Slashdot Mirror
Popular Firefox Add-Ons Open Millions To New Attack (slashgear.com)
An anonymous reader writes: Security researchers claim that NoScript and other popular Firefox add-on extensions are exposing millions of end users to a new type of vulnerability which, if exploited, can allow an attacker to execute malicious code and steal sensitive data. The vulnerability resides in the way Firefox extensions interact with each other. From a report on SlashGear, "The problem is that these extensions do not run sandboxed and are able to actually access data or functions from other extensions that are also enabled. This could mean, for example, that a malware masquerading as an add-on can access the functionality of one add-on to get access to system files or the ability of another add-on to redirect users to a certain web page, usually a phishing scam page. In the eyes of Mozilla's automated security checks, the devious add-on is blameless as it does nothing out of the ordinary." Firefox's VP of Product acknowledged the existence of the aforementioned vulnerability. "Because risks such as this one exist, we are evolving both our core product and our extensions platform to build in greater security. The new set of browser extension APIs that make up WebExtensions, which are available in Firefox today, are inherently more secure than traditional add-ons, and are not vulnerable to the particular attack outlined in the presentation at Black Hat Asia. As part of our electrolysis initiative -- our project to introduce multi-process architecture to Firefox later this year -- we will start to sandbox Firefox extensions so that they cannot share code."
Extensions can get the user's passwords, cookies, and history. They can make the browser do whatever they want including, but just as an example, intercept online banking sessions and make transactions in the background. Basically, they do whatever they want and this is by design.
Not looking forward to re-writing my plugin. I might not bother. It's been a fun project but Mozilla is asking me to do a lot of work without much support (so far anyway). They're gonna yank the XUL UI language without there being good replacements (HTML doesn't work right from an addon context because of the security constraints) and take away overlays (that let me access web content without a major mess of code).
That said their reasons aren't too bad and have nothing to do with a walled garden. The addon signing is there to give them a kill switch so that if somebody sells their addon to a malware company and it starts spewing adds they can revoke the signature and shut it down. I get a couple offers a year to "buy" my plugin and figured out pretty quick what they were after (my plugin's under the Moz license, so they could fork it or submit patches to mainline if they just wanted to pitch in).
As for the chromification, that's because they want to make it snappier by doing multi-process. And that means not letting my add on hold up the main thread. Honestly that's the biggest thing holding back my efforts to port to Chrome. It's a nightmare to deal with all the callbacks and such when you can't even hold up the thread for simple things like writing a few bytes of preferences to disk. You don't want to know what I had to do just to get that working... OTOH they're right that it'll make the browser seem snappier. But to be blunt I don't care. I've got an 4 year old A10-5800 and I've yet to be able to do anything in my single threaded Firefox addon that even slows down that old workhorse.
Oh, and yeah, the article is B.S.. Even in Chrome I can call out to executable files that run with the users permissions (basically root if you're a Windows User). It looked like click bait to me so I didn't RTFA.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/