us up in court for nearly three years. At that point, we were almost broke, and the board sold the company to MS. We each got a lot of cash from the sale, but it still rankles today.

Remember - if MS like your product, or if it poses a threat to them, they'll either kill you off in court or they will buy / steal the technology (Doublespace) and still tie you up in legal knots.

Nowadays, they screw around with other company's products, and there's (effectively) nothing that anyone can do.

Remember - anyone who can afford to buy the judge can get whatever "legal" ruling they want!

Sabotage?

[Reyendo]

Maybe it's a little paranoid, but... Doesn't Microsoft potentially benefit from Firefox vulnerabilities? I mean, IE isn't doing so well right now, and this could discredit Firefox a little.

Re:Sabotage?

[Voulnet]

On the other hand MS shouldn't want Windows machines to be anymore vulnerable.

Re:Sabotage?

[noundi]

Maybe it's a little paranoid, but... Doesn't Microsoft potentially benefit from Firefox vulnerabilities? I mean, IE isn't doing so well right now, and this could discredit Firefox a little.

It's not paranoid, and yes they do. Making the competitor look bad is the key to success in modern politics, why would it be different in business?

Re:Sabotage?

[e2d2]

Yeah, that sounds like the most likely scenario. It's not just piss poor code, no no. It's definitely a nefarious plan concocted by the Illuminati and put into action by the secret lab they have at Microsoft. First step - fuck up Firefox. Second step - Destroy national borders.

Too many movies makes you think strange things. For instance most people see the CIA as a bunch of bad asses with cell phone watches that project holograms of your dossier into thin air while sending you messages via ESP. Real life: rotary phones, paperwork in triplicate, and a gigantic fucking bureaucracy that thinks pagers are still useful.

Re:Sabotage?

[Captain Spam]

Not really, not when it's due to a plugin they themselves installed and have their name all over. I mean, you don't consider Flash vulnerabilities to be the fault of IE or Firefox, do you? If anything (and that's a big "if" in this case), it'll be a black eye for Microsoft.

Nah, if you're going the paranoid route, it'd have been a better idea if they made this plugin under the guise of a shell company or something, then when the vulnerabilities hit the fan, have the shell complain about how "hard" it is to make a secure plugin for the "obviously inferior" Firefox, then have Microsoft suddenly pipe up about how much more secure the .NET plugin is under IE. Bonus points if the shell claims to be open-source with their reimplementation of .NET so Microsoft can attempt to discredit open-source software, too!

But we're not THAT paranoid. Are we?

Re:Sabotage?

[FlyingBishop]

This is a .NET vulnerability, on MS Windows. Firefox being the vehicle is entirely Microsoft's fault as the maintainer of the .NET plugin.

Re:Sabotage?

[hairyfeet]

And it is actually quite simple to remove with regedit. For those that want to toss it just launch regedit and go to HKEY LOCAL MACHINE > Software> Mozilla > Firefox > Extensions. There you will find both it and the Java extension, just delete and voila! No more Dotnet or Java plugins.

Re:Sabotage?

[Thinboy00]

Given that Nintendo is legally required to warn you prior to updating your Wii that such updates break homebrew, I cannot possibly imagine that Microsoft is allowed to break your software without your consent.

Re:Sabotage?

[jamstar7]

Too many movies makes you think strange things. For instance most people see the CIA as a bunch of bad asses with cell phone watches that project holograms of your dossier into thin air while sending you messages via ESP. Real life: rotary phones, paperwork in triplicate, and a gigantic fucking bureaucracy that thinks pagers are still useful.

Or the idea of NSA 'agents' running around shooting up everything in sight (because the CIA isn't the big Boogie Man anymore). Real life: Bunch of bureaucrats overseeing a bunch of pastyfaced nerds and cubicle rats busy doing signal intercepts and codebreaking. Though the bandwidth and internet access is great, I hear...

Re:Sabotage?

[Ethanol-fueled]

It's not broken if it still works, even if it is a gaping security hole.

Re:Sabotage?

[shutdown -p now]

Maybe it's a little paranoid, but... Doesn't Microsoft potentially benefit from Firefox vulnerabilities? I mean, IE isn't doing so well right now, and this could discredit Firefox a little.

I'm the one who found and reported one of the vulnerabilities (CVE-2009-0090) in this batch that affects Firefox, and I strongly doubt that it was in any way intentional - the vulnerability itself is a fairly obscure corner case in .NET bytecode validator/verifier, and, so far as I can tell, it has been there for a very long time, seemingly before WPF was even released. All in all, it looks like a genuine bug.

A testament to its obscurity is the way I encountered it - I was designing an Algol-60 compiler targetting .NET, and was looking for an efficient way to pass Algol function-type function arguments (which are effectively vararg on the caller side) without having to lift outer locals used by captured functions to heap. Only after coming up with an efficient design and testing that it works, I realized the implications of what I had just done to the verifier.

I cannot comment on CVE-2009-2529 (the second Firefox-affecting vulnerability), but I don't see how it would be any different. Really, the idea of MS deliberately adding vulnerabilities to its products in hope of marginally affecting Firefox by them (remember that IE is hit much worse...) is pretty absurd - even if you disregard the notion of business reputation when it comes to MS, it poses a very high legal liability. No-one in a sane mind would even contemplate doing such a thing.

Disclaimer: I do work for Microsoft at present, though not on the affected products. I did not work for Microsoft when I discovered and reported that vulnerability.

Re:Sabotage?

[SleazyRidr]

If your security is that bad, you should really consider switching to Linux.

Re:Sabotage?

[SplashMyBandit]

And it is actually quite simple to remove with regedit. For those that want to toss it just launch regedit and go to HKEY LOCAL MACHINE > Software> Mozilla > Firefox > Extensions. There you will find both it and the Java extension, just delete and voila! No more Dotnet or Java plugins.

Whoa, there partner! There hasn't been even a theoretical remote Java exploit for quite some time. The Java plugin is actually useful (especially on the corporate desktop where there are a lot of enterprise-internal Java apps not made available to the public) so might be worth leaving it on.

Re:Sabotage?

[PopeRatzo]

For instance most people see the CIA as a bunch of bad asses with cell phone watches that project holograms of your dossier into thin air while sending you messages via ESP.

That's how those bastards did me, too!

Re:Sabotage?

[PopeRatzo]

Who gave Glenn Beck a webcam?

Re:Sabotage?

[PopeRatzo]

I'm the one who found and reported one of the vulnerabilities (CVE-2009-0090 [microsoft.com]) in this batch that affects Firefox, and I strongly doubt that it was in any way intentional...remember that IE is hit much worse

You're spoiling everyone's fun, you know that?

Re:Sabotage?

[Ilgaz]

Users can't use regedit. Apple knows it for the tiny plist files (which are text) so they did a "plutil" (plist utility) command included in OS which they (or developers) can tell users to run Terminal and "paste that command _exactly_ as it appears".

While there are 3.500.000 results for "run regedit" at Yahoo, can't they steal that idea from Apple so it would be basically "regutil --remove HKLM_Software_Mozilla_Firefox_Extensions .net"?

The most insane idea of all is entering Firefox on Windows, you know, the browser which its users use rejecting your built in browser. I wouldn't touch a byte on Firefox dir if I was MS. Even Apple who isn't that "hated" doesn't do anything regarding extensions, they merely install a basic browser plugin which they still get flamed for.

Re:Sabotage?

[koro666]

[...] can't they steal that idea from Apple so it would be basically "regutil --remove HKLM_Software_Mozilla_Firefox_Extensions .net"?

Isn't this exactly what reg.exe does already?

Re:Sabotage?

[interkin3tic]

Not surprisingly this comment is sitting here unmoderated

Only for half an hour. An hour later, it is up to +5. I guess the "nucleation" for moderations is the slow step, it has seemed to me that most moderations are done on posts already moderated once. Looking over my comments, I usually notice that most of my posts are unmoderated, the ones that are are usually moderated more than once. I don't really think my posts are either +5 great or +0 meh. Most people with mod points must be lazy and don't browse in full.

Re:Sabotage?

[shutdown -p now]

Ah, but you're missing the golden opportunity that I may be specifically sent here on /. to spread lies and FUD on the subject! ~

Re:Sabotage?

[Anonymous Coward]

Of course you are, everyone on Slashdot knows people who work at Microsoft aren't human and are all entirely malicious. They know anyone supporting Microsoft's viewpoint is just a paid shill, in fact they know you made the whole story up to cover up the real story.

Unfortantely, what people "know" on Slashdot is never actually the truth but a disturbingly paranoid cocktail of ignorance and idiocy.

Thanks for the write up, it's always really interesting to hear how people stumble across bugs like this in the first place, because I don't think the obscurity if your story was unique to bug reports- there's an interesting story behind many such bugs and they're all worth hearing as they generally involve something deeply technical and frankly, I'd rather hear such deeply technical stories than a bunch of OSS/Mac zealots whinging about how Microsoft did it intentionally so that when Steve Jobs has a pacemaker installed running Windows it instantly crashes killing him off and destroying Apple's share price, or whatever the fuck crazy story said zealots decide to conjure up in their paranoid minds next.

Of course, what said zealots miss, is that their zealotry and ignorance is more often than not what leads to the vast majority of users being put off their preferred platform.

Re:Sabotage?

[Anonymous Coward]

But this is exactly the kind of crap instructions you get when you try to anything in Linux. I would have thought Slashdot would be singing the praises of this kind of obtuse set of instructions!

Re:Sabotage?

[JimboFBX]

Nah, the instructions are missing a reference to an obscure library somewhere that the user was some how already supposed to have with no link as to where to download it.

Re:Sabotage?

[Gadget_Guy]

No, it is paranoid. How are you finding out about the vulnerability? Because Microsoft patched it last Tuesday. If they wanted to discredit Firefox they would have shipped something to take advantage of the security hole, not something to fix it. Besides, a security hole that only exists on the Windows version of Firefox (and will inevitably be traced back to their code) just makes it look like it is better to run FF on Linux rather than Windows - which would NOT be what they wanted.

The sad part is that this could have gone so well for them. This should have been remembered for Microsoft supporting alternate browsers under Windows so it would be one less reason to say how IE has an unfair advantage. I could (barely) forgive them for silently installing it the extension because from Microsoft's point of view they are adding support for Firefox to .NET rather than the other way around.

What was unforgivable was shipping this without the ability to disable the extension. Even if they had never contemplated the idea that anyone would want to uninstall it, it should have been blindingly obvious that a grayed out Disable button meant that this would stand out from other extensions. They couldn't just say that they didn't notice that it was not able to be uninstalled.

I would like to know how you disable those buttons. Is there some API call when installing the extension (meaning it is a deliberate feature, for which both Microsoft and Mozilla should be shot)? Is it caused by a lack of uninstall script (meaning Microsoft did a half-arsed job of writing the extension)? Or is it a permissions thing that the update was installed by the Administrator account and limited users were not allowed to delete the files/registry keys (meaning... I don't know what to think of that option)?

Re:Sabotage?

[hAckz0r]

You had me going there right up to the "Algol-60" part. In 2009? After all everybody her on SlashDot knows that Algol-68 is the most recent version! Why would anybody be using a back-dated version of a language?

Ok, seriously. Why Algol-60?

Re:Sabotage?

[hairyfeet]

Uuuuhhh...never heard of a .reg file? If you have somebody who is afraid of using the reg they really ain't hard to cook up. if you need one here is a nice tutorial on how to modify and delete reg entries with a .reg file. Certainly a lot easier to go "clicky clicky" on a reg file than risk having the user bone something in CLI.

That is one of the nice things about the Windows registry-it really isn't hard to cook up a .reg file in notepad and send it to someone having a problem. Oh and if anybody needs it here is a page of the most common fixes for those little problems that pop up from time to time, and nearly all of them are nice simple .reg files that makes it simple to send to someone having trouble or keep on a flash in a misc tools folder. Despite all the hate out there for the reg is actually pretty simple to backup, fix, and maintain, with little effort.

Re:Sabotage?

[shutdown -p now]

Ok, seriously. Why Algol-60?

Because it is one of the three languages that started it all, and one that affected all existing mainstream languages most. Curly braces of C, and the block construct that they represent, began their life as "begin .. end" in Algol-60.

Because it is at the same time a very beautiful language - especially considering the time when it was designed - and one with some very advanced constructs, not found even in many modern languages, that can pose significant challenge to implement efficiently, especially in an otherwise constrained environment such as sandboxed CLR. To list a few such features: computed goto, label variables/function arguments and the associated nonlocal goto, arbitrarily nested functions with variable capturing, and call-by-name. Challenges are fun.

Because it's a very important milestone in history of CompSci in general, and language design in particular (in case it's not quite obvious yet, I'm a language design geek), a piece of it that I wish to preserve. Apparently, I'm not alone in that, either - there's also GNU Marst - curiously enough, written by another Russian dude.

Because Simula-67 (the first OOP language ever, and the ultimate ancestor of virtually every statically typed OO language today, including C++, Java and C#) is a strict superset of Algol-60, and I wanted to go after it next.

And, of course, just for fun. I mean, this is Slashdot, right? We routinely get people installing KDE2 on NetBSD running on toasters with 7-segment indicators here; I think my little fetish is relatively benign in contrast.

(To bring the above references to Algol-60 language features into some context for those not familiar with the subject, the final Algol-60 language spec is here; it's a fairly short read.)

After all everybody her on SlashDot knows that Algol-68 is the most recent version!

Algol-68 is an entirely different language from Algol-60. It's not evolutionary, but a complete, ground-up redesign, by very different people. It's also a very interesting one, and important in its own right, since C borrowed a lot of things from it, down to keywords (VOID, INT, SHORT, LONG, STRUCT and UNION are all Algol-68 keywords with virtually the same meaning they have retained in C).

It would be fairly interesting thing to implement as well, but in many ways it's a much more rationally designed language than Algol-60, dropping some overly exotic and complicated features, and, consequently, implementing it is less of a challenge (I guess they had had enough real-world experience writing compilers by then to conclude that some features of Algol-60 looked good on paper only...).

Re:Sabotage?

[interkin3tic]

I mean browsing in full while moderating: actually reading those posts which haven't been modded up yet so that you can spot good ones deserving a mod. Such as the one in question.

Re:Sabotage?

[the_womble]

What idiot modded that insightful?

It is weird how Windows advocates are quite happy to mess about the the Windows registry but claim that copying and pasting a fwe lines into a terminal window is dfficult.

Re:Sabotage?

[hairyfeet]

Yeah about that? I've found those copy/pasta in the terminals don't...oh what is the word...oh yeah, actually work. Because it was cooked up by some guy with a hardware/software setup that was "kinda sorta like yours, but not really, oh and different revs on hardware firmware".

Contrast this to windows where the EXACT SAME reg file that worked on granny's XP works on little Timmy's gamer rig. That is what is nice about the reg-XP is XP is XP, no matter the hardware. You ever try to get one of those damned Broadcom wireless to WPA2 with those "easy to copy paste" commands in Linux? Yeah, good luck with that pal. It'll make you want to see how far you can chunk that laptop after a half day of dealing with that migraine creator. No thanks.

After 15 years of dealing with Windows as a PC repairman, from Win3.x on up, I can say without fear of exaggeration, that Windows on its worse day doesn't equal the bringing of the pain that is Linux. Linux guys like to talk about switching Windows users, but lets be honest here okay? Its bullshit. Linux is NO different than Mac. Linux is just hunky dory IF you have the right hardware, but that is a really big fucking IF, and of course finding out if that hardware you just bought is gonna work or not is a royal PITA. At least the Mac guys have the Apple store, and Windows has...well every other store, but Linux? Yeah enjoy those hours trawling forums there pal. No thank you, I spend all damned day fixing boxes, the LAST thing I want to do is spend a few hours in a fricking CLI trying to "tweak" a ton of Unix commands in the hopes I can get my soundcard unborked. Bleech!

Not true

[Voulnet]

That's not true, I have Win XP SP2, Firefox 3.5.3; and I just disabled this plugin. It CAN be disabled.

Re:Not true

[Neon Spiral Injector]

That may not be entirely true. Have a look at this:
http://adblockplus.org/blog/the-return-of-net-framework-assistant

Re:Not true

[The Moof]

Originally, you couldn't uninstall the extension. Microsoft did eventually release a patch that activated the Uninstall button, it's been out for a while now. I even think Slashdot had a story about the patch that enabled the button. Still patiently waiting for Sun to give me the same option with "Super Cool Java Firefox Extension"...

(Going to the Advanced Settings in Java under the Control Panel to uninstall a Firefox extension is unacceptable. I also wish they'd clean up their plug-ins when they update.)

Re:Not true

[Martin Blank]

Original reporting from 09 Feb 09: Microsoft Update Slips In a Firefox Extension

Follow-up with removal instructions from 05 Jun 09: MS Issued a Fix For Its Unwanted FireFox Extension

The second article notes that the fix was actually issued in early May.

Almost

[Kell Bengal]

I went through the process of removing the plug-in. While I was incensed that it was installed without so much as a by-your-leave, the removal method I used didn't require registry hacks or anything so high falutin.

That said, I should not have had to have gone to any such effort in the first place.

Re:Almost

[v1]

This is why you should read the release notes before you install software.

And the 109 page EULA. Don't forget to read all of that too. Pay particular attention to the 215+ word long sentences with words so long they wrap the window and stump your dictionary.

Read everything

Re:Almost

[edxwelch]

I have automatic windows updates disabled and it was installed on my machine. To tell you the truth I found half a dozen microsoft addins and plugins installed stealthly

Re:Almost

[Kell Bengal]

Also the case for me - I review each and every update to make sure it's something I really want/need.

Re:remember the important part

[abigsmurf]

The only thing worse than installing without asking is uninstalling without asking.

Registry Danger!

[aster_ken]

Can we please stop with the "registry editing will end the world" warnings? It's no more dangerous to delete something from your registry than it is to delete something from the Program Files or Windows folders, and System Restore is more-than-capable of bringing the system back to life after your incompetence.

Also, the ability to remove this plug-in was covered on Slashdot a few months ago when Microsoft released version 1.1. It was included in an earlier service release to the .NET Framework for Windows XP and Windows Vista. This plug-in doesn't even exist in Windows XP by default. You must have installed .NET Framework 3.0 or higher to get it. Windows Vista includes .NET Framework 3.0, but if you've bothered to keep up with security updates you would have the ability to uninstall or disable the plug-in without modifying the registry by hand. Windows 7 allows you to do it because the earlier service release is part of the operating system.

Microsoft bashing is fun, but let's stick to facts.

Re:Registry Danger!

[Darkness404]

The difference is, its pretty easy to figure out what things do in the Program Files directory, the Windows directory is a bit more confusing, but a lot of it is still pretty easy to figure out. Good luck for an average computer user to figure out what /HKEY_LOCAL_MACHINE\ SOFTWARE\etc. is compared to Program Files and X program.

Re:Registry Danger!

[Frosty Piss]

but if you've bothered to keep up with security updates you would have the ability to uninstall or disable the plug-in without modifying the registry by hand.

You mean like this? That's *no* uninstalling.

Re:Registry Danger!

[Penguinisto]

"It's no more dangerous to delete something from your registry"

Perhaps, but...

1. This kinda invalidates the argument that Windows fanboys have been spouting for years, namely "...but in Linux/BSD/Whatever, you have to edit files, which is too hard for Joe Sixpack to do!"
2. If you bork the registry, discover it's borked only after a full reboot/log-in, then try to reboot again thinking it's some other problem, that backup copy of the registry just went 'pfft!', and you may or may not be able to get to a point where you can use System Restore
3. The registry makes a great place to hide stuff in (see also half the malware to come down the pike in the past 9 years)

Re:Registry Danger!

[PopeRatzo]

turns out having a particular antivirus installed (mcaffee if I recall)

There's your problem, right there.

Re:Registry Danger!

[Rennt]

Go with me on this one. *ahem*

"Windows will NEVER be ready for the desktop until you can remove a plugin without hacking the registry. If a user has to open regedit.exe MS has already failed."

Amazing

[gmuslera]

This is from the same people that claimed that the Google Chrome Render plugin for IE6+ will make the browser less secure?

Re:Amazing

[matzahboy]

The other funny thing is that the firefox plugin was installed without the user's permission. The user has to go to the chrome website and click the button that say "install".

Re:Amazing

[shutdown -p now]

If anything, this case further reinforces that claim. Any new functionality (including plugins) added to a browser increases its attack surface, unless it completely replaces part of the existing code. In this case, the increased surface was due to WPF being exposed. In case of Chrome plugin, it's Chrome rendering engine.

If Chrome completely replaced IE renderer, with no means to re-activate it, then it would be reasonable to argue that it does improve security. However, Chrome renderer is opt-in, which means that any attack site willing to exploit an IE vulnerability will happily work in IE with Chrome plugin installed, but at the same time any site willing to exploit a Chrome vulnerability - and it's not like there aren't, or will never be, any - can request IE with Chrome plugin to use Chrome for rendering.

Deja-vu

[Dishwasha]

Is it just me, or were we just talking about this

Re:"Cripple the PC"

[Anonymous Coward]

Exactly, and if anyone knows about crippled platforms, it's Apple.

WPF not Assistant

[NoYob]

The Adblock guy is talking about the Assistant. Unless I'm misunderstanding the issue, the problem is with the WPF plugin. Windows Presentation Foundation - that's the vector.

Not this shit again.

[jim_v2000]

There are lots of programs that install plugins automagically...Skype, antiviruses, and Picasa are a few that I can think of off the top of my head. The only bad part of this whole thing is that MS screwed up the remove/uninstall feature by making it show up for all users.

Re:Not this shit again.

[asa]

There are lots of programs that install plugins automagically...Skype, antiviruses, and Picasa are a few that I can think of off the top of my head. The only bad part of this whole thing is that MS screwed up the remove/uninstall feature by making it show up for all users.

No. Wrong. Installing plug-ins or extensions without asking is bad. Period. Full stop. End of story.

Shouldn't the title read

[jayme0227]

"Microsoft fixes vulnerability in their own Firefox Addon"? The summary would then point out that this was covered and Microsoft fixed the problem. But I guess calling Microsoft "sneaky," ignoring the fact that this was already posted on slashdot, and then minimizing the fact that MS actually fixed the problem was too appealing to pass up.

Re:Shouldn't the title read

[causality]

"Microsoft fixes vulnerability in their own Firefox Addon"? The summary would then point out that this was covered and Microsoft fixed the problem. But I guess calling Microsoft "sneaky," ignoring the fact that this was already posted on slashdot, and then minimizing the fact that MS actually fixed the problem was too appealing to pass up.

In a way it is sneaky. If I used Firefox in Windows and wanted this plugin, I would install it myself. Anyone using Firefox in Windows is already demonstrating that they are aware that they have choices as to what browser software to use, and I strongly doubt that the average Firefox user has never heard of addons.mozilla.com or otherwise doesn't know how to locate and install desired add-ons/plugins on their own.

The case can be made for automagically installing things for the "blue E is the Internet!" crowd as they are rather averse to any involvement in this sort of decision-making, viewing it as an unwanted burden. Yet even then, it's non-ideal. The honest, non-sneaky way to handle this would be to separate it from the core .NET package. Then either remove it from Windows Update completely and offer it as a voluntary download, or, make it a separate line-item update that can be declined.

Just assuming that you must want this non-essential thing and making that assumption without considering security implications, all in the name of increasing marketshare, is what's sneaky or exploitative. People who use automatic Windows Updates do so because they rely on it to keep their systems patched and secure. When they are not technically inclined, they are something of a captive audience in this scenario.

You know, when the big virulent worms like Sasser and Code Red came out, they attacked vulnerabilities for which patches had already been issued. I used to wonder why so many people didn't keep their machines more up-to-date when an automatic mechanism is provided that will do it for them. Every time I see something like this, I begin to understand why. It's in everyone's interest to lessen the number of vulnerable machines on the network. Another reason to distrust a mechanism that could have prevented many of these infections does not further that interest. If Microsoft were really serious about security, they would minimize this effect by separating Windows Update into two categories: "Bugfixes & Security Patches", and an optional "New Features".

Re:remember the important part

[jalefkowit]

That's what SHE said!

(sorry, couldn't resist)

Re:What? Shouldn't firefox fix this one?

[asa]

So firefox allows a rogue addon to install without any user intervention and the story is all about how evil MSFT is?

Sure, they did it. Bad Microsoft.

But isn't the bigger issue that now that this is known....*anyone* can pull this on firefox users?

No. I am not apologizing for Microsoft. This was "Sony Stupid" of them. We're used to that here, though. What we're not used to (and apparently sweeping under the rug) is the massive, unholy hell of a mess mozilla's extension system for firefox is....

Anyone that can run executable code on your system can do anything to your system. The "good guys" aren't supposed to do things to your system without asking you first. The "bad guys" can simply replace Firefox entirely with a version that has what ever features they want. If you let someone run code on your system, you lose. Firefox cannot stop that code from doing what ever it wants. The point is that you're supposed to only install software from vendors you trust. You should be able to trust Microsoft and that your trust was abused and abused in a way that caused you to be vulnerable to remote exploits is the story here.

Re:What? Shouldn't firefox fix this one?

[asa]

That was my reaction as well. How can ANY firefox plugin be given the authority to not allow itself to be turned off? Sure, it's Microsoft being an asshole, but that also seems like broken behavior on Firefox's part.

Easy, install the plug-in or add-on to a system directory the current user doesn't have permission to change. This wasn't installed through Firefox's add-ons manager. This was installed by a third party executable that dumped the file into a location that the current user couldn't modify.

Re:except anything but Windoze

[Hymer]

You may find free and secure alternatives to Windows at http://ubuntu.com/ or http://opensuse.org/

Re:except anything but Windoze

[Evil Shabazz]

Yeah, but where can I find free and secure alternatives to Windows that run the applications I want to run? Specifically, I'm currently only using my home computer for - Internet, Email, and Gaming. The first two, okay. But where can I find this free, secure OS that will run both Aion and NBA 2K10 for me? I'm not asking to be completely sarcastic - I actually would consider moving away from Windows if I could find an alternative for gamers... It's getting here, slowly. Didn't Valve recently say they'd make their games for Linux?

Re:except anything but Windoze

[zach_the_lizard]

You can try WINE. Assuming Aion is Aion: The Tower of Eternity, people have gotten the game to play on Linux, FreeBSD, and Mac OS X with WINE, though there may be caveats. No one has tested NBA 2k10 on the AppDB. NBA 2k08 seems to work, however.

Mozilla is on top of it, though

[macraig]

This screen capture of a dialog I saw tonight demonstrates that Mozilla is paying attention and doing something about it, though:

Re:except anything but Windoze

[bh_doc]

I know you didn't start this, but I have to say:

2k10... 2k08...

What the hell? Are these supposed to be short for 2010 and 2008? What's the freaking point of writing them like that?