7145494
story
Comments: 208 +- IT: Zero-Day Vulnerabilities In Firefox Extensions on Friday November 20, @10:14AM
Posted
by
kdawson
on Friday November 20, @10:14AM
from the wild-in-the-playground dept.
from the wild-in-the-playground dept.
background: url(//a.fsdn.com/sd/topics/topicbug.gif); width:80px; height:62px;
bug
background: url(//a.fsdn.com/sd/topics/topicsecurity.gif); width:59px; height:78px;
security
background: url(//a.fsdn.com/sd/topics/topicmozilla.gif); width:80px; height:64px;
mozilla
background: url(//a.fsdn.com/sd/topics/topictech2.gif); width:60px; height:80px;
technology
An anonymous reader writes "Researchers have found several security holes in popular Firefox extensions that have an estimated total of 30 million downloads from AMO (the Addons Mozilla community site). Three 0-days were also released. Mozilla doesn't have a security model for extensions and Firefox fully trusts the code of the extensions. There are no security boundaries between extensions and, to make things even worse, an extension can silently modify another extension." The affected extensions are Sage version 1.4.3, InfoRSS 1.1.4.2, and Yoono 6.1.1 (and earlier versions). Clearly the problem is larger than just these three extensions.
Related Stories
Submission: Zero-Day Vulnerabilities In Firefox Extensions by Anonymous Coward
leverage, n.:
Even if someone doesn't care what the world thinks
about them, they always hope their mother doesn't find out.
All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2010 Geeknet, Inc.
Yep that's why I avoid extensions (Score:3, Informative)
Re: (Score:2, Insightful)
I completely agree, and I have been talking against the extension model for a long time. They are one of the main reasons why I use Opera instead of FF, as then I have only one vendor to introduce vulnerabilities, and it's the vendor I need to trust in any case to use the browser. Opera's inbuilt functionalities fortunately enable me to do the things for which I'd need to use extensions on FF.
Re: (Score:2)
The ad blocking functionality is limited in Opera, though. While its image-blocking setup works just fine, you can only block scripts based on the URL of the page being viewed, not by the URLs of each of the scripts themselves.
That said, I do use Opera at work since it's more responsive than Firefox.
Re: (Score:3, Informative)
Oh, advertising on /.'s comments?
Partnership Program
The Ad Muncher partnership program allows you to refer people to an address like:
http://youraccountname.admuncher.com/ [admuncher.com]
and receive 20% of all purchases later made by those people. For more information please visit the partnership program website.
"foropera" is just his partner alias. Sad.
Re: (Score:2)
You are correct that Opera's single vendor model is "safer" but the lack of extensions is a problem. If I see a youtube video I like, Opera has no way to grab it. Neither does it have an easy way to zoom-in on tiny photos. It's one of the reasons I've stayed with Firefox so I have the addon option if I need it.
Re: (Score:2)
That's what the widget model is for. There are a couple of widgets for grabbing video.
Not the problem (Score:2)
I have been talking against the extension model for a long time.
The problem is not with the extension model. It is with the Firefox implementation of the extension model. If done properly, the browser would not be exposing an API to the plugin that is capable of doing naughty things, nor would it be exposing an API for a plugin to alter another plugin. You build a clear but limited line of communication on established browser events, but everything else is concealed from the plugin.
Adblock will save you memory (Score:3)
It will also protect you overall, considering the amount of crap you find in web ads, even on supposedly reputable networks.
Re: (Score:3, Interesting)
Re: (Score:2)
A “minimum”, to me, would really be:
Adblock Plus
Download Statusbar
Video DownloadHelper
IE Tab
Screengrab
Tab Mix Plus
I don’t know how much bloat I’m adding by having them, but they all provide functionality that I really prefer not to do without. The only one that I’d be willing to waive is Screengrab, but it’s damn handy to have.
Re: (Score:3, Informative)
BULLSHIT.
Just to save anyone else the trouble...
That page claims to require 400 MB of memory in Firefox 3.5, supposedly due to memory leaks. Opening that page, and that page alone, in a clean Firefox session took only 50 MB of memory... compared to 47 MB to display about:blank.
GTFO with your FUD.
Re: (Score:3, Informative)
Check again. Try looking at how much memory firefox is allocating and not how much of it the operating system is currently keeping in memory. Most operating systems are smarter then the applications and flush any excess stupidity to the swap-file, so the ineffici
I have to say, I am depressed... (Score:2)
: (
FF is my favorite web browser because they always made sure to be more secure then IE. I guess when it comes to add-ons and extensions, its always a crap shoot, but I always thought FF was better at handling security for extensions then IE, I guess
I will have to go back to using linx now because I trust nothing else...
Life will be boring
Re:I have to say, I am depressed... (Score:5, Informative)
If you're that paranoid — use a virtual machine to browse the web and rollback to a trusted, clean snapshot a few times a day.
Parent
Re: (Score:3, Funny)
If you're that paranoid — use a virtual machine to browse the web and rollback to a trusted, clean snapshot a few times a day.
Yeah, but how do I know that the snapshot is clean? Or for that matter how do I know that my virtual machine hasn't been compromised?
They could have put a chip in my brain that makes my think that I'm browsing securely but in fact I'm not!
And who are you to be posting these things to make us feel like we can be secure? The sig of yours is French, no? But your user name looks Arabic. You could be a French secret agent with an Arabic code name - or, an Islamic Jihadist, hiding in France acting like a frien
Re: (Score:2)
Better yet, create a special user or two, one for anonymous browsing and one for your security relevant tasks (banking etc). The first one should be automatically reset after use (I use an Ubuntu guest account for that), the other one should have an encrypted home folder. At least make sure your browser is up to date if you use farlukar's scheme.
Re: (Score:3, Funny)
You can’t possibly be serious...
Re: (Score:2)
Linux is boring? Sacrilege! You get to read all those obscure docs and get into flamewars with developers. How is that not fun? ;-)
Which reminds me, what Linux needs is something like what I had on my old Amiga PC: A graphical way of interacting with the CLI so I don't have to remember all those obscure commands like "sudo -s -t /whatever"
Re: (Score:2)
There's really no excuse for Firefox to allow at least some of the more common security flaws - or at least allowing those flaws to cause problems.
First, sandboxing of extensions should limit what problems can be caused.
Second, a lot of errors are caused by the overflowing of buffers - a problem that could be limited by the use of stretchy buffers or bounds-checking malloc implementations. Or not allowing direct access to the heap.
Third, Firefox (and indeed all programs) should run on the principle of least
Re: (Score:2)
First, sandboxing of extensions should limit what problems can be caused.
While also limiting what functionality can be created.
Damned Activex Controls! (Score:3, Funny)
This is why Microsoft should turn off Activex Controls altogether.........oh wait........
Lobo? (Score:2)
There really needs to be Java (or other "managed" language based) based browser (like Lobo). Unfortunately Lobo is not (yet?) ready for prime time.
Re: (Score:2)
Re: (Score:2)
Garbage collection does not protect against *any* security breaches. It may even introduce a few security issues (e.g. files not closed since the destructor is not called in time). The lack of pointer arithmetic and addition of bounds checking, on the other hand, certainly does protect against many security breaches. It also enables a better component based design where one component cannot change the behavior of other components. E.g. in Lobo it seems that there is an API that enables plugins. If this API
Re: (Score:3, Informative)
I'm very much in favor of that. I would even like to help building a Java based browser (e.g. with a OSGi based plug-in system). But the thing is that these extensions use all kinds of technologies, but not C/C++ (as far as I could see). So if the browser was managed code you would have the same issues. Managed code helps against many bugs, but not against all.
Related link with more info on LWN (Score:2)
A quick Google search found this interesting article [lwn.net] from August of this year.
Go NoScript! (Score:2)
Re: (Score:2)
Wow, this is a big [citation needed], and if it’s true, were they suitably bitch-slapped for it?
It's about trust (Score:5, Insightful)
The problem is not necessarily with Firefox's security model - Firefox never claimed that plugins were secure. The problem is with perception. Users need to be aware that installing a plugin is tantamount to installing an application. You wouldn't willy-nilly install any old software on your computer. (Well, some people would, but hopefully not too many who frequent Slashdot.) You should take the same caution when installing a plugin.
The problem is that there is a perception that since Firefox is trusted then its plugins should be trusted. Especially those that are listed in Firefox's official plugin repository. Maybe some more verification is necessary before admitting these plugins, and definitely some more user education is required.
Re:It's about trust (Score:4, Insightful)
I'm in the 'supposed to know crowd' and I had this misconception for a long time. If I failed so quickly in this aspect, what hope is there for "ma and pa" and the rest of the fam'? Which makes the question simply -
What is easier to fix? Firefox's security model or most of the world's perception?
Parent
Re: (Score:3, Insightful)
Yawn... (Score:2)
This will get fixed in Firefox shortly & then it will be even more secure. What's the problem?
Either way, I'm so hooked on the 20 or so extensions that I use, that I'd never go back to anything else. IE is the pits. Chrome's speed just isn't a that big of a deal. Opera is ok, but the users are worse than Mac snobs.
color me unsurprised (Score:2)
I've always tried to keep a check on my addons for exactly this reason, the more code your running the more chance there is an exploitable bug in there somewhere. While steps can be taken to prevent an exploited addon doing damage, i don't think much can be done to prevent a buggy addon doing exactly what it sets out to do but wrongly.
The good news is that because all the functionality comes from addons they can be disabled and only affect users that want these features, so bob wanting to use his browser as
Privilege separation (Score:2)
It's lovely and fussy and all things nice. A world facing app like a web-browser should make use of it.
Really with the performance of current desktop computers and even netbooks there's no good reason not to stick
potentially vulnerable parts of your browser in a separate process and block it from accessing anything it does not
absolutely need to deal with.
Re: (Score:2)
Re: (Score:2, Informative)
Re: (Score:2)
Supposed you watched the Firefox commits when they do a security update (or reverse-engineered an IE patch) and discovered how to exploit a fixed vulnerability 2 days after the update. You could call that a 2-day vulnerability, and the small number of days means that a lot of people haven't patched yet.
So a zero-day vulnerability means that nobody's gotten a chance to patch yet, because the security hole is discovered before a patch is available.
Re: (Score:2)
Geez, I wonder where you could find that sort of information... [lmgtfy.com]
Re: (Score:3, Insightful)
Isn't the point that they have been seen now, if those holes where in closed binary addons (like coolaris preview) then they would never have been seen.
Re: (Score:2)
But, if the 'many eyes' were being honest with themselves, they should have cried foul at the insecure way extentions are handled before exploits were even known. It really isn't acceptible to give any random extention that much control over your software IMO.
Re: (Score:2)
The real trouble is that this is the way it’s designed, and it needs to stay this way.
Just like the real trouble with running arbitrary .exe files you download off the net is that .exe files are trusted a whole lot more than arbitrary files you download off the net ought to be.
Re: (Score:3, Informative)
Or use a clean firefox without extensions.
Of course, without extensions there isn't much that sets firefox apart from chrome except for the license. Some purists will prefer firefox for that reason but it's pretty much a coin toss.
Re: (Score:2)
Re: (Score:2)
Actually, not even the license, really. Just use Chromium, if you care.
Re: (Score:2)
As should extensions that retrieve data from responsible sites, like those extensions that alter google result pages. Assuming Google doesn't try to attack us, they should be fine.
I use to have an assload of extensions, but I've been really trying to restrict what I have for speed issues, so I'm not that worried.
That actually makes sense. (Score:2)
From TFS:
Mozilla doesn't have a security model for extensions and Firefox fully trusts the code of the extensions. There are no security boundaries between extensions and, to make things even worse, an extension can silently modify another extension.
Not one of these is true of Chrome extensions -- or at least, it is possible to develop extensions which are not fully trusted.
Re: (Score:2)
Re: (Score:2)
they weren't interested in using extensions
Give them AdBlock Plus and let them use it for a while, and I honestly doubt they’ll still feel that way.
Re: (Score:3, Informative)
Re: (Score:3, Funny)
I thought you were trolling, and then I read this:
I'll be switching my law firm back to IE and looking into a lawsuit against all FF contributors for their grossly negligent behavior.
Poe’s Law [rationalwiki.com] appears to be in full effect today.