Firefox exploits now in the wild

F-Secure reports:

Proof-of-concept exploits for the popular Mozilla and Firefox web browsers have been posted on public mailing lists. They target the following vulnerabilities:

– Code execution through favicons link
– Arbitrary code execution from Firefox sidebar panel

These exploits allow the attacker to run arbitrary commands on Firefox before version 1.0.3 and Mozilla before version 1.7.7.

We advice all Mozilla and Firefox users to immediately patch their browsers. Otherwise you might get nasty stuff happen on your computer just by surfing to the wrong site.

For those who know what this means, it’s blood-curdling news. A proof of concept is code that exploits a vulnerability. From that code, it’s a short step to actually creating a hostile exploit that installs a virus or Trojan horse on an unpatched computer. (Oh, and forgive the grammatical errors in the F-Secure announcement. They’re based in Finland and English is obviously a second language. Their expertise in combatting viruses is, however, second to none.)

There’s a little tiny icon in the upper right corner of the Firefox window, just below the Minimize / Maximize / Close buttons, that is supposed to alert you when an upgrade is available. The most current version is 1.0.3, and the little icon has been visible now for a couple of days, with no additional warning of any kind. In my opinion, the Firefox alert icon is way too subtle. How many people had Firefox 1.0 installed on their computer by a friend or family member over the holidays and don’t realize there have been three critical updates since then?

Curiously, the Mozilla Security Center includes no mention of the two most recent updates. As of today, the announcement at the top of the page reads:

Mozilla Foundation Announces Update to Firefox (February 24, 2005) All users should upgrade to Firefox 1.0.1, a security update to Firefox 1.0. …

And yet… The Mozilla Foundation Security Advisories page, which is linked from the Security Center, lists both Firefox 1.02 (released March 23), which fixes one critical security issue, and Firefox 1.03 (released April 15), which fixes three separate critical security issues, including the two that now have exploit code in the wild.

There’s no question that the Mozilla/Firefox team is taking their responsibility seriously, but the update mechanism is not working properly for a software program that is intended for use by the masses.

A worm with demo files

The Mytob worm is making the rounds. In the past four days, the copy of PC-cillin on my main working PC has successfully blocked seven copies of messages containing an infected attachment, and I’ve deleted a few more copies that arrived with corrupted (and therefore harmless) attachments.

But the one that shoed up this morning was hilarious. Like most mass-mailing worms, Mytob scours the infected machine to find e-mail addresses, and it uses the addresses it finds both as the destination and to forge the From: field. So this morning I received an attachment that was, ostensibly, from stephanie@contoso.com.

Anyone who’s worked with Office through the years should recognize the company instantly. Contoso.com is a fake domain registered by Microsoft and used extensively in sample files and product demos for Office and SharePoint. It’s comforting, I suppose, to know that this worm is too stupid to tell a fake domain from the real thing.

Tip of the day: Protect yourself from unwanted ActiveX controls

WARNING: The following tip contains script code that makes changes to your Windows registry. Although I have tested this script and believe it performs as described, I am not responsible for any damage that may occur to your computer if you choose to download and run this script.

The single biggest security flaw in Internet Explorer is its capability to download and run ActiveX controls. This feature is a double-edged sword. When used properly, ActiveX controls greatly expand the power of Internet Explorer. Unfortunately, the developers of spyware, adware, and other forms of crapware figured out long ago that ActiveX is a great way to sneak unwanted programs onto an unsuspecting user’s computer.

So how do you protect yourself? You could disable ActiveX programs completely. But when you do so, you cut off access to the good along with the bad. A better approach is the one that Carl Siechert and I came up with in Microsoft Windows Security Inside Out: Configure Internet Explorer so that existing ActiveX programs run as expected, but disable the ability to download new controls from any site in the Internet zone (sites in the Restricted zone are always blocked, and sites that you specifically place in the Trusted Sites zone are unaffected by this change). This configuration change makes it impossible for a Web site to push spyware/adware/crapware onto your machine. The beauty of this technique is that it doesn’t allow you (or an unsophisticated user on your computer) to be fooled into clicking Yes when you should click No. It stops new ActiveX controls cold.

In the rest of this article, I explain two ways to make this change: one that requires a series of manual steps, a second that runs automatically, using a simple script file. Note that I have only tested this script with Windows XP Service Pack 2. It will probably work with other versions of Windows, but I can’t guarantee it and don’t recommend using the script on any other Windows version. Oh, and this security tip is worth following even if you normally use Firefox as your default browser. Programs like Windows Media Player can call up Internet Explorer when you least expect it. If you’ve blocked unwanted ActiveX installations, they can’t do any damage.

Continue reading “Tip of the day: Protect yourself from unwanted ActiveX controls” →

Where’s the patch?

It’s Patch Tuesday, and Ryan Naraine at eWeek has the same question I do. Where’s the patch?

It’s been almost three months since Microsoft promised a Windows Media Player update to help thwart the threat of spyware infection but, to date, users of the WMP 9 Series remain at risk.

When the issue first surfaced in January, Microsoft officials made it clear that the spyware infection attack scenario did not exploit a vulnerability in the software.

The company later issued an update, but only for the newer WMP 10 software, which is only available on the Windows XP operating system.

When researchers pointed out that WMP 9 users remained vulnerable, Microsoft program manager Marcus Matthias said a fix would be made available at a later date. The issue remains unresolved.

Despite that missing piece, there are a host of Critical Updates out today. Make sure you have Automatic Updates turned on, or visit Windows Update.

Is this new Firefox feature a security hole?

Earlier today I posted an item about the “link prefetch” feature recently introduced in Firefox and used by Google for all searches run using Firefox.

To see exactly how this works, I performed a simple experiment.

First, I completely deleted the contents of the Cache folder in my Firefox profile. I left the directory window visible on the screen, opened Firefox, and went to the Firefox home page. After it finished loading, I refreshed the contents of the Cache folder window and observed that there were now a few small files there.

Next, I created a simple HTML page consisting of a single sentence. That sentence contained a hyperlink to a large (2.56MB) executable file on a third-party Web site. In the source code for the page I created, just before the hyperlink, I added a LINK tag using the REL=”prefetch” type, as documented in the Mozilla Link Prefetching FAQ. I uploaded this page, which was 369 bytes in size, to my Web site.

Finally, I returned to Firefox and typed in the URL of the test page I created. My tiny page loaded immediately, and over the course of the next few seconds I watched one file in the Cache folder grow to approximately 2.6MB in size. When I clicked the link to the executable file on my test page, the Firefox Downloads window appeared and almost instantly displayed the message that the download was complete. That’s not surprising, because the executable file was already in my cache.

Let me repeat that: I clicked on a link in one page, and Firefox silently, without any indication to me, downloaded a large executable file in the background and placed it in my browser’s cache.

I repeated the experiment with a much larger executable file (10MB) from a different third-party Web site, using a completely clean Firefox profile. Same result.

If you were to click on the link to my test page using Firefox, that executable code would be on your computer, downloaded from a site you never chose to visit. Now, let me be clear: That code isn’t an immediate danger. There’s no way I’m aware of for it to execute. At least not now. But if I were a bad guy, I’d be working my tail off to figure out how to get that code to execute – or to trick you into running it. I’d also be looking at other creative ways to exploit the fact that I can get you to download scripts and other content from a third-party site that you never even realized you visited. And I would surely be thinking of how I could get my pages to appear at the top of a Google search window, where they would automatically be prefetched by Firefox.

This is not a good thing.

Update: In a comment to my previous post, Alex Halderman, a PhD student in computer science at Princeton, notes that the privacy issue is a legitimate one but the security issue is less worrisome than I might fear. He writes:

There are lots of ways a site can cause your browser to load a page from another site without your knowledge: JavaScript tricks, hidden frames, etc. For legitimate uses, prefetching is preferable to these other methods, since the browser can be smart about only prefetching during idle periods. Disabling the prefetch feature will preclude these benefits without actually preventing malicious sites from loading remote pages.

On the other hand, well intentioned sites like Google need to be careful about what prefetching they cause for precisely the reasons Ed cites. Google’s users trust it not to place embarrassing content in their caches or to connect their browsers to disreputable sites. Google says only certain sites are prefetched, and I’ll bet these concerns enter into their selection algorithm.

Prefetching is also unlikely to exacerbate a vulnerability that “allows code to be executed automatically from a page that triggers a buffer overflow or exploits an unpatched scripting exploit.” The prefetched page is not rendered and any scripts it contains are not interpreted until the user actually follows a link to it. Only the HTTP and caching code is exposed to the prefetched data, and these relatively simple modules are less likely to contain exploitable holes.

I missed the part where Google says only certain sites are prefetched. I’ll have to look more closely at that.

Update 2: OK, I looked at the Google FAQ for Webmasters, which says, “Google only inserts this tag when there is a high likelihood that the user will click on the top result, but clearly this heuristic is not right 100% of the time.” I don’t see anything that suggests any concern for the privacy of the user or whether the content in the top-rated link is work-safe.

Update 3: Some interesting discussion of the issue here.

WaPo’s new security blog finds a Firefox flaw

The Washington Post has just rolled out a new blog, Security Fix. In one of the first posts, Brian Krebs describes an e-mail he received recently, which was forwarded by someone who was concerned about phishing scams:

The phishing e-mail my contact sent tried to hijack my computer in addition to directing my browser to a Web site designed to look like it was operated by a small British bank. After I got done yelling at him for sending this little nastygram without warning me, I got to looking at it a bit more closely.

In this particular phishing scam, simply clicking anywhere in the HTML e-mail caused my Firefox browser to begin downloading a file while the fake site loaded in the background. Needless to say, I killed the download immediately.

I wish Brian had provided more details, but in any event this doesn’t sound like a good thing.

Oh, and kudos to the WaPo for putting the full text of this blog in their RSS feed.

Microsoft and security: Giving credit where it’s due

Dana Epp has a fascinating post about Microsoft’s security development lifecycle:

In the past decade it has been easy to slag Microsoft for their stance on security. It has appeared that the drive for profits have always trumped the safety and security of the code. When Microsoft decided to STOP development and retrain the ENTIRE development group about secure programming, many in the industry brushed it off as a PR stunt. But as I pointed out early last year, if we look at what Microsoft has been doing as of late, we can see that they have made significant changes to build a foundation for a more secure computing experience.

Read the whole list, and bear in mind that Dana Epp knows security issues better than just about anyone. His perspective is a fascinating one here. I’m not a slavish Microsoft booster, and in fact I have been critical of some recent decisions they have made that are not consistent with their stated security goals. But anyone who thinks that Microsoft hasn’t made huge progress on security in the past four years simply isn’t paying attention.

This is the main reason you can expect that Internet Explorer 7 will be a very big deal and not a simplistic bunch of cosmetic fixes. Just watch…

From the annals of ineffective security

InformationWeek points to a new study from Jupiter Research that says Web surfers are going overboard with deleting cookies:

58 percent of Internet users have deleted the tiny files, essentially making many consumers anonymous during site visits, and crippling website operators’ ability to gather information, JupiterResearch found through surveys this year of more than 4,600 online consumers. In addition, 39 percent of consumers are deleting cookies from their primary computer monthly.

The reason for these Draconian measures is fear. Consumers are constantly reminded about the risks on the Internet posed by spyware, phishers and viruses, so deleting cookies makes them feel more secure, even though it’s unlikely to make them safer, Peterson said.

The article is oddly sympathetic to Web site administrators who can’t build profiles of their visitors. I feel more pain for the people who think that deleting cookies will have even the tiniest effect on their privacy or security.

War of the worms?

Oh, great. F-Secure says they’re seeing an alarming spike in worms spreading over instant messaging channels:

Recently we have noticed an increase in IM (Instant Messaging) worm numbers. We are regularly adding detection for new Bropia worm variants. The last one, Bropia.K, appeared yesterday, on Sunday. Today there appeared 2 more MSN worms: a variant of Kelvir and a new worm called Sumom.

When virus writers get into turf wars, you and I are usually caught in the crossfire.

Antivirus update goes haywire, security firm deletes thousands of e-mails

Silicon.com reports :

An email security scanning company has accidentally deleted thousands of its customers’ emails.

GFI, a Microsoft “gold certified partner”, is now offering free upgrades to all its customers after it trashed their emails by sending out incorrect update information.

According to GFI, the problem occurred because of a change in BitDefender’s technology, one of the products that GFI uses for its email scanning. When the GFI MailSecurity update mechanism tried to install BitDefender updates on customer networks, the service started to delete all emails by default. BitDefender and GFI then rolled back the updates.

A BitDefender spokesman said: “We’ve learned our lesson. From now on we’ll try to give more support to our integration partners. The other companies that integrate our scanning engine did not have the same problem.”

Ouch!

Readers with a keen memory may recall that BitDefender also licenses its personal antivirus software to the sleazy iDownload.com, which sells it at an inflated price under the name Virus Hunter. Sounds like the company needs to pay a lot more attention to its partners.