Whilst it's not okay in Microsoft's eyes for Google to install a plugin into Internet Explorer, increasing the potential surface area of attack, when Microsoft do it to Firefox, it's a different matter. Now a security hole has been found in a plugin that Microsoft have been silently installing into Firefox.
To read all comments associated with this story, please click here.
Member since:2005-12-15
I think the problem here is that these malware authors are very tricky. They figure out ways to slip things in without users noticing. I think Mozilla should add as much as possible, but I am wondering whether the issue at hand is not as much that the plugin is installed (it's a concern yes), but what the plugin can do.
Why not focus on controlling / auditing what the plugins do at the user level. For example, if it tries to write to disk alert the user, if it tries to remotely connect to a website, alert the user.
Control not only getting the plugin in the browser, but also add safe-guards to what it does once it's there.
Member since:2005-07-08
This exactly one reason why regardless of your OS, you might be easily owned.
Sure it is harder to get Virus and other type of malaware deployed in MacOS X, Linux and other systems. But if your browser gets owned, you might just say goodbye to your data. Remeber the browser has full rights to access all files with your user rights.
Just because you stay away of Windows, don't think that you are safe.
Member since:2005-11-10
Plugins are native code, there's no auditing that can really be done other than by your AV spotting this behaviour. The plugin interface just provides a means for the native code to load and to paint back to the browser.
Chrome and Safari on Snow Leopard place plugins on their own thread and in a sandboxed environment, which helps; but ultimately the whole nature of plugins is completely flawed and unsafe from the get-go.
Mozilla also can't outright block these things from being installed because the OS vetos the browser. Id est, any software running on the computer can manipulate any aspect of the browser to fool it into accepting a plugin, circumventing any protection Mozilla put in place.
That said, I feel Mozilla should take a firm stance and beef up how they handle plugins and things installing into the browser so that the user has complete control. They need to make managing plugins as easy as extensions.
Member since:2009-06-01
If the user is running a program, as far as your computer and OS (Windows, Unix, OS X) is concerned, that program IS the user. There's no distinction between what the user can do and what programs running as the user can do, therefore it's not possible for Mozilla to prevent programs running as the user from doing whatever they like "without the user's consent".
Member since:
2007-06-22
Moziila really has to re-think how extensions and plug-ins register with Firefox. In no way should Firefox allow that one of these things can be installed silently without the user's consent. Even a pop-up window when starting the browser would already be to prominent in my opinion. The yellow notification bar should be sufficient to inform the user that a plug-in wishes to installed, so that the user can also quickly discard of the notification ("Install|Don't install|Never bother me again").