Slashdot Mirror
How the Mozilla Sniffer Backdoor Was Discovered
An anonymous reader writes "Mozilla pulled one of their Firefox add-ons earlier this week for containing a backdoor which stole passwords from its users. Netcraft has taken a closer look at how the rogue extension worked, and how it was discovered by chance rather than through any code review process. Mozilla are working on a new security model to stop this kind of backdoor happening again."
Good job not actually telling the name of the offending plugin in the article blurb there. 'A new severe bug in mozilla is allowing hooligans to steal your passwords. But we won't tell you which one until after the break!'
I have nothing compelling to say
Is there? Apple's review process doesn't demand source(and, given the review volume, there is Absolutely. No. Way they would be giving proper attention to detecting subtle malice, even if they did). The review process seems to be reasonably good at weeding out applications that crash horribly often enough that the reviewer will run into a crash, which blatantly violate the rules, which seem likely to be fodder for stories that will tarnish Apple's PR, or which "duplicate" some feature that exists or is on Apple's secret roadmap. It has also been rumored that they have some sort of static analysis tool to detect use of private APIs.
.NET one, and as they have announced they will do here).
Nothing in that process would detect any but the most blatantly unsubtle malice(and, given that reviews tend to occur fairly quickly, something as simple as recording the date of first run, and not doing anything evil until 1 month has passed would probably count as "subtle" for the purposes of this exercise).
If malice is detected by a third party, or by some after-the-fact spot-check; both Apple and Android have practically identical capabilities to "unpublish and remove" an application from any device that hasn't been divorced from the mothership. For that matter, Mozilla can also issue FF updates that disable add-ons(as they did a while back for that MS
>And since Opera is not open source, there is no way to be sure of that.
Sure there is, you can reverse-engineer it to see what it does. You know, just because all you have is the binary doesn't mean you've suddenly entered a magic land where nothing can be understood.
(I'm going to ignore "but can you trust your tools" asshatery)
Belief is the currency of delusion.
Not only that, but the author couldn't even use proper English in the addon description:
Given that, I hate to say that "people had it coming", but I figure people had ample warning that they were trying something that could be malicious.
Unless you go through all the code yourself, there's no way to be sure of anything.
you mean unless you go through the code, compile it yourself using a compiler whose code you've also audited and itself was not compiled by an unaudited compiler
No, I've seen it. I used to have a pretty decent email pen-pal thing going on with Ken about 10 years ago. He's a pretty cool dude. The point is, yes, even if you see the code, unless you have the code to the compiler and build it yourself, then you can't trust the binary. Basically, you can't trust anything you don't create from scratch. There could also be back-doors in ROM in the hardware. Which is why I go on to say how even if you do your own audit you can't actually trust anything. Either you won't understand everything, you'll have taken in too much information and miss something vital or,as per your example, the real root of the problem will be so obscured from view that it doesn't even matter what you're auditing.
It was a modified version of Tamper Data that the author alleged "many problems have been solved in this version".
In addition to modifying several existing files, the author added a file called tamperPost.js that very deliberately sends every form submission to a remote server. You can see some of the code of this on the Netcraft article in the summary (or or a direct link to the image)
When you see the image, you can see that it was obviously a deliberate attempt to steal credentials.
Source is ok ... but can you trust your compiler?
No sig today...
You could try Dillo.
Do what thou wilt shall be the whole of the Law
Jim: This source is fine.
:D
Jon: This is great, good work.
Jane: Clean and efficient, great addon.
*Create account: Jack*
Jack: Yeah, awesome stuff! Jim, Jon, and Jane are all correct.
*Create account: James*
James: I love this addon! No viruses here
Finally had enough. Come see us over at https://soylentnews.org/
TabGroups Manager. It's not the only extension of its kind, though: There's also Tree Style Tabs that gives you hierarchical, if space-intensive, tabs and Tab Kit, which apparently offers both functionalities in one package - however, I haven't tested the it and can't say how well it works.
In case you're a beta user: Tree Style Tabs says it's 4.0b1-compatible; TabGroups Manager doesn't but works apart from a cosmetic issue (the tab group bar appears below the tab bar instead of above it).
USE HOT GRITS WITH STATUE OF NATALIE PORTMAN (NAKED AND PETRIFIED)
Case in point: the Debian ssl fiasco, rendering all Debian as well as derivatives vulnerable to a simple attack for 2 years.
jwhois 74.220.219.77
[Querying whois.arin.net]
[whois.arin.net]
OrgName: Bluehost Inc.
OrgID: BLUEH-2
Address: 1958 South 950 East
City: Provo
StateProv: UT
PostalCode: 84606
Country: US
So has law enforcement been notified?