Feeds

Firefox developers tinker with new security protections (finally)

Protecting users from net's weaker security links

Choosing a cloud hosting partner with confidence

Developers of the Firefox browser are designing new technologies aimed at protecting users from some of the nastiest and most prevalent forms of website attacks.

One protection is designed to minimize end users' risk to cross-site scripting (XSS) attacks and cross-site request forgeries (CSRFs), both of which subvert basic internet security by exploiting the often misplaced web of trust that exists between two or more different sites. The protection would allow developers of one site to explicitly define which domains are allowed to initiate or answer cross-site requests for code, cookies and other site resources.

"These policies will describe which scripts in a page should be treated as valid and how web content should be permitted to initiate cross-site requests," Brandon Sterne, a member of Mozilla's security group, wrote in an email. Sterne recently described his work to security professions at Yahoo.

The idea is to enable websites to define security policies that the browser enforces. That will protect users from vulnerable sites and prevent sites from receiving forged requests. Site developers could indicate an explicit set of domains that should be treated as valid sources of javascript, so that code embedded in sites that aren't specifically white-listed would not be executed.

The other protection would erect a wall in front of private resources on a company's intranet to prevent them from being accessed by web content from public sites. Private resources would still be permitted to make requests to public resources.

It is designed to guard against so-called DNS rebinding attacks like the one researcher Dan Kaminsky demonstrated last month, which used plain-vanilla internet specifications to take control of routers and other devices barricaded behind firewalls. Rather than creating a Trojan or other piece of specialized malware to access servers or other devices behind a firewall, such attacks use the nearly unlimited access of web traffic to do much the same thing.

The project is still in its infancy, but it is nonetheless an important step forward. When you consider the unending series of successful attacks that exploit the domain name system and rest of the net's weaker links in the security chain, it's easy to grumble that Mozilla, Microsoft and the rest of the browser developers don't do enough to insulate their users from the inherent risks of browsing the web.

"From a security professional's point of view, it's big," said Jeremiah Grossman, CTO of web application security firm WhiteHat Security. "There are a lot of big website operators that would like to have a browser with this feature to recommend to their users."

For now, some of these protections are being implemented as a Firefox extension that will serve as a proof of concept. Sterne says implementation details are "still very much in flux", and he can't say "if and when thee features will be available in Firefox".

But if all goes well, they could blossom into open specifications that website developers could use to enforce policies across any participating browser. Not that we're holding our breath, but that doesn't mean we aren't hopeful. ®

Beginner's guide to SSL certificates

More from The Register

next story
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
Kill off SSL 3.0 NOW: HTTPS savaged by vicious POODLE
Pull it out ASAP, it is SWISS CHEESE
Facebook slurps 'paste sites' for STOLEN passwords, sprinkles on hash and salt
Zuck's ad empire DOESN'T see details in plain text. Phew!
China is ALREADY spying on Apple iCloud users, watchdog claims
Attack harvests users' info at iPhone 6 launch
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.