FireFox users beware... Firefox add-ons open millions to new attack

Discussion in 'Microsoft Surface General Discussion' started by GreyFox7, Apr 5, 2016.

  1. GreyFox7

    GreyFox7 Super Moderator Staff Member

    Jul 27, 2014
    Likes Received:
    Trophy Points:
    Ref: NoScript and other popular Firefox add-ons open millions to new attack

    NoScript, Firebug, and other popular Firefox add-on extensions are opening millions of end users to a new type of attack that can surreptitiously execute malicious code and steal sensitive data, a team of researchers reported.

    The attack is made possible by a lack of isolation in Firefox among various add-ons installed by an end user. The underlying weakness has been described as an extension reuse vulnerability because it allows an attacker-developed add-on to conceal its malicious behavior by invoking the capabilities of other add-ons. Instead of directly causing a computer to visit a booby-trapped website or download malicious files, the add-on exploits vulnerabilities in popular third-party add-ons that allow the same nefarious actions to be carried out. Nine of the top 10 most popular Firefox add-ons contain exploitable vulnerabilities. By piggybacking off the capabilities of trusted third-party add-ons, the malicious add-on faces much better odds of not being detected.

    Of the top 10 most popular add-ons vetted by Mozilla officials and made available on the Mozilla website, only Adblock Plus was found to contain no flaws that could be exploited by a malicious add-on that relied on reuse vulnerabilities. Besides NoScript, Video DownloadHelper, Firebug, Greasemonkey, and FlashGot Mass Down all contained bugs that made it possible for the malicious add-on to execute malicious code. Many of those apps, and many others analyzed in the study, also made it possible to steal browser cookies, control or access a computer's file system, or to open webpages to sites of an attacker's choosing.
    Kevin Cossaboon likes this.
  2. Kevin Cossaboon

    Kevin Cossaboon Member

    Nov 18, 2015
    Likes Received:
    Trophy Points:
    My Device:
    Surface Book
    Thank you - removed some of them.
  3. Spider

    Spider Super Moderator Staff Member

    Feb 3, 2015
    Likes Received:
    Trophy Points:
    Chicago, IL
    After removing all except for Adblock Plus, run AdwCleaner to remove any malware the add-ons may have allowed to be installed.

    AdwCleaner (Free)
    leeshor likes this.

Share This Page