Can Mozilla-Based Browsers be Hijacked? 102
Chibi Merrow asks: "Matt Hartley in his latest GnomeReport speaks of supposed browser hijacker programs that are now targeting Mozilla FireFox instead of IE. While this is in a way cool (since that means the browser's now considered mainstream), it's also hard to believe. It doesn't help that his article is very light on details. Now there have been some discussion about spyware masquerading as valid extensions; but they require user intervention to install. Most people think of a browser hijack as something that automatically installs itself. Has anyone ever encountered an actual self installing browser hijacker/spyware program that has targeted Mozilla Firefox, or is this a bunch of FUD?"
No ActiveX (Score:3, Insightful)
And lets not forget the obvious - IE6 is always going to be bad for this. Mozilla gets updated each and every day and has a regular release schedule.
I know who I'd rely on for the latest and greatest security tech.
Re:No ActiveX (Score:4, Insightful)
Re:No ActiveX (Score:4, Insightful)
That's the theory. In practice, however, that still doesn't necessarily work. Look, for example, at the recent buffer overflow found in CVS, software that's been open since its inception and been around for a long time. Also, look at the latest problems with OpenSSH, again a package that has been around for quite a while, and one that people should be *very* security concious about.
While the idea that the code being open forces the bugs to be found and removed, that only works if someone with the skill to find the bug, and the willingness and skill to fix the bug does so.
Re:No ActiveX (Score:2)
I'm a big advocate of the theory of open source
Re:No ActiveX (Score:3, Insightful)
Insightful? Not even close. Buffer overflows aren't a given. They aren't a fact of life. Quite simply, all you have to do is simple bounds checking. If you allocate a 4k buffer, don't try to copy 6k to it. Buffer overflows are a 'feature' of C/C++. There are plenty of other languages that don't have that problem.
Unchecked buffers are the result of poor program design.
Re:No ActiveX (Score:1)
Of course the interpreters for those languages are usually written in C or C++, so we haven't quite escaped the problem yet.
Re:No ActiveX (Score:2)
Well, since Delphi doesn't have an interpreter, I would say as least some of us have escaped the problem. Haven't had a buffer overflow in an application in 10 years. Pointers and range checking hasn't been a problem either.
Re:No ActiveX (Score:5, Insightful)
Here is what I mean. My dad clicks on a link. The front page says "Click here to install the software necessary to view this web site." So he clicks. He gets a scary message, warning about potential viruses and trusting and digital signatures and stuff. None of it makes sense. Essentially, it gets translated into the following question:
Do you want to visit the web site? OK / Cancel.
XpInstall is just as vulnerable as ActiveX in this regard. People are dumb. Just like you don't care enough to read the full EULAs with all their legal mumbo-jumbo, most computer users won't really consider the warning.
And, by the way, ActiveX also requires an OK before installing, just like XPI. There are buffer overflows or cross-site scripting attacks that can bootstrap an attack without ActiveX (and to which Mozilla is just as vulnerable), but ActiveX itself doesn't offer any way to auto-install software without the user's agreement, unless the user changes the Internet Security settings.
ActiveX == Browser Plugins. Mozilla allows plugins, so there is NO difference.
IE gets updated whenever a security flaw is found. And the user is prompted to download the update. I don't get alerts when FireFox needs an update -- I go to the website once in a while. You tell me which method is more likely to keep my dad's computer secure.
Re:No ActiveX (Score:3, Informative)
You're wrong. Mozilla, and Firefox both inform you about about updates. take a look at the URL 'about:config' and filter for 'update_notifications'. Unless you changed something, update_notifications.enabled will be set to true, and when a ne
Re:No ActiveX (Score:1)
Re:No ActiveX (Score:2)
Re: E gets updated whenever a security flaw is fou (Score:3, Informative)
http://www.safecenter.net/UMBRELLAWEBV4/ie_un p atch ed/index.html
http://pivx.com/larholm/unpatched/
http://www.malware.com/index2.html
http://www.ee ye.com/html/Research/Upcoming/index.h tml
http://www.guninski.com/browsers.html
And for Mozilla, see
http://bugzilla.mozilla.org/
(search for "security" and sort by Severity)
How many bugs of type "silent delivery & execution of code" can you find for MS IE? How many in for Mozilla?
Re:Please learn how to make links. (Score:1)
highlight text
hit Ctrl-T for a new tab
hit middle mouse button to paste text
hit Enter to go
It takes a lot less time than typing all that other stuff you suggested. Don't tell me about inferior hardware or software. Those are your choices.
Re:Please learn how to make links. (Score:2, Insightful)
Re: E gets updated whenever a security flaw is fou (Score:2, Insightful)
Check all of these 3rd-party sites that I have chosen which list a bunch of security holes for Explorer. How evil! Now check a specific query that I have chosen. See! No bugs!
Well, duh. If you get to pick the evidence, you can prove whatever you want. I'll try my hand at this game. Try this page [mozilla.org]. 9 serious security issues in the November 2003 update. And I was even nice and kept it on Mozilla's own site. These are the vulnerabilities that were fixed in the last release.
Re: E gets updated whenever a security flaw is fou (Score:1)
malicious scripts to cross MS IE security zones too.
MS IE is an increasing target for the attackers, just
like MS Outlook was/is. Just wait and see.
Re: E gets updated whenever a security flaw is fou (Score:1)
malicious scripts to cross Mozilla security zones too.
(Well, they aren't called security zones, but some scripts get more privileges than others.)
Mozilla is an increasing target for the attackers, just
like every other program that touches a network was/is. Just wait and see.
(Grin.)
Re:No ActiveX (Score:4, Informative)
ActiveX itself doesn't offer any way to auto-install software without the user's agreement, unless the user changes the Internet Security settings.
AFAIK Mozilla never allows you to auto-install without a warning.
IE gets updated whenever a security flaw is found.
B.S.
Re:No ActiveX (Score:3, Insightful)
You cannot trust the end user to make good decisions regarding computer security.
You are so right.
It makes me think the better overall policy is to make flexible easy upgrades scarier.
But make the initial installation as capable as possible so most users won't ever feel a need to do an insecure upgrade.
In the Mozilla and FOSS world things are still not much better than in the Windows world as far as security is concerned. A lot of the current problems with Linux security policies are masked by a 1337
Re:No ActiveX (Score:3, Insightful)
But the problem is with the browser. If the browser were designed to be able to per-domain sandbox even plugins (a shit load of work I know, and it would limit their functionality), then a user could install a plugin downloaded from a site, view that site, and all the plugin could do would be screw with the data from that site. I guess what I'm advocating is that plugins be wr
Re:No ActiveX (Score:2)
You couldn't be more wrong and here's why:
XPI installer will ask you ONCE if you'd like to install a plugin without any custom text that lies to you and says to view our website click here.
ActiveX pops up 20+ times before it goes away.
Slight difference in my mind.
Re:No ActiveX (Score:1)
But I don't use IE much, so I don't have any experience of this.
Re:No ActiveX (Score:2)
If memory serves, IE's Medium security setting allows signed ActiveX to load without prompting. You're right if you're talking about XP SP2, or if I'm mistaken.
Re:No ActiveX (Score:1)
In any case, here are the settings on my XP SP1 version of IE6:
Default security for Internet zone: Custom (but very similar to Medium, and the same in all of the settings I list below).
Medium security setting:
Download unsigned ActiveX = disabled
Download signed ActiveX = prom
Re:No ActiveX (Score:5, Insightful)
Let's get one thing straight: this sort of browser hijacking isn't aimed at defeating technically-minded people like you or I, it's aimed at non-technical users, such as friends and relatives we might have encouraged to switch away from Microsoft Internet Explorer, or people who've installed Mozilla Firefox from a magazine cover disc, etc.
For the most part, these non-technical users aren't going to be actively updating their software on a regular basis. They're not going to be looking out for potential security risks and their solutions because they thought that they were leaving all that behind when they switched over from MSIE. In all probability, many if not most of these users won't even know that they've been hijacked if and when that happens.
To suggest that browser hijacking doesn't have the potential to be a major problem for Mozilla users is rather short-sighted. Being dismissive about it is like adopting a "head in the sand" security policy, and no better than a "security through obscurity" one.
IE is part of Windows (Score:5, Informative)
Re:IE is part of Windows (Score:5, Insightful)
An example: For a short time, several themers chose to distribute Mozilla skins in XPI form, because that allowed users to install them without additional files. The now preferred way of installing skins requires the help of a script, either in the browser (theme installer extension) or on a webpage. The latter method does not give skins access to JavaScript and is considered safe. XPIs can do a lot more: The installation process can run arbitrary code on the target system and even skins which are installed this way can later on access browser resources and relay them to an external attacker.
Re:IE is part of Windows (Score:2)
Re:IE is part of Windows (Score:4, Informative)
Haha. That's exactly what they did [mozdev.org] do. To quote the manual:
An XPI file is nothing more than a ZIP file with its own installation script. Using a ZIP utility, you can archive the xfly directory and preserve the subdirectory structure so it's installed in the user's chrome directory as it is in your own. Make sure that the ZIP file, whatever it's called, contains the top-level xfly subdirectory as part of this structure. If it is a JAR file you are distributing for your package, make the JAR file (xfly.jar) the top level, with the content, skin, and locale directories contained within
Re:IE is part of Windows (Score:2, Informative)
I love that bit where they say
I'd hate to see what Microsoft considers to be proprietary, because .cab and 'MSZIP' would fit my definition pretty closely.
Re:IE is part of Windows (Score:1)
Re:IE is part of Windows (Score:2, Informative)
And are you fucking kidding me? MSZIP? And you don't think that's proprietary? Lets take a stroll down memory lane [uklinux.net]:
In 1977, Abraham Lempel and Jacob Ziv devised and published a paper on their new compression method, LZ77. In 1982, James Storer and Thomas Szymarski released their LZSS variant. In the early 1980s, Microsoft required some form of data compression for their installation media to cut down on the numbe
Re:IE is part of Windows (Score:1)
Which original poster? I WAS [slashdot.org] the original poster. The parent [slashdot.org] to mine was saying that Mozilla somehow copied the packaging of ActiveX components. I went off googling for a reference to the ActiveX components, and discovered MS actually claims their proprietary cab format is non-proprietary.
Thats it.. No more replying to AC's for me.
<mental_note>There's a reason my threshold fi
Re:IE is part of Windows (Score:4, Interesting)
Actually, this is exactly contrary to SSL philosophy. When asked "why doesn't SSL/SSH do such-and-such", developers reply that they want to concentrate on the crypto layer and other applications can use that layer to provide their own services (for example, sftp is layered on top of ssh, VNC uses ssh to provide its crypto, etc). So, there's one crypto system to maintain and patch, not two or even n.
It's Unix philosphy too, building useful things from small tools that do one thing well. The Mozilla people lost sight of that pure vision LONG ago, and reimplemented everything from scratch. Kinda missing the point of libraries altogether.
Re:IE is part of Windows (Score:1)
OTOH this is why Mozilla is able to run on multiple platforms and architectures.
Re:IE is part of Windows (Score:1, Insightful)
And "Windows Philosphy" would be to use the built-in HTTPS libs. The idea of shared code isn't exclusive to Unix.
The fact is that Netscape^WMozilla has always seeen themeselves as their own 'operating system' layer. Remember Andreeson and his quip about "reducing Windows to a bunch of poorly debugged device drivers" -- well, the same attitute lives on today at mozilla.org.
Being hetrogenous reusing code (Score:1)
Mozilla/Firewombat have so many different versions floating about that a large scale exploit would be very difficult to pull off.
The fact that mozilla's ssl implementation is new and probably less tested will never make it more of a target than IEs or windows, even if mozilla became as popular. (So long
Yes, i've seen it (Score:5, Informative)
Re:Yes, i've seen it (Score:2)
Re:Yes, i've seen it (Score:5, Informative)
Guess I should have checked that
Re:Yes, i've seen it (Score:2, Informative)
Re:Yes, i've seen it (Score:5, Informative)
Re:Yes, i've seen it (Score:2)
The page includes a 1x1pixel iframe, with CSS visiblility set to hidden, referencing:
http://stat4.z-stat.com/cl.html
That will give you a javascript prompt "sorry your browser is not Win32 compatible", then it will try to launch an XPI installer, and then it will try to send a windows executable file "application/exe, do you want to run or sa
I think this vulnerability has been fixed (Score:1)
Semi-OT: Why are extensions not signed ? (Score:5, Insightful)
Re:Semi-OT: Why are extensions not signed ? (Score:2, Insightful)
Let's say I sign my extension with a private key named "George.Brampton@yahoo.com". How does that make you more confident that the extension is legit?
The only thing which signing would accomplish is making redistribution safer for people who actually check the signatures against the public keys on the authors web
Re:Semi-OT: Why are extensions not signed ? (Score:5, Insightful)
Surely you could get MozDev [mozdev.org] to be (one of) the top level Certificate Authority(s) though, seeing as it's already the main repository for plugins. Maybe XULPlanet [xulplanet.com] and a few others too, along the same lines as the SSL cert. verification model. Establish some trusted bodies and give them the issuing responsibilities.
Get these bodies to issue a cert. to each project and provide a mechanism for signing code, then plug the above CA servers into Mozilla, Firefox, etc., write some checking code (displaying warnings for unsigned code, for example) then you're done :)
Not quite that easy in practice though, I guess?
Re:Semi-OT: Why are extensions not signed ? (Score:1)
Do you know how much a certificate costs? When someone writes a small plugin and shares with the rest of the world for nothing, what reasons does he have to sign it.
If you want to install a plugin, just make sure you trust the provider. I think it's better to install plugins only from the official mozilla web site, just as a precaution.
Re:Semi-OT: Why are extensions not signed ? (Score:1, Interesting)
But, others have pointed out, it would actually be better to create a signing authority at MozDev rather than have stuff signed by Joe Blow.
what reasons does he have to sign it
As Mozilla-based malware becomes more popular, Mozilla WILL have to change the install policy to require signed components. Just look at the path Microsoft took -- For IE3, signed ActiveX was optional, for IE4 it became required, and XP SP2 will have a bunch o
Re:not enough users... (Score:3, Insightful)
Re:not enough users... (Score:2)
Difference between Linux and Windows (Score:1)
Re:Difference between Linux and Windows (Score:4, Informative)
Re:Difference between Linux and Windows (Score:3, Informative)
The next time you see a bootable C:\ drive formatted to FAT-32, note this: The OS, IE, and most apps are unprotected and can be compromised. In other words, in this configuration, IE is STILL running as root/administrator.
It's very odd that for backward compatibility reasons that M$ chose to leave FAT-32 insecure and
Re:Difference between Linux and Windows (Score:2)
Re:Difference between Linux and Windows (Score:2)
Only thing I've seen... (Score:5, Informative)
Re:Only thing I've seen... (Score:2)
Re:Only thing I've seen... (Score:1, Insightful)
One smart thing Microsoft did was make the ActiveX install dialog look unique and a little scary -- it says "Security Warning" and has it's own graphic.
Re:Only thing I've seen... (Score:1)
The only difference is that the JavaScript version will say "[JavaScript Application]" in the title bar instead.
Re:Only thing I've seen... (Score:1)
Not Just Windows anymore.... (Score:2, Insightful)
As other OS's and app's become more popular we will see a rise in breaches and attempted breaches of these systems.
No matter if your an Admin of a "microsoft", "Sun", "Linux" system. Security should still be on your agenda regardless of system.
What's really funny.... (Score:3, Interesting)
Wow, talk about timing! (Score:4, Informative)
So what right?
Well, I haven't had a virus in _years_ now, AND, (here's the kicker), I do NOT run IE, EVER. Firefox exclusively and previous incarnations for years previous.
And no, it most deffinately did not come in through email.
So apparently, the article is correct.
(As well, I NEVER click ok or the like unless I KNOW i initiated installation of something myself, and I haven't seen anything like that anyways in the past few weeks.)
I'd love some more details and a patch
Re:Wow, talk about timing! (Score:1, Interesting)
Re:Wow, talk about timing! (Score:1)
why dont you get a 2nd opinion ? [antivirus.com]
OS dependancy? (Score:3, Interesting)
Even so, using Mozilla on windows is a sensible thing to do from a security perspective since it provides another layer of security. IE, is so tied into the OS in this regard, but Mozilla is more of a seperate entity.
nick
Hoo, boy! (Score:1)
Oh man, you almost had me there!
Re:OS dependancy? (Score:2)
I've seen it (Score:2, Interesting)
Chris
Related info (Score:4, Informative)
Warning: Actions not found: addBookmark, viewBookmark, copy, undefined-key, find, findAgain, history, loadImages, openURL, mailNew, new, openFile, print, exit, reload, saveAs, paste, delete, cut, undo, historyItem, back, forward, abort, PageUp, PageDown
Didn't bother to determine which site did this as it doesn't bother me, but it was interesting to see.
Not necessarily (Score:3, Insightful)
actually it just means that hackers are finally starting to realize that people using IE rarely have data worth accessing. If someone's using FireFox, chances are they're bright enough to have some cool data.
On our webserver, we're only getting about 1.5% of 50,000 hits per day that our Firebird/Firefox, so it's still far from mainstream.
Different data here (Score:1)
1 39346847 78.96% MSIE 6.0
2 4523223 9.08% Mozilla/5.0
3 2250067 4.52% MSIE 5.5
4 710608 1.43% MSIE 5.0
5 696715 1.40% MSIE 5.01
Ok, I know some browsers other than Mozilla disguise as Mozilla/5.0, but their number should be really insignificant.
And no, it's not very geeky site, it's a forum for R/C enthusiasts.
Re:Different data here (Score:1)
If it has user input and output ... (Score:3, Insightful)
So yes, I believe it may be possible to exploit Mozilla.
But I also believe that the exploit will be known almost as soon as it hits the streets rather than being kept quiet until the devs get around to fixing it.
And if the devs don't quickly fix it I trust that the community will, because it is in their own interests.
The last 2 paragraphs are because Mozilla is open, IE is closed, plain and simple.
Not to mention that I don't believe that Mozilla is -as- vulnerable to exploits as IE nor will such exploits be as serious due to purposeful lack of OS integration.
Just came across one... (Score:1)
from http://www.bkahuna.scripterz.org/dg-tproxy.html
raj
auto download (Score:1)
A user visits the site, and the autodownload kicks in; the file being so small it will not pop up the download window. Later on, the user looks at his desktop and sees an executable. he double clicks.
I think the autodownload should be disabled for links that the user hasn't clicked on. If the site is pushing a download, the browser should prompt the user.
it has been reported, but the
My advice... (Score:1)
Technically, it is possible to do it on KDE desktop for ex
Re:My advice... (Score:2)
(It's particularly nasty if you want to avoid active attacks rather than just mistakes, becaus
I saw one non self installing one (Score:1)