Sneaky Microsoft Add-On Put Firefox Users At Risk

CWmike writes to mention that the "Windows Presentation Foundation" plugin that Microsoft slipped into Firefox last February apparently left the popular browser open to attack. This was among the many things recently addressed in the massive Tuesday patch. "What was particularly galling to users was that once installed, the .NET add-on was virtually impossible to remove from Firefox. The usual 'Disable' and 'Uninstall' buttons in Firefox's add-on list were grayed out on all versions of Windows except Windows 7, leaving most users no alternative other than to root through the Windows registry, a potentially dangerous chore, since a misstep could cripple the PC. Several sites posted complicated directions on how to scrub the .NET add-on from Firefox, including Annoyances.org."

Comments

except Windows 7

[nurb432]

Best upgrade then ya lusers!.. Here is an online form to order your shiny new pc with Windows 7..

Re:except Windows 7

[Penguinisto]

...depends - the Windows 7 beta and RC had that nasty little habit as well. The RTM is (so far) not doing it.

In either case, wouldn't simply disabling the add-on also work? (this is what I did, and it left me alone after that).

To be honest though, parking a crap add-on and then blaming Firefox for any security issues over it would sound par for the course as per Microsoft... just look at how they're blaming ORacle and Sun for the Sidekick data loss (in spite of the fact that it was lost because their management apparently forgot how to spell "backup").

Re:except Windows 7

[edwardsdl]

I don't understand the question.

Re:except Windows 7

[SilverHatHacker]

Removing the ubufox package is supposed to leave you with a vanilla Firefox, as far as I know. I don't know anything about the 'Ubuntu Firefox Modifications' add-on; I have nothing of the sort on my Ubuntu Jaunty system as far as I can tell.

Re:except Windows 7

[Anonymous Coward]

or ... here's a novel idea ... get ready ...

maybe microsoft could try making good quality products that people want to use instead of spending all their money on subversive, childish, and frankly idiotic, endeavors to stem the flow of users away from their products.

they have been doing the same crap for years with every piece of software in the market that's not theirs. they release an update that makes it insecure or unstable.

not that they care, but i have no respect whatsoever for the poor excuses for businessmen that run Microsoft.

nothing new though i guess ... rather than come out with something useful that makes the world better they just keep churning out the same old crap and bulldoze anyone who gets in their way just like the insurance industry, petroleum industry etc. /sigh

Re:except Windows 7

[shentino]

Which is exactly what makes it outrageous.

What the fuck kind of business does MS have with patching someone else's friggin software?

I'd say that MS is illegally making a derivative binary work and should get nailed for infringing on mozilla copyrights.

Additionally, I also say that MS is engaging in anti-competitive behavior by sabotaging a rival product.

Re:except Windows 7

[srmalloy]

To be honest though, parking a crap add-on and then blaming Firefox for any security issues over it would sound par for the course as per Microsoft...

Well, of course it is... After all, isn't being unable to prevent the company that controls the OS your program runs under from automatically installing unremovable exploit code a severe security hole in your program? So clearly it's a problem with Mozilla, and has nothing to do with Microsoft at all.

Re:except Windows 7

[CrossChris]

Those MS bastards also did it to two of my products (Stacker) back in the 1990s. My company sued them, and they tied us up in court for nearly three years. At that point, we were almost broke, and the board sold the company to MS. We each got a lot of cash from the sale, but it still rankles today.

Remember - if MS like your product, or if it poses a threat to them, they'll either kill you off in court or they will buy / steal the technology (Doublespace) and still tie you up in legal knots.

Nowadays, they screw around with other company's products, and there's (effectively) nothing that anyone can do.

Remember - anyone who can afford to buy the judge can get whatever "legal" ruling they want!

Sabotage?

[Reyendo]

Maybe it's a little paranoid, but... Doesn't Microsoft potentially benefit from Firefox vulnerabilities? I mean, IE isn't doing so well right now, and this could discredit Firefox a little.

Re:Sabotage?

[Voulnet]

On the other hand MS shouldn't want Windows machines to be anymore vulnerable.

Re:Sabotage?

[noundi]

Maybe it's a little paranoid, but... Doesn't Microsoft potentially benefit from Firefox vulnerabilities? I mean, IE isn't doing so well right now, and this could discredit Firefox a little.

It's not paranoid, and yes they do. Making the competitor look bad is the key to success in modern politics, why would it be different in business?

Re:Sabotage?

[e2d2]

Yeah, that sounds like the most likely scenario. It's not just piss poor code, no no. It's definitely a nefarious plan concocted by the Illuminati and put into action by the secret lab they have at Microsoft. First step - fuck up Firefox. Second step - Destroy national borders.

Too many movies makes you think strange things. For instance most people see the CIA as a bunch of bad asses with cell phone watches that project holograms of your dossier into thin air while sending you messages via ESP. Real life: rotary phones, paperwork in triplicate, and a gigantic fucking bureaucracy that thinks pagers are still useful.

Re:Sabotage?

[FlyingBishop]

This is a .NET vulnerability, on MS Windows. Firefox being the vehicle is entirely Microsoft's fault as the maintainer of the .NET plugin.

Re:Sabotage?

[hairyfeet]

And it is actually quite simple to remove with regedit. For those that want to toss it just launch regedit and go to HKEY LOCAL MACHINE > Software> Mozilla > Firefox > Extensions. There you will find both it and the Java extension, just delete and voila! No more Dotnet or Java plugins.

Re:Sabotage?

[Thinboy00]

Given that Nintendo is legally required to warn you prior to updating your Wii that such updates break homebrew, I cannot possibly imagine that Microsoft is allowed to break your software without your consent.

Re:Sabotage?

[jamstar7]

Too many movies makes you think strange things. For instance most people see the CIA as a bunch of bad asses with cell phone watches that project holograms of your dossier into thin air while sending you messages via ESP. Real life: rotary phones, paperwork in triplicate, and a gigantic fucking bureaucracy that thinks pagers are still useful.

Or the idea of NSA 'agents' running around shooting up everything in sight (because the CIA isn't the big Boogie Man anymore). Real life: Bunch of bureaucrats overseeing a bunch of pastyfaced nerds and cubicle rats busy doing signal intercepts and codebreaking. Though the bandwidth and internet access is great, I hear...

Re:Sabotage?

[shutdown -p now]

Maybe it's a little paranoid, but... Doesn't Microsoft potentially benefit from Firefox vulnerabilities? I mean, IE isn't doing so well right now, and this could discredit Firefox a little.

I'm the one who found and reported one of the vulnerabilities (CVE-2009-0090) in this batch that affects Firefox, and I strongly doubt that it was in any way intentional - the vulnerability itself is a fairly obscure corner case in .NET bytecode validator/verifier, and, so far as I can tell, it has been there for a very long time, seemingly before WPF was even released. All in all, it looks like a genuine bug.

A testament to its obscurity is the way I encountered it - I was designing an Algol-60 compiler targetting .NET, and was looking for an efficient way to pass Algol function-type function arguments (which are effectively vararg on the caller side) without having to lift outer locals used by captured functions to heap. Only after coming up with an efficient design and testing that it works, I realized the implications of what I had just done to the verifier.

I cannot comment on CVE-2009-2529 (the second Firefox-affecting vulnerability), but I don't see how it would be any different. Really, the idea of MS deliberately adding vulnerabilities to its products in hope of marginally affecting Firefox by them (remember that IE is hit much worse...) is pretty absurd - even if you disregard the notion of business reputation when it comes to MS, it poses a very high legal liability. No-one in a sane mind would even contemplate doing such a thing.

Disclaimer: I do work for Microsoft at present, though not on the affected products. I did not work for Microsoft when I discovered and reported that vulnerability.

Re:Sabotage?

[SplashMyBandit]

And it is actually quite simple to remove with regedit. For those that want to toss it just launch regedit and go to HKEY LOCAL MACHINE > Software> Mozilla > Firefox > Extensions. There you will find both it and the Java extension, just delete and voila! No more Dotnet or Java plugins.

Whoa, there partner! There hasn't been even a theoretical remote Java exploit for quite some time. The Java plugin is actually useful (especially on the corporate desktop where there are a lot of enterprise-internal Java apps not made available to the public) so might be worth leaving it on.

Re:Sabotage?

[PopeRatzo]

Who gave Glenn Beck a webcam?

Re:Sabotage?

[PopeRatzo]

I'm the one who found and reported one of the vulnerabilities (CVE-2009-0090 [microsoft.com]) in this batch that affects Firefox, and I strongly doubt that it was in any way intentional...remember that IE is hit much worse

You're spoiling everyone's fun, you know that?

Re:Sabotage?

[koro666]

[...] can't they steal that idea from Apple so it would be basically "regutil --remove HKLM_Software_Mozilla_Firefox_Extensions .net"?

Isn't this exactly what reg.exe does already?

Re:Sabotage?

[interkin3tic]

Not surprisingly this comment is sitting here unmoderated

Only for half an hour. An hour later, it is up to +5. I guess the "nucleation" for moderations is the slow step, it has seemed to me that most moderations are done on posts already moderated once. Looking over my comments, I usually notice that most of my posts are unmoderated, the ones that are are usually moderated more than once. I don't really think my posts are either +5 great or +0 meh. Most people with mod points must be lazy and don't browse in full.

Re:Sabotage?

[shutdown -p now]

Ah, but you're missing the golden opportunity that I may be specifically sent here on /. to spread lies and FUD on the subject! ~

Re:Sabotage?

[JimboFBX]

Nah, the instructions are missing a reference to an obscure library somewhere that the user was some how already supposed to have with no link as to where to download it.

Re:Sabotage?

[Gadget_Guy]

No, it is paranoid. How are you finding out about the vulnerability? Because Microsoft patched it last Tuesday. If they wanted to discredit Firefox they would have shipped something to take advantage of the security hole, not something to fix it. Besides, a security hole that only exists on the Windows version of Firefox (and will inevitably be traced back to their code) just makes it look like it is better to run FF on Linux rather than Windows - which would NOT be what they wanted.

The sad part is that this could have gone so well for them. This should have been remembered for Microsoft supporting alternate browsers under Windows so it would be one less reason to say how IE has an unfair advantage. I could (barely) forgive them for silently installing it the extension because from Microsoft's point of view they are adding support for Firefox to .NET rather than the other way around.

What was unforgivable was shipping this without the ability to disable the extension. Even if they had never contemplated the idea that anyone would want to uninstall it, it should have been blindingly obvious that a grayed out Disable button meant that this would stand out from other extensions. They couldn't just say that they didn't notice that it was not able to be uninstalled.

I would like to know how you disable those buttons. Is there some API call when installing the extension (meaning it is a deliberate feature, for which both Microsoft and Mozilla should be shot)? Is it caused by a lack of uninstall script (meaning Microsoft did a half-arsed job of writing the extension)? Or is it a permissions thing that the update was installed by the Administrator account and limited users were not allowed to delete the files/registry keys (meaning... I don't know what to think of that option)?

Re:Sabotage?

[hAckz0r]

You had me going there right up to the "Algol-60" part. In 2009? After all everybody her on SlashDot knows that Algol-68 is the most recent version! Why would anybody be using a back-dated version of a language?

Ok, seriously. Why Algol-60?

Re:Sabotage?

[shutdown -p now]

Ok, seriously. Why Algol-60?

Because it is one of the three languages that started it all, and one that affected all existing mainstream languages most. Curly braces of C, and the block construct that they represent, began their life as "begin .. end" in Algol-60.

Because it is at the same time a very beautiful language - especially considering the time when it was designed - and one with some very advanced constructs, not found even in many modern languages, that can pose significant challenge to implement efficiently, especially in an otherwise constrained environment such as sandboxed CLR. To list a few such features: computed goto, label variables/function arguments and the associated nonlocal goto, arbitrarily nested functions with variable capturing, and call-by-name. Challenges are fun.

Because it's a very important milestone in history of CompSci in general, and language design in particular (in case it's not quite obvious yet, I'm a language design geek), a piece of it that I wish to preserve. Apparently, I'm not alone in that, either - there's also GNU Marst - curiously enough, written by another Russian dude.

Because Simula-67 (the first OOP language ever, and the ultimate ancestor of virtually every statically typed OO language today, including C++, Java and C#) is a strict superset of Algol-60, and I wanted to go after it next.

And, of course, just for fun. I mean, this is Slashdot, right? We routinely get people installing KDE2 on NetBSD running on toasters with 7-segment indicators here; I think my little fetish is relatively benign in contrast.

(To bring the above references to Algol-60 language features into some context for those not familiar with the subject, the final Algol-60 language spec is here; it's a fairly short read.)

After all everybody her on SlashDot knows that Algol-68 is the most recent version!

Algol-68 is an entirely different language from Algol-60. It's not evolutionary, but a complete, ground-up redesign, by very different people. It's also a very interesting one, and important in its own right, since C borrowed a lot of things from it, down to keywords (VOID, INT, SHORT, LONG, STRUCT and UNION are all Algol-68 keywords with virtually the same meaning they have retained in C).

It would be fairly interesting thing to implement as well, but in many ways it's a much more rationally designed language than Algol-60, dropping some overly exotic and complicated features, and, consequently, implementing it is less of a challenge (I guess they had had enough real-world experience writing compilers by then to conclude that some features of Algol-60 looked good on paper only...).

Re:Sabotage?

[the_womble]

What idiot modded that insightful?

It is weird how Windows advocates are quite happy to mess about the the Windows registry but claim that copying and pasting a fwe lines into a terminal window is dfficult.

Not true

[Voulnet]

That's not true, I have Win XP SP2, Firefox 3.5.3; and I just disabled this plugin. It CAN be disabled.

Re:Not true

[Neon Spiral Injector]

That may not be entirely true. Have a look at this:
http://adblockplus.org/blog/the-return-of-net-framework-assistant

Re:Not true

[The Moof]

Originally, you couldn't uninstall the extension. Microsoft did eventually release a patch that activated the Uninstall button, it's been out for a while now. I even think Slashdot had a story about the patch that enabled the button. Still patiently waiting for Sun to give me the same option with "Super Cool Java Firefox Extension"...

(Going to the Advanced Settings in Java under the Control Panel to uninstall a Firefox extension is unacceptable. I also wish they'd clean up their plug-ins when they update.)

Almost

[Kell Bengal]

I went through the process of removing the plug-in. While I was incensed that it was installed without so much as a by-your-leave, the removal method I used didn't require registry hacks or anything so high falutin.

That said, I should not have had to have gone to any such effort in the first place.

Re:remember the important part

[abigsmurf]

The only thing worse than installing without asking is uninstalling without asking.

Registry Danger!

[aster_ken]

Can we please stop with the "registry editing will end the world" warnings? It's no more dangerous to delete something from your registry than it is to delete something from the Program Files or Windows folders, and System Restore is more-than-capable of bringing the system back to life after your incompetence.

Also, the ability to remove this plug-in was covered on Slashdot a few months ago when Microsoft released version 1.1. It was included in an earlier service release to the .NET Framework for Windows XP and Windows Vista. This plug-in doesn't even exist in Windows XP by default. You must have installed .NET Framework 3.0 or higher to get it. Windows Vista includes .NET Framework 3.0, but if you've bothered to keep up with security updates you would have the ability to uninstall or disable the plug-in without modifying the registry by hand. Windows 7 allows you to do it because the earlier service release is part of the operating system.

Microsoft bashing is fun, but let's stick to facts.

Re:Registry Danger!

[Frosty Piss]

but if you've bothered to keep up with security updates you would have the ability to uninstall or disable the plug-in without modifying the registry by hand.

You mean like this? That's *no* uninstalling.

Re:Registry Danger!

[Penguinisto]

"It's no more dangerous to delete something from your registry"

Perhaps, but...

1. This kinda invalidates the argument that Windows fanboys have been spouting for years, namely "...but in Linux/BSD/Whatever, you have to edit files, which is too hard for Joe Sixpack to do!"
2. If you bork the registry, discover it's borked only after a full reboot/log-in, then try to reboot again thinking it's some other problem, that backup copy of the registry just went 'pfft!', and you may or may not be able to get to a point where you can use System Restore
3. The registry makes a great place to hide stuff in (see also half the malware to come down the pike in the past 9 years)

Re:Registry Danger!

[PopeRatzo]

turns out having a particular antivirus installed (mcaffee if I recall)

There's your problem, right there.

Amazing

[gmuslera]

This is from the same people that claimed that the Google Chrome Render plugin for IE6+ will make the browser less secure?

Re:Amazing

[shutdown -p now]

If anything, this case further reinforces that claim. Any new functionality (including plugins) added to a browser increases its attack surface, unless it completely replaces part of the existing code. In this case, the increased surface was due to WPF being exposed. In case of Chrome plugin, it's Chrome rendering engine.

If Chrome completely replaced IE renderer, with no means to re-activate it, then it would be reasonable to argue that it does improve security. However, Chrome renderer is opt-in, which means that any attack site willing to exploit an IE vulnerability will happily work in IE with Chrome plugin installed, but at the same time any site willing to exploit a Chrome vulnerability - and it's not like there aren't, or will never be, any - can request IE with Chrome plugin to use Chrome for rendering.

Shouldn't the title read

[jayme0227]

"Microsoft fixes vulnerability in their own Firefox Addon"? The summary would then point out that this was covered and Microsoft fixed the problem. But I guess calling Microsoft "sneaky," ignoring the fact that this was already posted on slashdot, and then minimizing the fact that MS actually fixed the problem was too appealing to pass up.

Re:remember the important part

[jalefkowit]

That's what SHE said!

(sorry, couldn't resist)

Re:Not this shit again.

[asa]

There are lots of programs that install plugins automagically...Skype, antiviruses, and Picasa are a few that I can think of off the top of my head. The only bad part of this whole thing is that MS screwed up the remove/uninstall feature by making it show up for all users.

No. Wrong. Installing plug-ins or extensions without asking is bad. Period. Full stop. End of story.

Re:What? Shouldn't firefox fix this one?

[asa]

So firefox allows a rogue addon to install without any user intervention and the story is all about how evil MSFT is?

Sure, they did it. Bad Microsoft.

But isn't the bigger issue that now that this is known....*anyone* can pull this on firefox users?

No. I am not apologizing for Microsoft. This was "Sony Stupid" of them. We're used to that here, though. What we're not used to (and apparently sweeping under the rug) is the massive, unholy hell of a mess mozilla's extension system for firefox is....

Anyone that can run executable code on your system can do anything to your system. The "good guys" aren't supposed to do things to your system without asking you first. The "bad guys" can simply replace Firefox entirely with a version that has what ever features they want. If you let someone run code on your system, you lose. Firefox cannot stop that code from doing what ever it wants. The point is that you're supposed to only install software from vendors you trust. You should be able to trust Microsoft and that your trust was abused and abused in a way that caused you to be vulnerable to remote exploits is the story here.

Re:except anything but Windoze

[zach_the_lizard]

You can try WINE. Assuming Aion is Aion: The Tower of Eternity, people have gotten the game to play on Linux, FreeBSD, and Mac OS X with WINE, though there may be caveats. No one has tested NBA 2k10 on the AppDB. NBA 2k08 seems to work, however.

Mozilla is on top of it, though

[macraig]

This screen capture of a dialog I saw tonight demonstrates that Mozilla is paying attention and doing something about it, though:

Re:except anything but Windoze

[bh_doc]

I know you didn't start this, but I have to say:

2k10... 2k08...

What the hell? Are these supposed to be short for 2010 and 2008? What's the freaking point of writing them like that?