Slashdot Mirror
Popular Firefox Add-Ons Open Millions To New Attack (slashgear.com)
An anonymous reader writes: Security researchers claim that NoScript and other popular Firefox add-on extensions are exposing millions of end users to a new type of vulnerability which, if exploited, can allow an attacker to execute malicious code and steal sensitive data. The vulnerability resides in the way Firefox extensions interact with each other. From a report on SlashGear, "The problem is that these extensions do not run sandboxed and are able to actually access data or functions from other extensions that are also enabled. This could mean, for example, that a malware masquerading as an add-on can access the functionality of one add-on to get access to system files or the ability of another add-on to redirect users to a certain web page, usually a phishing scam page. In the eyes of Mozilla's automated security checks, the devious add-on is blameless as it does nothing out of the ordinary." Firefox's VP of Product acknowledged the existence of the aforementioned vulnerability. "Because risks such as this one exist, we are evolving both our core product and our extensions platform to build in greater security. The new set of browser extension APIs that make up WebExtensions, which are available in Firefox today, are inherently more secure than traditional add-ons, and are not vulnerable to the particular attack outlined in the presentation at Black Hat Asia. As part of our electrolysis initiative -- our project to introduce multi-process architecture to Firefox later this year -- we will start to sandbox Firefox extensions so that they cannot share code."
According to the article you still need a malicious addon installed to exploit this. At which point you're boned anyway.
What a pile of crap. Heck, NoScript's author outlined it far more eloquently that I ever could: https://hackademix.net/2016/04/08/crossfud-an-analysis-of-inflated-research-and-sloppy-reporting/
are going to get the shaft by the 'security upgrade'.and mad deprecation of extensions.
You're trying to FUD addons because they aren't sandboxed? Who makes the framework the addons run on?
"We are evolving both our core product and our extensions platform to build in greater security."
I have bingo on my business lingo card. What do I get?
Darren Pauli from The Register broke the story last Monday after attending Black Hat Asia. If someone wants to read his story he can do it here: http://www.theregister.co.uk/2...
Malware can do malicious stuff. How is this news worthy?
Oh my god! Water is wet! Why didn't I listen!?
So it's the way Firefox sandboxes add-ons?.. the article makes it sound like NoScript & friends are the ones directly opening "millions to new attack.." when it just Firefox. So a malicious add-on has to be approved by Firefox's team and then downloaded by some sorry victim?
I don't think your average NoScript user is incompetent enough to download and install your "FreeToolbarFreeExtensionFree2016" add-on. I guess it makes a better story to paint NoScript and other vulnerable add-ons as the bad guys instead of Firefox itself.
So we can shove the whitelisted ads we extorted money from with AdBlock down your throat!
That's pretty much what popped into my head the second I saw NoScript mentioned in the lead.
I typed into the search bar in FF and it defaulted to Yahoo instead of Google. I uninstalled because I was afraid it might force me to play Dota instead of League of Legends, drink Pepsi instead of Coke and vote from Trump instead of Bernie. Crisis averted!
Hey Chicken Little, why are you still running firefox after all these years of Chrome kicking its arse?
Extensions can get the user's passwords, cookies, and history. They can make the browser do whatever they want including, but just as an example, intercept online banking sessions and make transactions in the background. Basically, they do whatever they want and this is by design.
What crap. Addons hosted on addons.mozilla.org, like NoScript, undergo manual review. I'm not claiming it's perfect but specifically naming NoScript like this shows the authors' claims have no credibility.
THIS isn't -> APK Hosts File Engine 9.0++ SR-4 32/64-bit http://www.bing.com/search?q=%...
Less power/cpu/ram+ IO use vs. local DNS servers + addons w/ less security issues vs. DNS + routers. Less complex vs firewalls (needing layered filtering drivers - hosts don't + firewalls block less used IP addresses, hosts block more used host-domain names) complimenting 'em. Antivirus = reactive. Hosts = FAR more proactive, blocking infection BEFORE you get it. Gets its data from 10 reputable security community sites.
APK
P.S. - Hosts get you more speed (hardcodes + adblocks) & faster vs. addons, security (vs. bad sites/dns security issues), reliability (vs. downed/poisoned dns), & anonymity (dns requestlogs/trackers) vs. other "so-called -solutions'" w/ what you natively have. Unlike Adblock/UBlock/Ghostery, hosts != blockable by ClarityRay/BlockIQ
Signed,
Janrain.com
ntv.io
googleadservices.com
and of course, the home of the thinly veiled advertisment,
Slashdot.fucking.org
Not looking forward to re-writing my plugin. I might not bother. It's been a fun project but Mozilla is asking me to do a lot of work without much support (so far anyway). They're gonna yank the XUL UI language without there being good replacements (HTML doesn't work right from an addon context because of the security constraints) and take away overlays (that let me access web content without a major mess of code).
That said their reasons aren't too bad and have nothing to do with a walled garden. The addon signing is there to give them a kill switch so that if somebody sells their addon to a malware company and it starts spewing adds they can revoke the signature and shut it down. I get a couple offers a year to "buy" my plugin and figured out pretty quick what they were after (my plugin's under the Moz license, so they could fork it or submit patches to mainline if they just wanted to pitch in).
As for the chromification, that's because they want to make it snappier by doing multi-process. And that means not letting my add on hold up the main thread. Honestly that's the biggest thing holding back my efforts to port to Chrome. It's a nightmare to deal with all the callbacks and such when you can't even hold up the thread for simple things like writing a few bytes of preferences to disk. You don't want to know what I had to do just to get that working... OTOH they're right that it'll make the browser seem snappier. But to be blunt I don't care. I've got an 4 year old A10-5800 and I've yet to be able to do anything in my single threaded Firefox addon that even slows down that old workhorse.
Oh, and yeah, the article is B.S.. Even in Chrome I can call out to executable files that run with the users permissions (basically root if you're a Windows User). It looked like click bait to me so I didn't RTFA.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
The new set of browser extension APIs that make up WebExtensions, which are available in Firefox today, are inherently more secure than traditional add-ons
They're also a lot less vulnerable to allowing Web users to control their browsing experience, which is the main impetus behind the change. Users were never supposed to get powerful extensions like AdBlock, NoScript, and Greasemonkey, so Mozilla is righting that wrong.
I also WIPED ARSTECHNICA OFF THE MAP in 2003-2006 @ Windows IT Pro easily - Jeremy Reimer's website? Removed by Shaw of Canada his ISP & hosting provider + he was put on a tracking ticket by them for email harassment... his "henchman" Jay Little said "I am an EXPERT on Exchange" which much to his dismay worked against him @ "The Memory Optimization Hoax" where I proved to them AND Dr. Mark Russinovich (former "co-worker" of mine @ Sunbelt where we retailed our wares there & he bitched I outsold his work, awww) that that technology unhalted & sped up frozen Exchange Servers USING MICROSOFT'S OWN DOCUMENTATION TO DO IT (clearmem.exe is the same tech, but not GUI, & I designed the 1st program of that nature in GUI no less).
Jay Little then trolled & stalked me to other websites where I annihilated him on ramdrives as well - he was banned + had his website @ CrystalTech removed by that hosting provider for libeling me.
FOOLS... you're the same kind of scum, doubtless from that shithole of known online losers.
APK
P.S.=> Bad move bringing up the DOLTS of Arstechnica - all they can do is "gossip" like old biddies behind my back, BUT OUTSIDE THEIR "PRIVATE PLAYPEN"? The results are QUITE different, see above, lol... apk
See subject: Right here https://science.slashdot.org/c... only he calls me "andy" for some odd reason & now he posts AC to try 'hide it' not remembering he calls me that.
* LOL - didn't LIKE having it shown how I HANDED YOU YOUR ASS BEFORE for your utter fuckups vs. myself (that's only a tiny sample too - I have TONS more bookmarked on you imbecile), did you, troll -> https://slashdot.org/comments.... ?
APK
P.S.=> You pitiful little COWARDLY fake name online using fuck - Look: IF you're going to play "I can hide" games (no, stupid, you can't - you're TOO fucking stupid & obviously have the intellect of a carrot, as well as the same memory span dimwit - YOU GAVE YOURSELF AWAY), learn how to do it right, ok?... apk
"wiped off the map"? arstechnica appears to be alive & thriving.
I got the best of arstechnica where it matters. Tech (which they claim to be good at? I know not). Outside their private playpen where they delete posts and alter posts of those that get the best of them, they are nothing. Heck I even caught MWNH & GOD usernames using the SAME EMAIL on both accounts there too.
* They're scumbags of the HIGHEST order... no questions asked, especially "GOITER MAN" (ugly fat fuck) PeterB/Dr. Pizza, Jeremy Reimer & his henchman (who reimer had to use he's so technically inept) Jay Little.
(Too bad they took a former "co-worker' of mine for the ride too in Dr. Mark Russinovich - as Microsoft's OWN DOCUMENTATION floored them ALL on how memory optimization tech unhalts Exchange Servers that are jammed up!)
APK
P.S.=> See subject - says it all! You can *TRY* to post "days later", trolling by UNIDENTIFIABLE AC POSTS too, thinking I won't see it so you can attempt to "get the last word" but, I'll be there CRUSHING YOU, again, as always... lol! apk
See subject: Until you were caught admitting it in links before this where you FINALLY admitted it was you https://slashdot.org/comments.... ?
* Coming along a week or so later trying to "cover your ass" with more lies doesn't cut it... you did yourself in LONG ago.
APK
P.S.=> You're the LITTLE BOY who cried wolf chump - you little DELUSIONAL FAKE NAME using trashbags online are ALL THE SAME - miserable bastards that don't have a thing to your name that others say is decent so you try spread your misery to others, trolling - you're trash, and you KNOW it (these posts merely expose it)... apk
See subject & https://slashdot.org/comments.... so time to make you "eat your words" scumbag:
My code went thru verification by Mr. Steven Burn of Malwarebytes "I've been asked to further clarify so for the record yes I've seen the code, and yes, it is safe" FROM http://forum.hosts-file.net/vi...
EACH company listed below HAD to rescind their false positives clearing my ware in 2012:
1.) McAfee/Intel
2.) ESET/NOD32
3.) Symantec/Norton
4.) Sophos
5.) Comodo
6.) ArcaVir
7.) ClamAV
8.) EmsiSoft
9.) Qihoo360
10.) Computer Associates
* Which Mr. Burn of Malwarebytes can substantiate as well if you need more, scumbag... you're pitiful.
APK
P.S.=> Proof it's safe by 57++ antivirus' too (as well as having malwarebytes' folks see the code to audit it or they wouldn't host it for me as they still do years later now)-> https://www.virustotal.com/en/... ... apk