Hijacking Firefox Via Insecure Add-Ons

An anonymous reader writes "Many makers of extensions or add-ons for Firefox are introducing ways for bad guys to hijack the Web browser, new research suggests. A great many add-ons are updated over insecure (non https://) connections, providing an avenue for attackers to replace the extension with an evil update. Google's add-ons are particularly vulnerable, because they update automatically without notifying the user. From the story: '[I]f an attacker were to hijack a public Wi-Fi hot spot at a coffeehouse or bookstore — a fairly trivial attack given the myriad free, point-and-click hacking tools available today — he could also intercept this update process and replace a Firefox add-on with a malicious one.'" Here is security researcher Chris Soghoian's description of the vulnerability and a video of a simulated takeover.

fud?

They mention the google plugin. Doesn't google offer almost all of its firefox offerings as IE search bars, desktop agents, and stuff like that. So why is the update structure for firefox different than, say, google search bar on IE?

Re:fud?

Any developer can create their own SSL Certificates for free. It's getting a certificate that's been signed by a vendor already in Firefox's whitelist that they are paying for. I would rather each developer create their own self-signed certificate, then I get to decide who to trust, not Verisign.

But using HTTPS wouldn't solve this problem either, because Verisign will sell a certificate to anyone with money. What should be happening is that developers sign their packages like they do for DEB and RPM package distros. That way you always know that you're getting your updates from the same person, no matter what your internet connection.

Re:fud?

Alternately, the Mozilla team could create their own signing certificate and add it to Firefox's whitelist; add-on developers could then get Mozilla-signed certificates for themselves. That would at least narrow the list a bit -- as you say, anyone can get a Verisign certificate, in part because there are just so many possible uses for one, but there should be few enough official Mozilla-signed add-on certificates to allow for some proper screening.

The certificates could also be used for authentication of the updates themselves, as you suggested.

Re:fud?

Unfortunately, doing that would sort of imply Mozilla would need to vouch for the extension developers (hey, they're letting them use a cert; that's what it's for, right?). As it is they barely have enough people to just try installing extensions before approving for the main site...

If it's just extension updates anyway, and extensions already act as a part of Firefox (i.e. they're not sandboxed... which they can't be in the current architecture)... They might as well just require SSL for updates, and people who don't use the Mozilla update service can just ship their own (self-signed) cert with the extension. Of course, some authors will still work around that by doing their own thing anyway. (There were, at one point, very, very insecure extensions that... load the whole toolbar at runtime using eval() by pulling data from unsecured sites.)

Re:fud?

The different is, everyone knows IE is insecure because of this. But everyone expects Firefox to be this totally secure, unhackable browser when it really isn't. The point is that the same things can be done on both browsers.

Another point is how this affects the Google Gears project that was in a previous post. Now you have cross platform hackability for an application that could potentially host your critical apps.

Don't trust public nets.

[I]f an attacker were to hijack a public Wi-Fi hot spot at a coffeehouse or bookstore -- a fairly trivial attack given the myriad free, point-and-click hacking tools available today -- he could also intercept this update process and replace a Firefox add-on with a malicious one.

This is why you shouldn't be performing anything as heavy as software updates over networks you don't totally trust, least of all the lash-ups in your average coffeehouse.

Re:Don't trust public nets.

This is why one of the problem is automatical updates, multiple untrusted sources of updates and update systems that allow those by default.

You mean like the Google Toolbar for IE and about a bazillion other ActiveX applets?

This problem is not Firefox-specific.

However, it's important to note that Firefox does not allow updates from untrusted sources by default. It comes configured with updates allowed only from addons.mozilla.org and updates.mozilla.org.

Furthermore, for those of you with notebooks/WiFi -- for God's sake, turn off Automatically check for Updates to: Firefox, Installed Add-Ons and Search Engines from the 'Updates' tab in the 'Advanced' options, especially if you're going to be spending time in a coffee bar. And before you say: "Well, that's in the Advanced section and we shouldn't expect normal people to have to edit those options" I say horsepuckey. If you're bright enough to be using Firefox instead of IE, you should be bright enough to know how to configure it in a secure manner.

Is this a firefox issue?

I would think this is an issue with the specific ad-on, not really Firefox. I guess you could say Firefox should only allow https traffic...

No shit!

This is why extensions should all be signed or have the update servers SSL cert hard-coded.

We can prevent attacks like this easily.

don't automatically update

How about setting your updates (yes, even for add-ons) to NOT download automatically? That way you can at least control when they download...

Forced automatic update is evil

...and what happened to Google's "Do no evil" slogan?

Then again these days Firefox itself pretty much forces you to update if you want to easily install extensions. What is with forcing people to download the plugins at install time? Last time I checked there was a plugin that allowed you to download to install later. That makes no sense. Why do I need a plugin to do this???

I use to have a stable browser with 1.0. With 1.5 and 2.0 I often have to restart the thing if I open lots of tabs and some of the pages don't respond, otherwise anything new I try to open doesn't respond. Firefox is still the best browser around at the moment, but it started off with so much more promise. It's become a bit of a pain to use as I've gotten use to the features (and other browsers have caught up), yet Firefox has gotten buggier.

Addons from addons.mozilla.org not vulnerable

The vast majority of the open source/hobbyist made Firefox extensions - those that are hosted at https://addons.mozilla.org/ [mozilla.org] - are not vulnerable to this attack. Users of popular Firefox extensions such as NoScript, Greasemonkey, and AdBlock Plus have nothing to worry about.

Since it's not mentioned in the summary, it's important to reiterate that this takes advantage of non-secure update mechanisms used by some addons. The addons.mozilla.org site will only host extensions that update from addons.mozilla.org through the built-in mechanism, which is not vulnerable to this attack. This is an extension-specific issue, and would most likely apply to any sort of addon for any software that doesn't verify security certificates.

Plug-in's are people too

Maybe if you spent more time with your plug-in's they wouldn't feel that way. Have some compassion!

Is it viable?

So ok, it is possible to do such an attack, but... is it viable enough as an attack vector? I mean, the attacker would have to sit 24/7 near an unsecure hotspot and/or an unsecure network to wait for a potential victim, and, as we know, firefox users aren't the majority, so this further narrows down the possibility of a successful attack. That's enough to call it improbable i think. Of course, since such an attack is possible, that can mean something, but, please, would anyone sit around coffee shops all day just to infect one person with spyware, when he could just, I dunno, send viruses or trojans through mail to computer illiterate people?

Firefox extensions are insecure

Right from day one I realized that the extensions provided by Firefox could become an security issue. I use very few of them. Scriptblock, Adblock and almost nothing else. And I disable auto updates. But on the other hand, Firefox is not so closely tied to the OS that they could take this breach, elevate privileges and take over a system, like ActiveX vulnerabilities.

Yes, one should be careful about the extensions, and use them carefully. And one should be careful about using WiFi in coffee shops and hotels. I am far more worried about our salesmen plugging in their lap top in some hotel network in Bangkok, pick up an infection and coming to corporate HQ and plug that laptop in our intranet, behind the firewall, in the trusted network. I have asked my sysadmin to set up a separate network for laptops that might be used outside our intranet that is not part of the trusted intra net.

Sign your addons, please..

How to sign a Firefox Extension [mercille.org] by Frederic Mercille.

It's not hard (for anyone who can make an add-on).

Stupid

This is like handing out your car keys and then end up blaming Audi for it.

Subject to the laws of physics

Q: When am I at risk?

A: When you use a public wireless network, an untrusted Internet connection, or a wireless home router with the default password set.

That means that this attack only works if the local area network is hijacked! Which reduces its danger substantially for the population at large as the huge majority of home connections is on its own link.

It is only a problem in the situation above (that are atypical nowadays) and in work or other large-network settings where it is possible to connect an untrusted computer to the network.

IT ALSO MEANS IT IS NOT FIREFOX SPECIFIC, as hijacking a connection can lead to many unpleasant things that may be as dangerous as that without requiring Firefox (ie grabbing passwords!).

As the user goes, so goes the browser

If the user is "insecure", then so too will the browser be. Anyone who would update software from a public wi-fi connection is in dire need of an education and asking for trouble. As far as extensions go, LESS IS MORE, as in beer: the browser will load faster, be less prone to memory leaks and XUL conflicts, and as the article suggests more secure to boot. Considerable skepticism should be given to any extension not found at the Mozilla site; if it were me I wouldn't install it, for the reasons above and unless it is indispensable and I was completely certain of the integrity of the author and site.

This is crypto 101

Nothing new here please move along.

HTTPS isn't necessarily secure..

HTTPS just makes it hard to eavesdrop. It doesn't mean the site you are getting your plugin from isn't a spoofed one with a self-signed cert or that your legitimate location for downloading the plugin hasn't been hacked. I guess all of www.download.com downloads are vulnerable since they're sent over http or ftp - which is suceptible to attacks! Also, if your DNS (or host file etc) is owned/poisoned then I'd think your firefox plugin is the least of your concerns. Give me a break.

HTTP versus HTTPS is _not_ the problem

This is not an issue of http versus https. The only way for Firefox add-on updates to be secure, or any software updates to be secure for that matter, is for the software to make sure that the update code has been signed by the developer before installing the update. This is software updating 101. Impossible to spoof without the developer's private key.

Back in my day ...

Funny, I remember a time when people ran away from Internet explorer because of the potential for some very powerful and useful plugin technology (ActiveX) to be used against their computers.

Everyone's websurfing saviour firefox is just as vulnerable it seems ... but everyone loves firefox and hates IE.

I think this big warped shift in people's perception happened about the time when all those pesky Javascript haters (all slashdot readers just a couple years ago) fell in love with Ajax ... as if it wasn't simply a cool way to use javascript with a new extention or two.

Ah yes. The good old days.

Relation

How is this related to FireFox only?

Doesn't the same apply for Windows Updates? A hijacked DNS can return a false address of a windows pdate server and have the user download vulns. instead of patches.

Re:Surely they're signed?

This is not about updates to Firefox - it's about updates for user-supplied add-ons.

Re:Now they're hijacking Firefox?!

Someone get Larry Niven and Jerry Pournelle on the case!

What about Craig Thomas?

Re:Goatse!

Well, maybe someone exploited the security hole mentioned in this article to add a "goatse extension" to some Firefox installations, which automatically sends a goatse comment to each visited Slashdot story. :-)