Popular Firefox Add-Ons Open Millions To New Attack (slashgear.com)

An anonymous reader writes: Security researchers claim that NoScript and other popular Firefox add-on extensions are exposing millions of end users to a new type of vulnerability which, if exploited, can allow an attacker to execute malicious code and steal sensitive data. The vulnerability resides in the way Firefox extensions interact with each other. From a report on SlashGear, "The problem is that these extensions do not run sandboxed and are able to actually access data or functions from other extensions that are also enabled. This could mean, for example, that a malware masquerading as an add-on can access the functionality of one add-on to get access to system files or the ability of another add-on to redirect users to a certain web page, usually a phishing scam page. In the eyes of Mozilla's automated security checks, the devious add-on is blameless as it does nothing out of the ordinary." Firefox's VP of Product acknowledged the existence of the aforementioned vulnerability. "Because risks such as this one exist, we are evolving both our core product and our extensions platform to build in greater security. The new set of browser extension APIs that make up WebExtensions, which are available in Firefox today, are inherently more secure than traditional add-ons, and are not vulnerable to the particular attack outlined in the presentation at Black Hat Asia. As part of our electrolysis initiative -- our project to introduce multi-process architecture to Firefox later this year -- we will start to sandbox Firefox extensions so that they cannot share code."

Comments

This article is alarmist rubbish.

[Anonymous Coward]

What a pile of crap. Heck, NoScript's author outlined it far more eloquently that I ever could: https://hackademix.net/2016/04/08/crossfud-an-analysis-of-inflated-research-and-sloppy-reporting/

Re:This article is alarmist rubbish.

[inode_buddha]

Clickable links get more traffic around here. Re-posting the link for you from my login acct because logins tend to have more cred.

Re:This article is alarmist rubbish.

[nmb3000]

This just in: Installing malware is bad for your computer. Film at 11.

What a pile of crap.

Agreed. Frankly this just looks like more FUD against browser addons and a lame attempt to justify Mozilla's looming walled garden and continued Chromification approach to Firefox addons. See also: slow death of the personal computer.