Firefox developers tinker with new security protections (finally)
Protecting users from net's weaker security links
Developers of the Firefox browser are designing new technologies aimed at protecting users from some of the nastiest and most prevalent forms of website attacks.
One protection is designed to minimize end users' risk to cross-site scripting (XSS) attacks and cross-site request forgeries (CSRFs), both of which subvert basic internet security by exploiting the often misplaced web of trust that exists between two or more different sites. The protection would allow developers of one site to explicitly define which domains are allowed to initiate or answer cross-site requests for code, cookies and other site resources.
"These policies will describe which scripts in a page should be treated as valid and how web content should be permitted to initiate cross-site requests," Brandon Sterne, a member of Mozilla's security group, wrote in an email. Sterne recently described his work to security professions at Yahoo.
The other protection would erect a wall in front of private resources on a company's intranet to prevent them from being accessed by web content from public sites. Private resources would still be permitted to make requests to public resources.
It is designed to guard against so-called DNS rebinding attacks like the one researcher Dan Kaminsky demonstrated last month, which used plain-vanilla internet specifications to take control of routers and other devices barricaded behind firewalls. Rather than creating a Trojan or other piece of specialized malware to access servers or other devices behind a firewall, such attacks use the nearly unlimited access of web traffic to do much the same thing.
The project is still in its infancy, but it is nonetheless an important step forward. When you consider the unending series of successful attacks that exploit the domain name system and rest of the net's weaker links in the security chain, it's easy to grumble that Mozilla, Microsoft and the rest of the browser developers don't do enough to insulate their users from the inherent risks of browsing the web.
"From a security professional's point of view, it's big," said Jeremiah Grossman, CTO of web application security firm WhiteHat Security. "There are a lot of big website operators that would like to have a browser with this feature to recommend to their users."
For now, some of these protections are being implemented as a Firefox extension that will serve as a proof of concept. Sterne says implementation details are "still very much in flux", and he can't say "if and when thee features will be available in Firefox".
But if all goes well, they could blossom into open specifications that website developers could use to enforce policies across any participating browser. Not that we're holding our breath, but that doesn't mean we aren't hopeful. ®
I'm an IE flamer, for the exact reason you mention. Standards are meant to minimise development overhead by allowing the same code to be cross-browser compatible, a thing IE is notorious for breaking. Should Mozilla go this same route, deviating from the W3C, rest assured I (and many other web developers) will start hoeing into them with just as much avidity as we currently attack IE!
Paris because she's become a universal standard on El Reg...
Security? What security?
For whom and by whom?
I suppose it would be useful for this functionality to be built into the browser, but I have little doubt that the "NoScript" extension will still do it much better. (if nothing else because of the ridiculously frequent updates to NoScript)