Spyware Disguises Itself as Firefox Extension

Juha-Matti Laurio writes "The antivirus specialists at McAfee have warned of a Trojan that disguises itself as a Firefox extension. The trojan installs itself as a Firefox extension, presenting itself as a legitimate existing extension called numberedlinks. It then begins intercepting passwords and credit card numbers entered into the browser, which it then sends to an external server. The most dangerous part of the issue is that it records itself directly into the Firefox configuration data, avoiding the regular installation and confirmation process."

How does it work?

[Klaidas]

Does it install simply by browsing, or does it need to open an .exe? Or do you install it like a normal extension?
If it's #1, it's bad
If it's #2, not so bad - a simple virus
If it's #3 - hey, who install extension from non-oficial sources?

Re:Not a vulnerability.

[DrXym]

Well yes it is. Firefox extensions are an easy way to trojan a system. Anyone can write an extension and put it up on the addons site and there isn't even the requirement that it be signed. There is no enforcement of trust at all except for a primitive domain whitelist system. I think it would be fairly trivial to produce a malicious extension. Worse, you could even craft one that works on Linux, OS X and Windows in one fell swoop, since you have unfettered access to all of the XPCOM objects running in Firefox.

My feeling is that Firefox desperately needs to implement some kind of trust model. I can understand why that might not be RSA PKCS since the system is crap for small publishers. But something is needed. Even a trust model based on PGP signing would be of benefit.

I'm sure some would argue that no one looks at signatures anyway, which might be an exaggeration, but it does have some truth. It is certainly no excuse for offering no trust model at all, or for Firefox UI designers to not be able to produce some simple traffic light trust system with sensible defaults to simplify it for those who can't or won't look at the certs.

Re:Not a vulnerability.

[dschuetz]

Note that this isn't a Firefox vulnerability. The trojan is opened as a Windows executable from email attachments, and writes itself into the Firefox profile's configuration directory.

While true, perhaps a related problem that actually is a vulnerability is the fact that Firefox (apparently) only checks for a valid signature on the plugin at download/install time. Maybe the Firefox configuration file, or at the very least the binaries for each extension, should be cryptographically verified at runtime.

Of course, this presupposes that Firefox hackers can manage to get their extensions signed, and if that's possible, then the malware authors could do the same. Unless...FF gets distributed with a mozilla.org CA cert, and extensions accepted and published on the mozilla site(s) get signed with that cert, then every "legitimate" extension from the mozilla sites will be verifiable at runtime. The user could opt out of that with an "allow execution [not installation] of unsigned extensions" preference setting, but the majority of users would be protected, so long as the malware doesn't also set that preference for the user. :)

(though even that last bit could be guarded against by creating a personal key to sign the config with, and every time you make a "security relevant configuration change" to the browser's settings, you have to re-sign the file.)

The tip of the iceberg...

[Anonymous Coward]

People seem to be awfully dismissive of this, but it poses a real problem. Given the number of available vectors, even careful Firefox users can get struck by virus/spyware/other attacks (even OpenSHH has critical security vulnerabilities from time to time, and it is specifically designed for security). More sophisticated extension hacks aren't too far away. Given the level of extensibility offered via extensions, it sounds plausible that extensions may be delist themselves from the extension manager (a la rootkit techniques). Even if the Moz team had the foresight to prevent such a hack, it is pretty trivial to simply infect an existing extension. Simply inject your hostile javascript code into the extension files to get loaded along with the host extension. Maybe modify existing javascript that is provided in a default installation, such as the search engine plugins. Plus, you get the added benefit of cross platform compatability for your Firefox hacks.

This is the proverbial shot across the bow. Perhaps it's time for crytographically signed extensions? It may not protect from someone explicitly installing a hostile extension, but it may prevent the self-installation of this kind of software from succeeding.

It is a vulnerability.

[mobby_6kl]

Firefox isn't doing anything to prevent it, so it's a Ff vulnerability.

At least, that's how it works for other software.

Re:Personally...

[celardore]

In that case... Who runs an exe they receive in an email? Unless I'm expecting it, and know the sender, I certainly won't.

Education must be the answer then. I learned not to open random executables from unknown sources many years ago. People apparently click them though. Teach a man to use the internet, and he'll be safe for a day. Teach a man to know the internet and he'll be safe for a lifetime.

Re:Why is mozdev.org still...

[radish]

Hate to break it to you but ALL software is potentially bad. You have to decide how much you trust it based on who wrote it, whether that's verifiable, your own inspection of the source, whatever. In the case of F/OSS you do at least have to option of inspecting the source. You have no such luxury with non-free software, in which case you simply have to decide how much you trust the publisher.

Re:Not a vulnerability.

[KiloByte]

... or until the trojan makes a trivial change in FireFox's binary.

Once you're pwned, you're pwned. If you give someone free reign on your box, he can do anything to any file writeable by you.

Re:Not a vulnerability.

[greed]

While true, perhaps a related problem that actually is a vulnerability is the fact that Firefox (apparently) only checks for a valid signature on the plugin at download/install time. Maybe the Firefox configuration file, or at the very least the binaries for each extension, should be cryptographically verified at runtime.

Once someone's system is compromised, they can replace or alter the FireFox binary which verifies the signatures, replace libnssckbi.so, libsoftokn3.so, whatever.

You can't win at that point. If you're storing your operating system and executables on writable media, it can never be trusted to that level. The hardware would have to cryptographically verify the boot loader on disk, which would verify the kernel, which would then be able to verify everything it executes--FireFox alone can't do it.

(Say, what was that hardware-based Trusted Computing stuff supposed to do? In addition to ramming DRM down everyone's PCI bus, wasn't there system verification too?)

Re:FUD

[LurkerXXX]

What you don't seem to realize is that IE isn't embedded in 3rd party email clients like Thunderbird and Eudora, but the attachment will still hammer Firefix when you run it, just as it will in Outlook.

Re:Why is mozdev.org still...

[Anonymous Coward]

you will be labeled a hacker/cracker whether you like it or not; innocent or not.

And, until this is settled, I will consider anything you develop to be suspect.

Then that makes you part of the problem, asshole. It's not the legitimate author's responsibility to police every malicious programmer and make sure that they are not using the same name as something that is legitimate. If he has the name of his extension legally registered, and the author of the malware gets identified, then the legitimate author can sue for infringement, but that's the only recourse he has. He just has to hope that malinformed assholes like yourself are the minority.

Re:Not a vulnerability.

[archen]

I think you'll still end up with the same problems though. Where does firefox keep it's list of trusts? In the registry, or a config file? People will want to develop/install plugins that aren't signed so you'll need to be able to make exceptions. Where will the settings for the exceptions be stored? In the registry or config file?

I think this just gives you a false sense of security. If you're OS were secure and you knew for a fact that no one else could ever write to the firefox config files or the registry, you could sign things just fine. But this isn't a man in the middle attack, but more like a "man in the backroom" attack. And that's exactly what this spywhere does.

Re:FUD

[Firehed]

As with anything else, this requires you to be enough of a moron to run an attachment received in a spam message (which theoretically requires you to be enough of a moron to actually read your spam). It's much more of a PEBKAC problem than a vulnerability of any piece of software. I don't know about Eudora, but I've found Thunderbird's spam filtering to be excellent, something not even offered the last time I used a MS-made client, which hypothetically reduces the risk of you running the thing, though that's pushing it.

It's probably worth considering that most people smart enough to have switched to Firefox are also smart enough not to think "oooh, cool, free file, better see what it does!!!1".

Re:Emphasis on that.

[dedazo]

This is an Outlook/IE "virus" who's payload is a keylogger and crap that hooks into Firefox.

This is an user-executed email attachment with a trojan. It will happily be executed from Outlook Express, IE, Eudora and Thunderbird. McAfee mentions they've seen one version trying to exploit a three year old IE vulnerability. If you haven't patched that, well then you deserve to get nailed.

This does not exploit any vulnerability in Firefox

It is a vulnerability in that FF will happily load and execute any plugins dropped into its profile directory. The only time you are warned about installing someone is at download time. FF will never check for a signature or otherwise go "oh, a new plugin I've never seen. Hmmm, maybe I should ask the user about it?". Vulnerability.

If your OS is not secure, no app running on it can be secured.

If your OS is being operated by a user that executes attachments from "WalMart" that read "helo, teh attcachements for yuo pleasures" then your OS is not secure.

BTW, this progression is interesting. When FF came out just installing it would make the world safe, because it was invulnerable and impervious. Now I also have to switch operating systems? And when someone finds another exploit in SSH

Re:Not a vulnerability.

[Drachemorder]

Any piece of software capable of running executable code is vulnerable to trojans. Anyone can write an executable program to do nasty stuff, and there's no reasonable way for an application to tell the difference. Firefox can't figure out on its own that an extension which deletes files or sends email is malicious, because such functionality can conceivably be useful. The only real solution is to educate people about running untrusted executable code, and Firefox already takes every reasonable precaution to do so. So much so, in fact, that it's a bit annoying when you really do want to install an extension. Trojans are a form of social engineering; with enough effort you can convince most people you're trustworthy, and there's very little that can be done to prevent that sort of activity, except perhaps educating people about the possibility.

So the problem isn't the software. It's the people using the software. As more people learn about Firefox, we'll just have to accept that some of them are going to be stupid. It's a statistical inevitability. You can fix security holes all day, but you can't fix stupid.

Re:Firefox is horribly vulnerable; I have proof.

[Itninja]

How does this make FF 'horribly vulnerable'? The WMF flaw is, by definition, a Windows problem not a FF one. That's like saying your new alarm system is flawed because someone left the front door unlocked.

Signatures don't matter here

[sterno]

You are talking about a situation where an executable has been run with your priveleges. It can do anything it wants to, especially in Windows where most people run as Administrators. It can disguise itself as a firefox extension, sure. But it could also modify the firefox binary, or simply install a sniffer running as a service, or format your drive, or any number of nasty things.

The only place a singature would matter in this case is when the trojan executable was run. If you are executing attached executables from an e-mail, then no amount of signature verification is going to protect you. The reality is that no technical process can exist that will prevent this kind of attack so long as users can install their own software.

Looking at the big picture!

[Aeomer]

Forget the debate on FF vs IE and WinXX vs *nix - otherwise known as the 'My dad is bigger than your dad!' department. The issue is that an exploit, however it arrived on the machine, is targeting Firefox. All those smug 'it can't happen to me because I use xxxx version of yyyy product/os' should see this as the beginning of an onslaught on all *nix and open source projects in general. Yes, I realise this exploit was specifically on Windows but you are missing the big picture. That being an open source project went from a minor player to a major competitor and so became a big target. You may feel safe in your (insert *nix here) OS but the end of that house of cards is in sight. 'But I know what is secure and what is not, and my system is harded against such stuff!', I hear you cry. Well, if you realise that more and more people are running *nix based desktops and most of those new users have and need only basic 'Clue' on how to run their browser and wordprocessor then we are looking at an ever expanding problem. How long will it be before everyday users are downloading distros with Spyware built right into the kernel? 'But, I know how check a distro is genuine!!!', I hear you cry again. And again I say what about your average user - do they know instinctively how to check hashes on everything they download? No they do not! Mark this date in your calender - the end of OS smugness is in site.

Re:It is a vulnerability.

[peacefinder]

In general, if the next lower layer can't be trusted, the security of whatever you're evaluating is screwed.

By way of example, at my previous job I used a linux boot floppy to change the local administrator password on a Windows NT4 system, thus owning the machine at the next boot. By an extension of your standard, this represented a Windows vulnerability, because whatever measures Windows may have taken to prevent such a thing (like NTFS) were ineffective.

I think that's a clear mis-assessment of the true vulnerability: the problem wasn't that Windows couldn't handle tampering, but that the machine itself was physically unprotected from tampering. (Fortunately, I was an authorized tamperer.)

Likewise, it is unreasonable to expect any app to successfully defend itself from its host OS. Firefox might make OS-level tampering harder, but it cannot prevent it. Therefore I agree with the grandparent poster that this is not a firefox vulnerability.

Re: Emphasis on that.

[PhoenixPath]

No. It's not.

Any extension downloaded from addons.mozilla.org has been tested, is widely used, and subject to an enormous amount of user feedback.

Now, if you download an extension from kickme.to/malware, you get what you deserve.

firefox -safe-mode &

[alskjdfasd]

i always run firefox in safe-mode. i know that extensions cannot be loaded, but the only important firefox extensions i used to use are now replaced by web proxies. for example, i used to use livehttpheaders, tamperdata, and modifyheaders. with burp, suru, webscarab, and xss-proxy, these extensions lack the significance they once had. for people that are heavy into extensions and themes, maybe you should first ask yourself why, and then weigh the benefits versus the drawbacks.

i also change a few settings in options->content and about:config to prevent javascript from doing anything but the basics. since i'm always bouncing back between windows xp, linux, freebsd, and mac os x - it's nice to be able to acheive such consistency and still know what my baseline for browser security posture is.

there is worse spyware out there these days anyways. see: http://theinvisiblethings.blogspot.com/2006/06/int roducing-blue-pill.html [blogspot.com]

Re:Not a vulnerability.

[cyber-vandal]

Not as priceless as the look on my face on reading that and noting that that clueless muppet gets paid a lot more than I do. Maybe I should get off my arse and get one of them MCSE thingies.

Re:Not a vulnerability.

[arose]

It would be TRIVIAL to insert a trojan onto that site.

I still don't see how that differs from a trojan on, say, SourceForge--that's just how trojans are.

The funny thing is IE was panned for ActiveX control issues and yet Firefox contains something just as serious in extensions.

IMHO problem with ActiveX are the seemingly endless vulnerabilities that enable drive by installations, I don't see this with Firefox.

It is true that extensions must be voluntarily fetched by a user so the user base as a whole has a lot of protection, but it does not excuse the lack of trust information for the poor sucker who caught a dose from Mozilla's own web site.

And your proposition for a distributed system of trust information that is transparent to users is? Sure, PGP/GPG signing might benefit to those who watch where they step, but it does little for those who are most susceptible to trojan attacks.

Re:Emphasis on that.

[mrchaotica]

It is a vulnerability in that FF will happily load and execute any plugins dropped into its profile directory. The only time you are warned about installing someone is at download time. FF will never check for a signature or otherwise go "oh, a new plugin I've never seen. Hmmm, maybe I should ask the user about it?". Vulnerability.

Okay, and then the next trojan will simply add itself to the file that Firefox checks to see if the extension is new, and you're back to square one.

Firefox isn't the problem. The fact that the thing can write to the application's directory means the computer is already compromised.

Re:Not a vulnerability.

[Anonymous Coward]

Look, I got my MCSE in 1999, and I had to know how to use ipconfig and route as part of the course -- now, did that get covered in the test? I don't know. But it was part of the work we had to do in the TCP/IP module. It's depressing to me because I think MCSE used to mean something, but I also have encountered dolts who have a raft of acronyms after their email signature, and it's almost a sure-fire way of identifying useless chumps in the organization. I don't advertise my MCSE in my signature, and I instead refer to my 11 years' experience as my qualification for doing what I do: that, and the fact that almost everyone in the organization comes to me when they want something done right.

Re:Emphasis on that.

[penix1]

"The only saving grace for Linux at this point in time is that your average Linux user is smart enough to not execute random executable files they receive from people they don't know in an email message."

Although I agree with this statement, a lot of the time the really nasty ones are spread by people you *DO* know. You know the type. This is the user that actually believes clicking "Remove me from this list" will actually remove them from that spammer's list. These also tend to be those people that clog the email system with "try this! It really works!" messages.

B.

Re:Not a vulnerability.

[Anonymous Coward]

I have modpoints now, and could have given you one, had you not written:

"winbloze"

Please remember that for the future. It's sad *nix fanboyism to write such words, as are forms of "Microsoft" with a string symbol($) in it, variations on "Windows" and constructions with "Internet Explorer". Thank you.

Your comment was otherwise insightful, and you hit the nail on the head, but then you had to go and spoil it all by saying "Winbloze" ...