Feeds

Firefox loses its shine

Spate of vulns raises security questions

  • alert
  • submit to reddit

Beginner's guide to SSL certificates

The Mozilla Foundation's Firefox web browser has made security a major part of its marketing, but a spate of vulnerabilities found over the last nine months had sullied that message.

In the latest incident, a 16-year-old security researcher - who asked only to be identified by his first name, Paul - found three vulnerabilities in the Firefox browser that together could be exploited to run arbitrary code. The incident is the latest black eye for the open-source software project's security image. While vulnerability researchers frequently flogged Microsoft for the number of security holes found in its Internet Explorer browser, now flaw finders are pinpointing more security holes in Firefox and, in many cases, using the same techniques.

"Much of what we learned security-wise from Internet Explorer is being applied to Firefox to find vulnerabilities," said Paul in an email interview. For example, Internet Explorer had its own Javascript flaw that allowed one page to execute scripts by navigating to another page that had higher privileges, he said. "That is one of the vulnerabilities used in this exploit."

The Mozilla Foundation changed its update server last week to prevent the exploit from working in the browser's default configuration, and on Thursday, the project released version 1.0.4 - a more permanent fix for the hole, said Chris Hofmann, director of engineering for the Mozilla Foundation.

"That was the main reason for this update," he said. "Though, as far as we know, this has not been actively exploited on the Web."

The security issues come as Firefox has rewritten the Cinderella story for the browser market by succeeding in gaining market share against the juggernaut of Microsoft's Internet Explorer.

Last month, the Firefox campaign announced that more than 50 million people had downloaded the browser. Almost seven per cent of visitors to major websites use the Firefox browser, an increase of more than a percentage point over two months, analysis firm WebSideStory announced on Tuesday.

However, the open-source software browser's security story has had to deal with some hiccups.

For the last six months of 2004, researchers found more vulnerabilities in Mozilla's Firefox than Microsoft's Internet Explorer, according to Symantec's bi-annual Internet Security Threat Report. The report tallied 21 vulnerabilities for Mozilla Firefox versus 13 for Internet Explorer. However, a smaller percentage of the vulnerabilities found in Firefox were considered a severe security threat, said Symantec's Oliver Friedrichs, senior manager with the company's security response team.

"Severe vulnerabilities in general allow for drive-by installs," he said. "So just by visiting a website, you could have [anything from] spyware to malware to Trojan horses installed on your system."

Friedrichs stressed that the number of vulnerabilities found by researchers is not necessarily a good indication of product security. He pointed to the Mozilla Firefox's relatively young age, the browser's increasing popularity, and commercial software vendors tendency to silently fix vulnerabilities as factors that could affect the vulnerability count.

Microsoft, for example, changed more than 50 features of Internet Explorer in its major security update, known as Service Pack 2, which the company released last August. In total, the software giant changed more than 428 features in Windows XP, including eliminating two classes of vulnerabilities on which the company has yet to provide details.

Those changes have made Internet Explorer a tougher target for vulnerability researchers, said one flaw finder.

"The assumption that Internet Explorer is easier to exploit is a common misconception," Paul said. "Internet Explorer has become quite tough, and it is very difficult to find vulnerabilities in it."

Microsoft did not immediately comment for this article, but tackled the issue on the company's Internet Explorer developer's blog.

"Security is an industry-wide problem," wrote one Microsoft developer. "It's not limited or unique to operating systems or applications, or client or server software. It's not limited or unique to commercial software or open source."

Whether the Mozilla Foundation will find that its original development focus on security will mean fewer security updates remains to be seen. However, their is no question that the project has its work cut out for it, said Mozilla's Hoffman.

"There is definitely engineering work to do," he said. "We work towards integrating security -- that's a critical part of our mission and what we want to accomplish with the browser and engage people that can help us secure the application and help us build a better browser."

Copyright © 2004, SecurityFocus logo

Related stories

Firefox exploit targets zero day vulns
Opera downloads reach 2m
Firefox doubles market share as IE slips

Protecting users from Firesheep and other Sidejacking attacks with SSL

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
China hacked US Army transport orgs TWENTY TIMES in ONE YEAR
FBI et al knew of nine hacks - but didn't tell TRANSCOM
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.