NoScript and other popular Firefox add-ons open millions to new attack

  • 0 Replies
  • 517 Views
*

Offline Bugbatter

  • Microsoft® MVP
  • Administrator
  • Diamond Member
  • 10660


Unlike many browsers, Firefox doesn't always isolate an add-on’s functions.

NoScript, Firebug, and other popular Firefox add-on extensions are opening millions of end users to a new type of attack that can surreptitiously execute malicious code and steal sensitive data, a team of researchers reported.

The attack is made possible by a lack of isolation in Firefox among various add-ons installed by an end user. The underlying weakness has been described as an extension reuse vulnerability because it allows an attacker-developed add-on to conceal its malicious behavior by invoking the capabilities of other add-ons. Instead of directly causing a computer to visit a booby-trapped website or download malicious files, the add-on exploits vulnerabilities in popular third-party add-ons that allow the same nefarious actions to be carried out. Nine of the top 10 most popular Firefox add-ons contain exploitable vulnerabilities. By piggybacking off the capabilities of trusted third-party add-ons, the malicious add-on faces much better odds of not being detected.

http://arstechnica.co.uk/security/2016/04/noscript-and-other-popular-firefox-add-ons-open-millions-to-new-attack/



Microsoft MVP Consumer Security 2006-2016
Microsoft Windows Insider MVP 2016-