Feeds

Firefox developers tinker with new security protections (finally)

Protecting users from net's weaker security links

High performance access to file storage

Developers of the Firefox browser are designing new technologies aimed at protecting users from some of the nastiest and most prevalent forms of website attacks.

One protection is designed to minimize end users' risk to cross-site scripting (XSS) attacks and cross-site request forgeries (CSRFs), both of which subvert basic internet security by exploiting the often misplaced web of trust that exists between two or more different sites. The protection would allow developers of one site to explicitly define which domains are allowed to initiate or answer cross-site requests for code, cookies and other site resources.

"These policies will describe which scripts in a page should be treated as valid and how web content should be permitted to initiate cross-site requests," Brandon Sterne, a member of Mozilla's security group, wrote in an email. Sterne recently described his work to security professions at Yahoo.

The idea is to enable websites to define security policies that the browser enforces. That will protect users from vulnerable sites and prevent sites from receiving forged requests. Site developers could indicate an explicit set of domains that should be treated as valid sources of javascript, so that code embedded in sites that aren't specifically white-listed would not be executed.

The other protection would erect a wall in front of private resources on a company's intranet to prevent them from being accessed by web content from public sites. Private resources would still be permitted to make requests to public resources.

It is designed to guard against so-called DNS rebinding attacks like the one researcher Dan Kaminsky demonstrated last month, which used plain-vanilla internet specifications to take control of routers and other devices barricaded behind firewalls. Rather than creating a Trojan or other piece of specialized malware to access servers or other devices behind a firewall, such attacks use the nearly unlimited access of web traffic to do much the same thing.

The project is still in its infancy, but it is nonetheless an important step forward. When you consider the unending series of successful attacks that exploit the domain name system and rest of the net's weaker links in the security chain, it's easy to grumble that Mozilla, Microsoft and the rest of the browser developers don't do enough to insulate their users from the inherent risks of browsing the web.

"From a security professional's point of view, it's big," said Jeremiah Grossman, CTO of web application security firm WhiteHat Security. "There are a lot of big website operators that would like to have a browser with this feature to recommend to their users."

For now, some of these protections are being implemented as a Firefox extension that will serve as a proof of concept. Sterne says implementation details are "still very much in flux", and he can't say "if and when thee features will be available in Firefox".

But if all goes well, they could blossom into open specifications that website developers could use to enforce policies across any participating browser. Not that we're holding our breath, but that doesn't mean we aren't hopeful. ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
OpenSSL Heartbleed: Bloody nose for open-source bleeding hearts
Bloke behind the cockup says not enough people are helping crucial crypto project
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Experian subsidiary faces MEGA-PROBE for 'selling consumer data to fraudster'
US attorneys general roll up sleeves, snap on gloves
Bad PUPPY: Undead Windows XP deposits fresh scamware on lawn
Installing random interwebs shiz will bork your zombie box
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.