Ads by TechWords

See your link here
Receive the latest technology news and information.
Security
Computerworld Daily News (First Look and Wrap-Up)
Computerworld Blogs Newsletter
The Weekly Top 10
Cloud Computing
View all newsletters




Privacy Policy
 

Firefox leaks info that's useful to attackers

Some browser add-ons let hackers do preattack reconnaissance

January 23, 2008 12:00 PM ET

Active Comments
Anonanon says: "Users are only at risk if they have one of the 'flat' packaged add-ons installed," Snyder said. That means it's...
beeno says: If you want secure, use a browser that no one uses. People don't target those. That or change your browser...


Computerworld - Mozilla's head of security yesterday confirmed a bug in Firefox that could be used by attackers to scout out a system prior to mounting a more thorough assault.

The flaw, said Window Snyder, Mozilla Corp.'s chief security officer, is in the browser's chrome protocol, she said in response to reports of the vulnerability and the public posting of a proof-of-concept exploit. "Chrome" is the Firefox term for its user interface.

Access to a user's machine would be through one of many Firefox extensions packaged in a flat file structure, rather than collected into a single Java archive, or .jar file, said Snyder. Several popular add-ons, including Download Statusbar and Greasemonkey, use a flat file structure. "Users are only at risk if they have one of the 'flat' packaged add-ons installed," Snyder said on the Mozilla security blog.

By leading users to a tricked-out Web page, criminals could sniff for information that might be useful in more aggressive attacks, Snyder acknowledged. "A visited attacking page is able to load images, scripts or style sheets from known locations on the disk," she said. "Attackers may use this method to detect the presence of files which may give an attacker information about which applications are installed. This information may be used to profile the system for a different kind of attack."

Firefox developers are working on a patch, according to a thread on Bugzilla, Mozilla's bug-tracking and management site, but a fix has not yet been coded.

In the meantime, the authors of the two extensions that Snyder called out -- Download Statusbar and Greasemonkey -- have updated them so that they can't be exploited. "I just released a JARred version of Download Statusbar 0.9.5.3," said Devon Jensen on Bugzilla.

Firefox users can also deploy another add-on, the popular NoScript, to block exploits, regardless of which extensions have been installed, updated or not. "[NoScript] block[s] chrome JavaScript load attempts," reported Giorgio Maone, NoScript's maker, on the same Bugzilla thread.

Although Snyder downplayed the threat posed by the bug, Gerry Eisenhauer, the researcher who uncovered the vulnerability, said there might be more to it. "This looks very interesting and may have bigger potential," he said Saturday in his original write-up. "But for now, it's just another information disclosure."



Jump to comments

Mozilla

Additional Resources

Xerox
By using solid ink technology only from Xerox, you could save up to 65% by printing color for the cost of black and white. Enter for a chance to WIN a PhaserTM 8860 network color printer!
Microsoft
Save time and mitigate security risk. Deploy it now.
Sybase
In this white paper, IDC analyzes the role of next-generation mobile enterprise platforms as organizations seek a more strategic deployment of mobile solutions.

Learn the important issues you must consider before starting your next mobility initiative. Get your mobility white paper from IDC now, compliments of Sybase.

What People Are Saying

White Papers & Webcasts

Share our Strength
Download Now  

Managing Secure File Transfer to Save Time, Money and IT Resources
Learn how companies are using innovative technology to overcome these challenges and improve user productivity by offloading e-mail attachments and replacing FTP with...

Security Convergence Equals Network Security Cost Savings
Listen to IBM Internet Security Systems' take on network security convergence.

Disaster Recovery 2008: Reduced Costs and Improved Performance
How long can your Enterprise afford to be without your data? With an accelerated disaster recovery program, you never have to answer this...