Hackers can Hijack PCs With Firefox Add-Ons

[Richard]

Hackers can drop malicious code into systems running Firefox when the browser is armed with Google Toolbar, Yahoo Toolbar, or other add-ons.

Gregg Keizer, Computerworld
Thursday, May 31, 2007 06:00 AM PDT

Hackers can drop malicious code into systems running Mozilla Corp.'s Firefox when the browser is armed with any of several high-profile add-ons, including Google Toolbar and Yahoo Toolbar, a researcher revealed today. Mozilla has acknowledged the risk posed by some extensions.

Christopher Soghoian, a Ph.D student at Indiana University, outlined how "man-in-the-middle" attackers, especially in public wireless networks, could disguise malware as a Firefox extension and surreptitiously plant their code in lieu of a normal update to one of the vulnerable extensions.

The bulk of Firefox extensions -- small plug-ins that add features or functionality, and are almost universally created by volunteer developers or hobbyists -- are hosted and updated from Mozilla's own SSL-secured site, and are not vulnerable to this attack, Soghoian said. A number of broadly used third-party extensions, however, update from their own unsecured servers.

"It's sort of a compounding of errors," Soghoian said. "Mozilla didn't tell developers that they should update from a secure link; they erred in assuming everyone would know to do that. But the add-on developers are at fault for not using a secure server."

Mozilla revised the documentation for crafting and maintaining Firefox extensions after being contacted by Soghoian to post a prominent warning that urges developers to host updates on a SSL-secured site.

Public wireless access points, like those at airports and coffee shops, would be the most likely scene of an attack, because it's relatively easy there for a hackers' laptop to mimic a legitimate update server. But Soghoian warned that other locales would be just as dangerous.

"Any network where you're not running the show puts you at risk," he said. "If you're using your neighbor's wireless, for example." Users of the Tor anonymity network would also be vulnerable, Soghoian added. "There you're trusting your DSN to someone you don't know."

He listed Google Toolbar, Yahoo Toolbar, Del.icio.us Extension, Facebook Toolbar, AOL Toolbar, Ask.com Toolbar, Netcraft Anti-Phishing Toolbar, and PhishTank SiteChecker among the at-risk add-ons, but couldn't come up with an exhaustive catalog. "I didn't have time to test every extension," he said, "so I went to Download.com and looked at the top 20."

Ironically, some, such as Netcraft's, are designed to protect users against threats. "Users think 'I'm gonna make myself safer' by installing this extension, but they end up putting themselves at risk."

One vulnerable extension -- the eBay-created, Mozilla-sanctioned add-on for French, German, and British online auction users -- was shifted to a secure server within days, Soghoian said.

Other vendors contacted by Soghoian, however, were less responsive.

"It was really frustrating. Firefox was fantastic, but some of the other firms, they either ignored my e-mails or didn't reply," Soghoian said. He fingered Google Inc. as especially uncooperative. Between April 16 and May 24 he sent Google's security team five e-mails, but received only one reply, on May 25, that said the group was working on a fix that was to be deployed before today. As of today, however, Google Toolbar was being served from an unsecured URL.

"This was really eye-opening," said Soghoian, who interned with Google's Application Security Team last summer.

"Vendors should be doing everything possible to encourage researchers," he said. "They should be encouraging us to come to them rather than sell the vulnerabilities to iDefense or Tipping Point. Ignoring researchers isn't the best way to encourage an open dialog."

Soghoian recommended that until affected extension vendors release secure updates, users should either remove or disable all Firefox extensions and toolbars that have not been downloaded from the official Mozilla Add-Ons site.

In an e-mail today, Mozilla's director of ecosystem development, Mike Shaver, admitted the danger that insecurely hosted and updated add-ons pose, and urged extension developers to fix the problem.

"We strongly encourage the providers of such add-ons to remedy their hosting situation promptly, to minimize the exposure to the users of their software," Shaver said. "Users of add-ons hosted on AMO, including all of the ones we've been working on, are not at risk here."

http://www.pcworld.com/article/id,132398...ticle.html

[Rod]

Yes, this is a big issue, as well as the new toolbars created for Internet Explorer. A company I have checked out, leaves the doors wide open for executable javascripts. The website is http://www.conduit.com/ and anyone can make a freetoolbar. The problem with this, is that if over 100,000 people have the toolbar, all someone needs to do, is hijack the creator of the toolbar, edit custom scripting in JS, and save settings. The next time one of the 100,000 users load internet explorer, boom, they're all infected when the toolbar is updated automatically. Its a huge problem, and is a perfect example of how centralisation has problems.

This is also the problem with central governing bodies, why sould the government in Canberra, have to dictate Western Australia? they're holding onto the leashes too hard and if something happens in canberra - boom, if affects the whole of western australia and other states, as well as any relationships with other nations.

the ideal situation would be states being 'countries' in respect, so the federal government ceases to exist, and only at a state level. What Western Australia does, does not reflect on Victoria. This allows state economies to have their own international trade agreements, where say indonesia buys from western australia, and perhaps sydney has trade agreements with New Zealand. What this does, is the frequency matches from New Zealand more so to Sydney, than New Zealand to Western Australia. That is my gut instinct by the way. So what that would mean, is if you want New Zealand products, ideally you would go through the sydney channel. It allows for frequency of products to slowly change to reflect area.

Its like exporting Ice from antartica to the sahara desert.. Instead, export it to Australia/Chile, and they do what they can with it (frequency change) and then the other countries around get the frequency aspect that matches their nation, ie, argentina. Argentina would get the frequency aspect of the ice that matches them. Meaning processing and filtering the water to match argentinian genetics..

Brings another example, don't eat food unless its from your genetic background....

If you're chinese, why are you going to eat taco's? Stick with the rice and the food that grows there because that food grows in china - as it matches frequency of china. If you're genetically from china - you're matching chinas frequency. Eat food from china, and you have now matched the frequency of food that best supports your DNA.........

Now where are my Jalepenioes.. (I need to research more on south american cuisine, more so chilean cuisine..... genetically associated to procyon food....hrmmm bronze hair, eyes, golden brown skin, food that allows those genes to activate - anyone have ideas on food in south america?)

Brings up memory of Stewart saying I should have incan statues in my house as it activates genetic memory...makes sense now :)

So basically don't have egyptian statues, unless it reflects you in someway, either genetically or spiritually on personal level, as it doesn't resonate with you.