Will design flaws flunk Firefox?
The open source Mozilla Firefox Web browser is potentially at risk from design flaws that could allegedly let attackers take whatever they want from users' computers. Radware Security researcher Itzik Kotler is alleging that he can exploit Mozilla Firefox, and he's going to demonstrate how at Black Hat.
Kotler admitted to InternetNews.com that he specifically targeted Firefox to find vulnerabilities. "People are hacking Internet Explorer every day, and if I did the same thing on IE people would just say it's just another IE vulnerability," he said.
"I wanted to do something different," Kotler explained. "People say that it's Firefox -- it's not supposed to be as bad, and it's supposed to be safer and more secure so I took it as a challenge."
Kotler explained that his intention was to create a form of malware that didn't rely on virtualization or SQL injection but rather is completely dependent on the browser itself.
"The basic thing that Jinx implements is that it will download files from your computer and send it to a remote Web site," he said.
Kotler argued that Jinx goes beyond a basic cache reading exploit of the type that was discussed at Black Hat in 2006. Jinx is a full hard drive read allowing the attacker to access anything on the drive.
Reading a user's hard drive contents alone wasn't enough for Kotler who claimed that function alone bored him after a period of time.
To execute the Jinx framework, Kotler explained that he uses a file URI (define) handler as a way to dig into the target system. Mozilla had a number of high-profile issues with URI handling in the last year. In fact Mozilla rearchitected Firefox 3 so that it would not be at risk from the same sorts of issues that plagued Firefox 2. The third iteration was released earlier this year.
As it turns out, Kotler admitted that Jinx in its current implementation only affects Firefox 2 and not Firefox 3 specifically because of how Firefox 3 handles URIs. That said, he did note that he is confident that if he spent more time on research he could figure out a way to attack Firefox 3 or any other browser.
Kotler claims that he e-mailed his presentation to Window Snyder, Mozilla's chief security officer to disclose the issues he had discovered.
Snyder told InternetNews.com that she had received an e-mail from Kotler only last Friday about the presentation.
"My concern is that Firefox 2 is still in use and even though the same functionality isn't in Firefox 3, anything that could potentially hurt our users is a concern," Snyder said. "We're very concerned about this."
Snyder argued that Kotler did not give Mozilla enough time to evaluate the security issues prior to disclosing them.
"It would have been great if they contacted us before hand, before they released the information so we could evaluate it and see how it might affect our users," Snyder said. "Giving us the opportunity to protect our users before it's available to attackers is always preferable."
That said, the fact that Kotler may well have discovered a security flaw within Firefox is actually a positive thing for Mozilla overall.
"We always appreciate when people work on Firefox security because it does help us," Snyder said. "Once we know about it, we can fix it, but it's easier to protect our users when we have time to fix an issue before it's available publicly."
Return to internet news headlines
View Internet News Archive