http://arstechnica.com/security/2016/04/noscript-and-other-popular-firefox-add-ons-open-millions-to-new-attack/
NoScript and other popular Firefox add-ons open millions to new attack
NoScript, Firebug, and other popular Firefox add-on extensions are opening millions of end users to a new type of attack that can surreptitiously execute malicious code and steal sensitive data, a team of researchers reported.
>firecucks
>once, never again
>Because risks such as this one exist, we are evolving both our core product and our extensions platform to build in greater security. The new set of browser extension APIs that make up WebExtensions, which are available in Firefox today, are inherently more secure than traditional add-ons, and are not vulnerable to the particular attack outlined in the presentation at Black Hat Asia. As part of our electrolysis initiative—our project to introduce multi-process architecture to Firefox later this year—we will start to sandbox Firefox extensions so that they cannot share code.
Are they seriously shitting on their single remaining selling-point (powerful and thus actually useful addons) just to color the upcoming deprecation of addons as a GOOD thing!?
"First, someone must go through the trouble of installing the trojanized extension."
So it's nothing.
>>53893536
The directors just want more money in the shortest amount of time. They don't give a fuck about the actual product. Even though it'll die in the long run.
This notion has been reiterated countless times on hacker news
>>53893588
Like it has ever been a real stumbling block to either install malicious code onto a target machine or get some dumb user to do it for you.
If that barrier was insurmountable, we wouldn't even have malware as we know it today.
Too late for me
>>53893697
since enforcing addon-signing, sideloading doesn't work anymore though.
>>53893698
you've already been hacked.
>mess with the best, die like the rest
>it allows an attacker-developed add-on to conceal its malicious behavior
Holy fucking shit, stop the presses!
OP you're a retard
>>53893698
That happens whenever you click around on a 4chan page while the captcha thing is loading. If you click on that image, like the window tells you to try, it'll switch to an image of the 4chan page you're on, where you clicked.
>The researchers noted that attackers must clear several hurdles for their malicious add-on to succeed. First, someone must go through the trouble of installing the trojanized extension. Second, the computer that downloads it must have enough vulnerable third-party add-ons installed to achieve the attackers' objective.
Oh, look, it's fucking nothing.
>>53893377
>HOLY SHIT THERE IS A VULNRABILITY IN SOFTWARE (YOU) USE
>...but you have let the attacker install x on your...
every
single
time
firecucks is ded
>>53894304
it's the war on general purpose computing.
before:
>omg, malware is dangerous because it can do shit without you knowing
now:
>omg, malware is dangerous because it does shit after you install it
curated walled gardens is the future.
>>53893698
>using new captcha
> extensions can be hacked if they are hacked
you don't fucking say.........
>>53893377
What a waste of dubs.
>>53895495
fuck you
>>53894286
Better than fucking uhide origin. If I wanted just to hide ads I would close my eyes.
>>53894694
>curated walled gardens is the future.
I only trusted Steve Jobs as my walled garden curator and he's dead.
>>53893377
>Unlike many browsers, Firefox doesn't always isolate an add-on’s functions.
I wonder if that's because other browser are chromium with different make up or IE/Edge.
>First, someone must go through the trouble of installing the trojanized extension.
>Second, the computer that downloads it must have enough vulnerable third-party add-ons installed to achieve the attackers' objective
Why would anyone support Firefox management team at this point? They are intentionally crashing their show. I really don't want to have to learn greasemonkey or similar filtering, but its becoming necessary is a possibility now, fuck.
>>53893377
>First, someone must go through the trouble of installing the trojanized extension. Second, the computer that downloads it must have enough vulnerable third-party add-ons installed to achieve the attackers' objective.
Trust OP to just read the title.
>>53893377
>The researchers noted that attackers must clear several hurdles for their malicious add-on to succeed. First, someone must go through the trouble of installing the trojanized extension
It's fucking nothing.
"if you download a trojan bad things will happen!!"
whoa, really?
