Mozilla: Security Remains on Front Burner
453367
With the release of its latest Firefox 2.0.0.5 browser, the chief security officer at Mozilla says they have fixed a number of potentially serious vulnerabilities.
416887
(InfoWorld) - Makers of some of the most popular extension software used by the Firefox browser are not doing enough to secure their software, a security researcher said Wednesday. The problem is that many widely used Firefox extensions, including toolbars from Google, Yahoo, and AOL, do not use secure connections to update themselves, according to Christopher Soghoian, a security researcher who blogged about the issue on Wednesday. Soghoian is best known as the researcher who attracted the attention of the FBI late last year after publishing a tool that could be used to print fake boarding passes. The Indiana University doctoral student discovered the Firefox issue last month while examining network traffic on his computer. He noticed that many of the most popular Firefox extensions are not hosted on servers that use the SSL Web protocol. SSL Web sites, which begin with "https://," use digital certificates to provide users with some level of assurance that they're not connecting with a fake server. Although the corporation behind Firefox, Mozilla, hosts the majority of Firefox extensions on its own SSL-enabled Web site, it is common for commercial extension-makers like Google to host their software on an unsecured site, Soghoian said in an interview. This leaves users vulnerable to a "man-in-the middle" attack, where Firefox could be tricked into downloading malicious software from a site it mistakenly thought was hosting an extension. It wouldn't be easy for an attacker to pull this off, however. In one scenario, the hacker would set up a malicious wireless access point in a public area where people are using wireless connections. He could then redirect extension update traffic to a malicious computer. "An attacker who sets up a wireless access point can then infect anyone who connects to it," Soghoian said. The Del.icio.us Extension, Facebook Toolbar, Ask.com Toolbar, LinkedIn Browser Toolbar, Netcraft Anti-Phishing Toolbar, and PhishTank SiteChecker are also vulnerable to this issue, Soghoian said. Though Soghoian said Firefox users should avoid extensions that are not from the secure Firefox add-ons site, not all security researchers see this as a major issue. "It's just yet another vulnerable design among billions,"said Gadi Evron, security evangelist for Beyond Security. "I don't see it as that critical. There is no inherent vulnerability, but it does make the over-whole design weaker, and that should probably be addressed" Evron said it was "silly" that sites weren't using SSL for these extensions. Soghoian said he notified Google, Yahoo, and Facebook of the issue in mid-April, but nobody had addressed the issue as of Wednesday. Just hours after Soghoian went public with his findings, Google said it would "soon" have a fix for the problem. It's common for Web developers to ignore security in the rush to push out new and cool features, Soghoian said. "Your average Web 2.0 developer doesn't learn about security," he said. "Google has a spectacular security team ... my suspicion is that one hand wasn't talking to the other."
363317
Mozilla has issued 10 patches including three for critical vulnerabilities.
424227
While Microsoft's Internet Explorer has become the bane of computer security, switching to Mozilla may not be the simple answer after all. Security firm Secunia has issued a "highly critical" advisory that details 10 separate vulnerabilities found in Mozilla, Firefox and Thunderbird. The flaws can be exploited remotely, allowing an attacker to compromise a system and expose sensitive data. Mozilla users are urged to upgrade to the latest releases of each application, which contain the necessary fixes.
287575
Firefox continues to bite into Internet Explorer's market share. But users and analysts say that Mozilla hasn't changed its laissez-faire attitude about trying to get IT managers to formally adopt the open-source browser.
664847
The relatively new world of online applications is grappling with security issues. Is Web security where it should be? And where should it be going?
599385
Opinion: Internet Explorer is insecure junk, and it&#39;s time for Windows users to move to Firefox if they want to protect their systems.
188255
Pass the parcel bug binned Mozilla has pushed out a new version of Firefox that fixes a number of security bugs, including a high-profile bug involving launching Firefox from Internet Explorer.â¦
519764
Cure worse than disease The Mozilla Foundation has patched a faulty patch that was itself subject to a security vulnerability.â¦
739533
A vulnerability in the way the Firefox browser handles Javascript drew attention at a Saturday presentation at the ToorCon hacker conference, and Mozilla developers entered the week "heads down" in search of a solution.
307904
The publicity avalanche surrounding FireFox continues unabated. News.com profiles developers at the forefront of the FireFox developer movement and explains how some crafty developers are taking advantage
128986
Users of the Mozilla and Firefox browsers and the Thunderbird e-mail client may be vulnerable to flaws that could allow an attacker to spy on or take over a system, according to security researchers.
98455
Mozilla's Firefox 2.0 has long been considered a safer Web browser than Microsoft's Internet Explorer, but a new flaw in the Firefox Password Manager, which lets users store usernames and passwords for trusted Web sites, could let hackers steal their login data.
88616
Surf's up for privacy A modified version of Mozilla Firefox that lets users browse the web anonymously has been released.â¦
674476
The day has finally arrived for the Mozilla Foundation and its sleep-deprived developers; Firefox 1.0 is out the door, ready to make its official debut. Billed as a faster, more secure alternative to Microsoft's Internet Explorer, Firefox has already garnered rave reviews and ignited the browser war flames once again.
585748
Mozilla Corp. released updated versions of Firefox Friday to patch 14 vulnerabilities, three of them critical, but it pushed out the new versions without fixing several flaws.
561018
It's raining security updates Mozilla pushed out a new update of Firefox on Thursday that fixes ten security vulnerabilities, three of which are deemed critical.â¦