Become a fan of Slashdot on Facebook

 


Forgot your password?
Close
typodupeerror
×
Security Mozilla The Internet

Mozilla Developers Respond to Malware 429

Posted by CmdrTaco from the something-to-think-about dept.
An anonymous reader writes "Last week's well- publicised (and quickly fixed) security hole in Mozilla, Firefox and Thunderbird reminded the Slashdot faithful that Mozilla is not invincible and that it is now big enough for malware (virus and spyware) authors to target. MozillaZine has a short article on this topic, looking at the rise in attacks aimed at Mozilla and how the developers are responding."
This discussion has been archived. No new comments can be posted.

Mozilla Developers Respond to Malware More

Mozilla Developers Respond to Malware

Comments Filter:

  • not so fast of a fix (Score:3, Informative)

    by true_majik ( 588374 ) on Tuesday July 13, 2004 @08:47AM (#9685467)
    wasn't this bug known for a while and was just recently issued a fix for it?

    • Re:not so fast of a fix (Score:5, Informative)

      by it0 ( 567968 ) on Tuesday July 13, 2004 @08:55AM (#9685553)
      Wasn't it also that it was a shell bug in win2k/xp that actually only was an OS bug, that MS didn't fixed so they eventually did it?

    • Re:not so fast of a fix (Score:3, Informative)

      by ZZeta ( 743322 )

      Not really.

      A report had been out for a while detailing some improvements that could have prevented that vulnerability. However, the bug itself wasn't exploited until one day before the patch was released.

    • It was fixed. Fixed with bubblegum as an extension.

      The fix was also not easy to find. It was not (and still isn't) listed on the firefox homepage.

    • Re:not so fast of a fix (Score:5, Informative)

      by Diabolical ( 2110 ) on Tuesday July 13, 2004 @09:04AM (#9685654) Homepage
      Why is this modded interesting?

      First of all, it wasn't a bug at all, it was a problem in Windows' URI handler. Mozilla merely redirected unknown uri's to this handler as it was expected. The "bug" the op mentions was a discussion about whether this feature was safe or not.

      When it turned out that it wasn't safe, the Mozilla team was very quick to solve it.

      Very simple solution by the way, just turn the redirect off... now the user has to explicitly consent with this action instead of automagical launching of apps.

      By the way, this feature was a MS one, not Mozilla's idea. Recent bugs in the MS product family are actually the same. Just an exploit of the URI handling of Windows.

      • Re:not so fast of a fix (Score:5, Informative)

        by _xeno_ ( 155264 ) on Tuesday July 13, 2004 @11:05AM (#9687101) Homepage Journal
        As many people have mentioned, this bug was found two years ago.

        Since Mozilla doesn't like people on Slashdot being able to trash-talk their browser by linking to bug reports, you'll have to copy the links to actually visit them, but:

        2002-08-20 - http://bugzilla.mozilla.org/show_bug.cgi?id=163767 - root of all these bugs, Mozilla passes unknown protocols to Windows
        2002-08-20 - http://bugzilla.mozilla.org/show_bug.cgi?id=163648 - same bug, spefically could launch IE and allow the execution of VBScript (possibly in the local security zone)
        2002-10-03 - http://bugzilla.mozilla.org/show_bug.cgi?id=172498 - same bug, hcp: protocol could delete any file on your computer (wildcards allowed)
        2002-10-07 - http://bugzilla.mozilla.org/show_bug.cgi?id=173010 - requested a whitelist to avoid future instances of the same bug

        This bug has been known about for two years. It still hasn't been fixed. When SP2 adds the "delete:" protocol or similar, then Mozilla is going to be vulnerable to that, too. And it looks like the developers have decided not to bother fixing it.

        This isn't a triumph of open source - it's an example of how open source falls prey to exactly the same problems closed source does. Except publically, so you can point to these discussions to demonstrate that they knew about the issues for two years.

  • I'd still rather (Score:2, Interesting)

    by UltimateZer0 ( 610695 )
    I'd still rather use a marginally flawed Mozilla browser than a fully dysfunctional Intercourse Exploiter browser

    • Re:I'd still rather (Score:3, Insightful)

      by Anonymous Coward
      I know we all like to take jabs at Microsoft, but really people, we will take these comments more seriously if you don't make your little "witty" changes to the names. IE: no more "M$, Micro$oft, Internet Exploiter"..etc

      • Re:I'd still rather (Score:5, Funny)

        by BenBenBen ( 249969 ) on Tuesday July 13, 2004 @09:01AM (#9685609)
        How about "those greedy corporate cocksuckers with the strait-jacket EULA and dozens of politicians in their pocket"? M$ is just faster, I'm afraid...
    • Dude, the exploit is part of the Win32 API. Why do you think shell exploits were discovered in other software?

    • Re:I'd still rather (Score:3, Interesting)

      by prell ( 584580 )
      I think that this will be a very interesting case study in the capabilities of the OSS community to create secure, reliable, and ultimately "better" (you be the judge) software than those in the Cathedral. While Linux is popular, it is isolated. That is, Mozilla is a crossover OSS product, as this "Windows-only" exploit shows.

      I'd like to see Mozilla products increase in popularity and press coverage, so we can have something substantial to point to to say "that is how well OSS can work."

  • Mozilla "innovation" reaches new low? (Score:5, Insightful)

    by Allen Zadr ( 767458 ) * <Allen@Zadr.gmail@com> on Tuesday July 13, 2004 @08:48AM (#9685472) Journal

    I'm quite happy to see that the Mozilla team is pro-active in fixing the bugs that could allow MalWare to install unchecked.

    Yet, a base Mozilla 1.7 downloaded right after release will have this issue for a very long time. This situation is worse, in one big way, than the Internet Explorer issues; Mozilla users 'feel' safe. Non-techies that use Mozilla assume it's 'safe' because a geek once told them that this is the case.

    I've been an Open Source supporter for quite a long while, but the days of relative desktop safety for F/OSS cross-over users is coming to a close.

    And, I'm probably not the only one who "shivers", when reading, "... almost a carbon copy of the new Internet Explorer Information Bar ..."

    There's no way to defend that.

    • Mozilla turning into "Carbon Copy" of IE (Score:2, Interesting)

      by Anonymous Coward
      If that's not good enough... just install the Internet Explorer skin [zzxc.net] for firefox.

    • Re:Mozilla "innovation" reaches new low? (Score:5, Funny)

      by TopShelf ( 92521 ) on Tuesday July 13, 2004 @08:56AM (#9685561) Homepage Journal
      Non-techies that use Mozilla assume it's 'safe' because a geek once told them that this is the case.

      For such users, they need to be taught that there is no such thing as truly "safe" browsing. The only "safe" choice is abstinence.

      *then watch as they slip a condom over their mouse and hope for the best*

    • Re:Mozilla "innovation" reaches new low? (Score:4, Insightful)

      by T-Keith ( 782767 ) on Tuesday July 13, 2004 @08:57AM (#9685565)
      "Non-techies that use Mozilla assume it's 'safe' because a geek once told them that this is the case." Non-techies are more likely to assume that the "Internet" that came with their computer is safe too. Which they really should. Unfortunately this is not the case.

    • Re:Mozilla "innovation" reaches new low? (Score:5, Insightful)

      by Blindman ( 36862 ) on Tuesday July 13, 2004 @08:57AM (#9685572) Journal
      No software package can fix ignorance. Mozilla makes ignorance a little cheaper. Microsoft is trying to do the same with changing the defaults in Service Pack 2. However, the real problem won't be fixed as long as people choose not to think.

      • Ignorant developers (Score:5, Interesting)

        by gr8_phk ( 621180 ) on Tuesday July 13, 2004 @09:52AM (#9686156)
        The software should not allow a web site to initiate any action on the client side. Security 101 here people. Opening files using the default application is pushing the limit. Allowing the site to specify what you run was just plain stupid. The Mozilla team should not just disable that feature by default, but should remove it entirely. There are work arounds for the small fraction of users who have a legitimate use for that.

        IMHO, desktops (GNOME, KDE) are crossing the line and even X itself has some "features" that may lead to exploits if developers aren't careful - remember the window manager is just a program that can actually control other programs on the machine. No application should ever tell another what to do based on untrusted data, that's reserved for the user (clicking a link doesn't count as approval - the link may not do what it claims).

        When you add a feature, consider what a criminal might use it for and who the burden will land on to prevent it. With shell: the burden lands on any application you might possibly launch and that's just unacceptable. With a window manager, consider that I may want to offer my display server to some untrusted application (airline reservation system) running on a remote machine - great possibilities and a great security risk. Because so much is accessible through X we don't use it that way.

        I'm rambling now trying to gather too many thoughts in too little time.

    • I'm quite happy to see that the Mozilla team is pro-active in fixing the bugs that could allow MalWare to install unchecked.

      The Mozilla team isn't proactive on security issues. The dangers of Windows URL schemes have been known to the Mozilla team since mid-2002:

      http://bugzilla.mozilla.org/show_bug.cgi?id=163767 [mozilla.org]

      If they had implemented a whitelist of known-good URL schemes back then, it would have been a proactive security measure. Fixing things after they have been announced on some mailing list (
      • If they had implemented a whitelist of known-good URL schemes back then, it would have been a proactive security measure.

        And it would have broken a large number of programs. What's your point?

      • Re:Mozilla "innovation" reaches new low? (Score:5, Insightful)

        by t1m0r4n ( 310230 ) on Tuesday July 13, 2004 @09:52AM (#9686158) Homepage Journal

        The Mozilla team isn't proactive on security issues. The dangers of Windows URL schemes have been known to the Mozilla team since mid-2002

        I said last time around I said if I heard this comment one more time I would scream, and, well, I just scared my poor dog. Who the heck is this "Mozilla team" you are insulting? Last time I checked mozilla source code was readily available to you. Patch it. Done. If someone "official" doesn't want to include it in the nightly build, too bad. Put up a little website at geocities.com/securemozilla and post a message on your geek board of choice.

        Such is the burden of open source. You can't complain about the coding choice of another person if you are lazy and/or stupid. I don't see it as a failure of the Mozilla team, but a failure of Windows users who were too lame to fix it themselves.

        • Re:Mozilla "innovation" reaches new low? (Score:5, Insightful)

          by ajs ( 35943 ) <ajs@ajs . c om> on Tuesday July 13, 2004 @10:03AM (#9686281) Homepage Journal
          Actually, you should look at the link (though you have to copy/paste it because Bugzilla is refusing connections that have a Slashdot URL as referer). The bug was reported by someone who wrote, tested and bug-fixed a patch. Two years later (TWO YEARS) someone from the Mozilla Team (and by that, I mean people with control over the released source) said that they thought it wasn't a good idea. A few months later the exploits were "discovered".

          This whole incident is a huge black-eye for Open Source's theory of many eyes. The eyes saw. The fingers fixed. The brain ignored.

          PS: I am still an open source advocate and I still believe in the many-eyes theory of security, but this incident shows that we cannot be abolutely confident in that theory producing better results that proprietary solutions.

    • Re:Mozilla "innovation" reaches new low? (Score:5, Insightful)

      by sigaar ( 733777 ) on Tuesday July 13, 2004 @09:04AM (#9685655)
      "This situation is worse, in one big way, than the Internet Explorer issues; Mozilla users 'feel' safe. Non-techies that use Mozilla assume it's 'safe' because a geek once told them that this is the case."

      Non-techies using IE, like my mother, feel safe too, just because Microsoft said it's OK. Such a big company with so many users can't be wrong, after all.

      Despite the fact that her computer's gotten infected a couple of times already. Despite the fact that she refuses to do her Windows update (it takes so damn long over the modem). Despite the fact that her son (me) who works for an IT security company, have told her repeatedly not to use IE, and have made sure that she always has the latest Mozilla/FireFox and Opera installed.

      On a slightly different but related topic. I am not a programmer, so this is just a guess. The same vulnerability that was discovered in Firefox and Mozilla, was discovered in IE too. Would the fact the vulnerability in Firefox and Mozilla only affected the Windows 2000/XP versions, and not the ones on other platforms, suggest that it might have been a vulnerability in windows rather than Mozilla? Sure, preventitive maintainance on Mozilla's side would prevent it from being expoited.

      I just find it to be a bit like mopping the floor because the bathtub is overflowing, instead of closing the tap.
      • Do like I do. Change the Internet Explorer link to launch FireFox. Most people don't notice (or care enough) that it isn't Internet Explorer. Keep in mind that the switch is very much a physiological thing. They're used to hitting that IE button, and just don't feel the same if they don't.

        Also, make sure that Flash, Java, RealPlayer, and other plugins are installed. You may hate them, but your mother is going to hate you if they don't work.

      • Re:Mozilla "innovation" reaches new low? (Score:5, Interesting)

        by Finuvir ( 596566 ) <rparle@@@soylentred...net> on Tuesday July 13, 2004 @09:26AM (#9685850) Homepage

        Would the fact the vulnerability in Firefox and Mozilla only affected the Windows 2000/XP versions, and not the ones on other platforms, suggest that it might have been a vulnerability in windows rather than Mozilla?

        Yes. The flaw was that Mozilla handled the protocols it knew and passed all unknown protocols to the OS to handle. Windows was (is) all too happy to launch programs with the shell protocol.

    • Yet, a base Mozilla 1.7 downloaded right after release will have this issue for a very long time

      NO, because, Firefox (and I think also Mozilla) now have a function to automatically dowload new versions or security fixes.

      Also please note the steps on had to take to get infected by malware before the fix (whitelisting domains):

      reminded the Slashdot faithful that Mozilla is not invincible and that it is now big enough for malware (virus and spyware)

      I would like to point out that this is slightly mis

      • Re:Mozilla "innovation" reaches new low? (Score:5, Informative)

        by That's Unpossible! ( 722232 ) * on Tuesday July 13, 2004 @09:24AM (#9685832)
        I would like to point out that this is slightly misleading (as it implies Mozilla had a security flaw before the fix), because, even before the whitelist fix was added, you had to do the following to get infected by any malware...

        I don't think this is true. The specific exploit in XP allows shell: protocol links to run arbitrary code if crafted properly. Mozilla was passing these links right on to the OS.

        I think you are confusing this bug with the idea that people can install malware via XPI.

  • the interesting thing (Score:5, Insightful)

    by koan ( 80826 ) on Tuesday July 13, 2004 @08:48AM (#9685473)
    Will be how fast the community can fix these types of issues compared to M$'s response time.
    I think we all know that whatever is the popular software is what will be targeted so the big difference maybe how it's responded to.

  • IE (Score:5, Informative)

    by shackma2 ( 685062 ) on Tuesday July 13, 2004 @08:48AM (#9685476)
    It wasnt just Mozilla Firefox and the like.

    Some microsoft products were affected also. [infoworld.com]

  • missiles (Score:5, Funny)

    by foxhound01 ( 661872 ) on Tuesday July 13, 2004 @08:50AM (#9685494)
    this is precisely the reason the Firefox [imdb.com] was equipped with thought guided missiles...to destroy unseen threats.

  • Quickly (Score:5, Interesting)

    by L-s-L69 ( 700599 ) on Tuesday July 13, 2004 @08:51AM (#9685497)
    The large developer base responds quickly - gets things patched and released.

    This coupled with the fact moz/firefox is already more secure than IE means Moz users are not invunerable but we have a better chance than the IE crowd.

  • The solution is simple (Score:2, Interesting)

    by Anonymous Coward
    If moz gets too bad, I'll just switch to Opera. What we need in the long run, is to have a totally new browser developed about 6 times a year. If everyone switches browsers every other month, these malware stooges will be put in their place.

  • Targeting Flaws (Score:4, Interesting)

    by feilkin ( 790260 ) on Tuesday July 13, 2004 @08:51AM (#9685503)
    I think that there is a major disadvantage when it comes to attacking the Mozilla series of applications -- they are all on multiple operating systems. It's worth noting that this bug was only found on Windows systems operating Mozilla, and while this may be the largest base of people using the program, I get the impression that a lot Linux and OSX folks are using them as well. Yet everyone is so eager to jump on Mozilla for having a bug, even though it only affected one of the operating systems. I think that's a pretty good track record, espically with the speed that it's been fixed in. I'd like to see that with IE.

  • OSS vs non-OSS (Score:4, Insightful)

    by siplus ( 796514 ) on Tuesday July 13, 2004 @08:53AM (#9685524) Homepage
    if people are going to start targetting mozilla for exploits, then we can see the true difference between security/stability of OSS vs proprietary products. i have no doubt that mozilla will come out in the lead, because in being open source when there IS a problem, it is fixed in a timely manner :)
    • We already have that with Apache v.s. IIS. Consider that Apache is way more popular than IIS, so you can easily take a look at something like that as an example of OSS v.s. non-OSS.

      However, you do have a point that Mozilla will allow us to look at the consumer/user end of things and see how this plays out.

  • Why should installing plugins be easy? (Score:5, Insightful)

    by Neil Watson ( 60859 ) on Tuesday July 13, 2004 @08:53AM (#9685526) Homepage
    Apart from initial install, how often does one need to install a browser plugin? Why should it be made easy? What kind of legitimate website needs a plugin to browse it?

    There is a fine line between easy to use and easy to exploit. Let's not repeat the mistakes of others.

  • It was a Windows flaw, not a Mozilla flaw (Score:5, Insightful)

    by dtjohnson ( 102237 ) on Tuesday July 13, 2004 @08:55AM (#9685541)
    It was widely reported that a flaw was found in 'Mozilla' which was not correct. The flaw was in the Shell: protocol on Windows. That's why the alleged 'flaw' in Mozilla did not exist on non-Windows platforms. The only 'flaw' in Mozilla was its failure to block the use of the shell: stuff on Windows (which the patch now does).
    • If you develop for Windows, you have to develop for it as it is. That is, you have to expect that things aren't secure in the way you like them to be or don't work the way you might like them to work.

      The attitude Mozilla should have that they should only call library and OS interfaces on each OS that they can have a reasonable expectation to be safe and secure in practice. That is, they need to orient themselves not only based on what they think an API ought to do or how the API ought to behave, but what
  • From the earlier slashdot story:

    "Note that this only affects users of Mozilla and Firefox on Windows XP or Windows 2000."

    Actually I think the biggest marketing achievement in the last 10 years was Microsoft convincing the public that Win2000/XP is more secure than Win9x.

    • So true, it was the Ballmer contention that they were "betting the company" on Windows 2000 and then releasing it with security and stability issues that pretty much squandered what faith I had left in MS. I firmly believe that if the codebase of Windows ME had been even slightly more stable than it was that it would still be in favor. It was better looking than 9x, supported newer hardware features better and was still less bloated than XP by a long shot, too bad it suffered from so many stability issues f

    • Re:Just to clear some things up... (Score:5, Insightful)

      by RonnyJ ( 651856 ) on Tuesday July 13, 2004 @10:02AM (#9686271)
      Actually I think the biggest marketing achievement in the last 10 years was Microsoft convincing the public that Win2000/XP is more secure than Win9x.

      Are you serious? You're saying that an operating system that let anybody use it by simply selecting 'Cancel' on the login screen (if even enabled), is more secure than Windows 2000/XP. Madness.

    • It has filesystem security and true protected memory. Whatever else you say about it, it is more secure than Win9x.

      It's also much more reliable, and on higher end systems, seems much faster than Win9x, unless you are badly starved for memory (say, less than 256MB.)

  • Rest assured, if Firefox ever does make it big time, ~20-30% of browsers, malware writers WILL exploit any hole they can find.

    Hopefully the developers will be quick enough to fix it, but will users be sharp enough to get the patches. I think automatic updates for firefox are what is needed to ensure users have less to worry about. I know myself that the patch for the shell exploit was not a simple matter of clicking search for updates, as the update program times 0out after 2 secs.

    Firefox won't be immune to the legions of spammers, crackers, marketers and pornographers which have already begun to exploit it. With some kind of autoinstaller/updater or a faster update cycle users could be confident that whatever new tricks the spammers come up with, the fixes will be prompt. Hopefully anyway.

    I know autoinstallers aren't in vouge, for many good reasons. But if it's just for one, largely selfcontained program, would it really be so bad.

    Maybe at the very least mozilla could have a list of critical, anti-spam and other update categories. Or would that just confuse people
    • Someone could implement that through an extension, couldn't they? I didn't actually download 0.9.2 to fix it, I just installed an extension which fixes the vulnerability. Now if they could just run some extensions the moment you install them they'd be ahead of IE (no browser restart). I'll admit this would be minor but it's a real gain as far as the mental picture of the program.
    • Rest assured, if Firefox ever does make it big time, ~20-30% of browsers, malware writers WILL exploit any hole they can find.

      Am I the only one who simply got fed up with these kinds of arguments over the years ? :P M$ and the Win crowd should one hell of a day understand that this argument does NOT justify a bad and slow development and update process.

      It's _because_ the much more larger user base that they should pay much more attention on this matter. Not just in talks and speeches, but (at least one d

  • The price of success (Score:5, Interesting)

    by twbecker ( 315312 ) on Tuesday July 13, 2004 @08:56AM (#9685557)
    These exploits are just the price of success in the browser business. I have no doubt that Mozilla products are more secure than IE, but even if significant holes are found, I'll put the turnaround time for the fix up against MS track record anyday.

    • Re:The price of success (Score:3, Insightful)

      by pjrc ( 134994 )
      By your logic, Apache webservers would be paying the "price of success". In reality, it is Microsoft IIS servers that are suffering security breaches, despite the fact that IIS runs far fewer websites than Apache.

  • my bad.... (Score:2, Funny)

    by eegad ( 588763 )
    I thought Mozilla WAS the response to malware.

  • Spoofing (Score:4, Interesting)

    by POWRSURG ( 755318 ) on Tuesday July 13, 2004 @08:58AM (#9685575) Homepage

    Now let us hope that there are no spoofing mechanisms discovered that result in users believing they're on one of the whitelisted sites to allow such installations. As someone on that board had already pointed out, allowing all of mozilla.org as a means to install code can result in people taking advantage of bugzilla.mozilla.org and ftp.mozilla.org.

    You know, I really appreciate hearing from developers who recognize a potential threat and are informing us how they are working to fight the problem. Their method might be taking a page out of Internet Explorer for SP2, but if it works than it's good.

  • Malware (Score:5, Interesting)

    by mfh ( 56 ) on Tuesday July 13, 2004 @08:58AM (#9685581) Homepage Journal
    This story comes at a perfect time for me. I'm a Mozilla diehard, and I just ran Ad Aware 6 to find that some malware bypassed security (even Norton Internet Security) to install itself. One of the progs I found was malware called Winfavorites [symantec.com], and although Symantec says this is detectable malware, I had run Norton Antivirus and it went undetected. Looks like it's smartest to run a combination of programs just in case!

    I might add that I don't blame Mozilla for it. I blame the programmers who sell their soul for cash to these unscrupulous companies only looking to profit while hurting the systems they populate.

  • This will be the true test. (Score:5, Interesting)

    by Schezar ( 249629 ) on Tuesday July 13, 2004 @08:59AM (#9685585) Homepage Journal
    As Mozilla browsers become more popular, and thus face credible threats on the scale that IE has been facing, this may well be the breaking point for OSS in general.

    Business types are afraid of OSS mostly for the fact that it's "unsupported." To them, support doesn't mean having developers on hand to fix problems so much as it does having someone to blame when things go wrong. As long as someone else is fiscally responsible for their technology problems, their customers/shareholders are happy.

    They won't admit to believing the above, but it's true: I have first hand experience with it. They'll say that they need the support to protect them from threats and vulnerabilities. They cite Microsoft's patches and updates as proof that the support is useful. They claim that OSS is only safer because no one targets it, and thus the threats aren't as severe. They don't believe any of that, but it's what they use to rationalize their decisions.

    If Mozilla continually and expertly deals with these vulnerabilities, that argument will fall flat. They'll either have to admit just what they're -actually- paying for when they claim "support," or they'll at least begin to look into OSS alternatives.

    At least, that's what I hope ^_~

    • Re:This will be the true test. (Score:4, Insightful)

      by riley ( 36484 ) on Tuesday July 13, 2004 @09:27AM (#9685866)
      Business types are afraid of OSS mostly for the fact that it's "unsupported." To them, support doesn't mean having developers on hand to fix problems so much as it does having someone to blame when things go wrong. As long as someone else is fiscally responsible for their technology problems, their customers/shareholders are happy.

      Here's the hole in that theory: no one has ever successfully sued Microsoft for technology problems with MS products. Worms, viruses, etc have all cost reported billions of dollars (real cost unknown, but obviously significant), yet MS does not bear the consequences of those losses.

      The question of whether it is possible for us (as a species) to build completely error free systems (thus making it feasable to hold vendors responsible for mistakes) is for another time. The possibility that software is more abstract and thus more complex for humans than any other form of commercial engineering maybe the case.

      This is not to let MS off the hook. In my dealings with them, the company in the past has tended to let the marketers write the program specifications, often over the objections of actual engineers. The difference in perspective between a salesperson and an engineer is significant with regards to long term security and reliability.

    • If I'm not reading too much into your post, you're basically saying more than that Microsoft products have become an alibi with many stockholders, board members, and customers. Your use of the phrase "fiscally responsible" seems to suggest it's a legal strategy.

      I can see how CIO's and such could pick Microsoft so that they could say:

      1. Don't fire me, Oh boardmembers, I went with the industry leader.
      2. Don't blame us, Oh customers, blame Microsoft.

      But "someone else is fiscally responsible" sounds like mo

  • Bad example (Score:4, Insightful)

    by gpinzone ( 531794 ) on Tuesday July 13, 2004 @08:59AM (#9685595) Homepage Journal
    The shell: vulnerability is a bad example. Other things like buffer overflows are pertinant, but will not support the idea that open source is any more or less prone to attack. Bugs occur in any software.

    What has not yet occured is a plug-in or extension for Mozilla/Firefox that is similar to the kinds of spyware/malware that has been developed for IE. If the "AOL crowd" starts dumpping IE for Mozilla/Firefox, spyware/malware authors will have a reason to invest their time and money into developing such applications. Seriously, how will the Mozilla team ensure somone doesn't intentionally install an extension because some website told the user that it will "accelerate their web experience for free?"
    • Malware/Spyware isn't anything other than software or a plugin for software. It's a program. So if a user wishes to install software, nothing the OS can do will fix that.

      Linux might be secure by design, but someone with software to install and root access can still install malware or spyware.

      However, as far as your question is concerned in how Mozilla will avert people from doing this, the answer is in the article. It's called a whitelist.

  • Misleading (Score:5, Informative)

    by sepluv ( 641107 ) <blakesleyNO@SPAMgmail.com> on Tuesday July 13, 2004 @09:00AM (#9685607)
    reminded the Slashdot faithful that Mozilla is not invincible and that it is now big enough for malware (virus and spyware)
    I would like to point out that this is slightly misleading (as it implies Mozilla had a security flaw before the fix), because, even before the whitelist fix was added, you had to do the following to get infected by any malware:
    1. Enable Javascript
    2. Enable install from XPI locally and globally
    3. Click on a Javascript link on a WWW page (which would be shown in status bar) (N.B. Mozilla does not execute XPI-related JS automatically--the user must have clicked the link)
    4. Wait a few seconds while watching a very large uncancellable dialog box saying "A website is requesting permission to install the following item", giving full details of the program it is installing (including its signatures in big red letters, its name and its URI), and saying in big bold letters, "Malicious software can damage your computer or violate your privacy. You can only install software from source you can trust."
    5. After waiting a few seconds you, you then had to press a button labelled "install now".
    I'm guessing that even some ex-MSIE users might not go through all that on the request of a malicious WWW site they have found.

    I digress.

    • Re:Misleading (Score:5, Insightful)

      by Paulrothrock ( 685079 ) on Tuesday July 13, 2004 @09:10AM (#9685717) Homepage Journal
      I'm guessing that even some ex-MSIE users might not go through all that on the request of a malicious WWW site they have found.

      That depends. Does the link promise free pr0n, money, or chocolate? Or does the link say it will find and destroy malware or pr0n on your system.

      Social engineering is the most effective exploit of any system.

    • Re:Misleading (Score:3, Interesting)

      by Tim C ( 15259 )
      As of at least Mozilla 1.6, steps 1 and 2 are not necessary as they're on by default, and step 3 is not necessary as I have personally seen pages use the onLoad js handler to launch the installation dialogue. I also don't recall having to wait for the dialogue; I seem to remember the install/cancel buttons being available immediately.

      I'm guessing that even some ex-MSIE users might not go through all that on the request of a malicious WWW site they have found.

      Well, I've seen someone with a couple of deca

  • But who will upgrade? (Score:5, Interesting)

    by Scarblac ( 122480 ) <slashdot@gerlich.nl> on Tuesday July 13, 2004 @09:02AM (#9685620) Homepage

    Last week, right before this news, there was news that a lot of people switched to FireFox because of the vulnerabilities in IE.

    Who's going to tell them now that they should upgrade their FireFox to the fixed version, because there was a problem?

    It doesn't really matter that it was fixed quickly. The people that didn't install updates for IE, won't install the updates for their brand new FireFox either. Sadly.

  • How will they respond? (Score:3, Interesting)

    by ThisIsFred ( 705426 ) on Tuesday July 13, 2004 @09:04AM (#9685647) Journal
    I can't speak for them, but if I were the public relations for the project, I'd say, "we're going to trust Windows' protocol handlers a lot less." Just like how Windows' flawed design makes it dangerous to use Windows' shell functions to decide what to do with various filetypes, the Moz devs are going to have to include special testing procedures for their Windows releases to determine how underlying design flaws can make a third-party product vulnerable.

    I think Mozilla Project got a bum rap on this one. When an XP service pack fixes the same issue in all effected products (including IE and Word), I'm inclined to think that it was a Windows problem to begin with.
  • Clearly, those in the press who live in the pocket of the redmondians would have us believe that this is a good reason not to stop using I.E. After all, you may go to all the trouble of switching and still not have nirvana.

    Well, even if the beta versions of Mozilla aren't instant nirvana; they're already more secure, more stable, faster, smaller, and better looking.

    The mozilla browser also comes with better karma, and I've heard some people have regrown hair, enlarged body parts, and improved their sex

  • Firefox targeted? (Score:4, Interesting)

    by jfengel ( 409917 ) on Tuesday July 13, 2004 @09:08AM (#9685703) Homepage Journal
    The flaw certainly affected Firefox, but given that it also affected things like Microsoft Word, was Firefox itself necessarily targeted? That is, did the guy who came up with the exploit have Firefox in mind?

    The difference may seem irrelevant, but if Firefox wasn't targeted, it means that the evil will of the cracker community has not yet been turned to finding the bugs in Firefox the way that they have in IE. I'm pretty sure Firefox will fare better than IE did, but when you've got so much effort aimed at a product, and with the source available, they will find any easily-findable bugs.

    If they did target Firefox, then we begin to have some idea how many security bugs there really are in Firefox, by seeing the rate at which new exploits appear. Thus far, the answer is "quite slow", and I hope that's because people are targeting it and failing.

  • Run the patch (Score:3, Funny)

    by SoopahMan ( 706062 ) on Tuesday July 13, 2004 @09:10AM (#9685715)
    You just have to love how easy it is to install this Mozilla patch [mozilla.org]. What IE fix works this simply? Open page. Click link. If this were IE, there would be one, minor, takes-forever step now: Restart computer.

  • more IE swiss cheese (Score:3, Informative)

    by Ari_Haviv ( 796424 ) on Tuesday July 13, 2004 @09:14AM (#9685752) Homepage
    see http://secunia.com/advisories/12048/

  • Now THAT is quick! (Score:3, Interesting)

    by choas ( 102419 ) on Tuesday July 13, 2004 @09:16AM (#9685765)
    Whole of mozilla.org?
    by dave532

    Tuesday July 13th, 2004 1:30 AM

    "Mozilla Firefox 0.9 just allows update.mozilla.org (though this has since being expanded to the whole of mozilla.org)."

    Allowing the whole of mozilla.org is a bad idea because bugzilla.mozilla.org can allow anyone to upload a malicious XPI
    To:

    Re: Whole of mozilla.org?
    by Ben_Goodger

    Tuesday July 13th, 2004 3:44 AM

    good point. fixed.

  • Mozilla exploit? (Score:3, Informative)

    by panamahank ( 233338 ) on Tuesday July 13, 2004 @09:23AM (#9685816)
    Whoa! If this was a Mozilla exploit, does that mean I have to patch my Linux version?

  • I was hoping they would do something about the protocol problem, and default to not allowing unknown or unexpected OS-handled protocols or helper applications.

    This new dialog would be a great place to add

    '$webpage is attempting to display an image from exploit:format+c:\'

    so that by default new registered protocols and helper applications would be blocked rather than permitted until the user explicitly whitelists them.

    Helper apps, too:

    'Should $file.pdf be opened with the Adobe Acrobat plugin? [always] [always for this site] [just this once] [no] [never for this site] [never]'

    I'm tired of going in and re-removing 'automatically perform the associated action for each of the following file types' over and over and over again.

  • At the risk of being flamed... (Score:3, Interesting)

    by InfinityWpi ( 175421 ) on Tuesday July 13, 2004 @09:46AM (#9686101)
    The most important thing to be in abrowser is speed and ease of use. I've got IE, an old Netscape, Firefox, and a handful of other esoteric small project browsers. It may be full of holes, but IE is the best when it comes to browsing. I'd love Firefox a lot more if it wouldn't keep telling me "Connection Refused" five or six times before I -finally- get the lucky refresh that lets the page load. IE'll do that right away. Maybe IE just doesn't tell me the connection was refused and keeps retrying for me, but that's -nice-. It's -helpful-. It's damn near -considerate-. I don't want to be George Jetson, pushing a button all the time, just to websurf.

    Tho I do like the tabbed browsing. Lets me open a page five times so I can finally get one that doesn't say "Not responding".

  • NOT just a Windows/Mozilla problem (Score:5, Insightful)

    by for_usenet ( 550217 ) on Tuesday July 13, 2004 @10:07AM (#9686321)

    Folks - this is not just a Mozilla/Windows problem. Just a few short weeks ago, a lot of noise was made about a very similar URI exploit on Mac OS X, both through any browser that runs on OS X (noise was made about Safari, and I verified that the exploit was also present in Camino) and OS X's help system.

    Because of the seemingly general nature of this type of exploit - why are we letting browsers run code ?? The web SHOULD primarily be to exchange information (text, images, audio, video). Why are we allowing remote program execution?

    • Oh good, it's not just me who thinks the promiscuous use of protocol handlers and helper apps is a bad idea. Every time I bring it up on /. or anywhere else I get hit with platitudes like "it's a balance between security and convenience"[1], or "it's not Mozilla's job to debug Microsoft's bugs."

      IDGI. This should be an open and shut case. Feeding data you know can't be trusted to an application you don't know is secure without so much as asking the user if that's OK is so obviously a bad idea that I can't comprehend the confusion of the mind that considers it for a moment.

      [1] No, it isn't, you can build a system that's more secure and convenient if protocol handlers didn't have to double as security software because they don't know if they're being run from a browser or directly from local code... if a browser doesn't KNOW that it's safe to use a registered protocol or helper app, it shouldn't blithely go ahead and use it.

  • Call to Arms (or maybe just eyes) (Score:4, Insightful)

    by MythoBeast ( 54294 ) on Tuesday July 13, 2004 @10:23AM (#9686512) Homepage Journal
    This brings up an interesting concept. It has been the conjecture of most people on this forum that opensource is more secure because it's more freely examined. This doesn't hold true if the opensource code in question is never actually examined.

    A number of years ago, an initiative was created to make FreeBSD the most secure operating system on the planet. OpenBSD is the result, and I have to say that they did a darn fine job of it.

    I'd like to propose that the Opensource community do the same thing with Mozilla. Start a line-by-line security audit of the Mozilla code base. Leverage the opensource massively distributed model and create the first browser that can be called truely secure.

    If you don't want to do it to create a truely awesome product, then just do it to rub Microsoft's nose in something that they are completely incapable of. *evil grin*

  • Remember Slate? (Score:3, Interesting)

    by ShadowRage ( 678728 ) on Tuesday July 13, 2004 @01:06PM (#9688676) Homepage Journal
    Slate, a Microsoft magazine urged users to use mozilla as well, however, I dont think this was a charitable request, instead, make users use this alternative, microsoft will sit back and watch as mozilla gets exploited by malware, make a big shit about it every time, (possibly even write their own as well) then come out with a version of IE that isnt exposed the the type of malware that mozilla is exposed to, and use choice marketing words to get people to download it (even buy it)
    Microsoft is gonna use Mozilla as a pawn in the browser wars to re-affirm their grounds in the Browser Monopoly.

  • If there was no bundling (Score:3, Interesting)

    by DuctTape4Windows ( 796638 ) <radiogeek@comcast.net> on Tuesday July 13, 2004 @03:54PM (#9690734)
    I think most people prefer internet explorer because it's there. I NEVER used IE, i always used Netscape, (and now mozilla) and that was when the battle of the browsers was still big, but I think netscape was MORE popular. Microsoft cornered the cornered the market when in Windows98, When they merged IE with Windows Explorer, so to browse your files you HAD to use IE, (today thats still the problem, i wish i could use FireFox as my file manager) IE is only popular because of bundling I still think FireFox is a more seccure browser, simply cause it is, and there isn't so much "IE Friendly" HTML, i've noticed, that on pages not published with Frontpage or any other MS product, Firefox often looks better. and pages done with Frontpage often still look better in firefox. I still think firefox is a more secure browser because it isn't jammed with useless features like IE. I have the "view with IE" extention on firefox, i NEVER need to use it. The only thing i can think of that can't be used in firefox is Launch.com Oh well, stick with firefox

Slashdot Top Deals

If mathematically you end up with the wrong answer, try multiplying by the page number.

Close