Vulnerabilities / Threats
4/13/2012
02:12 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Firefox To Require Permission For Plug-Ins

Mozilla hopes to make Firefox more secure by having users opt in for plug-ins.

Mozilla engineers are in the process of improving the security and speed of Firefox by implementing a permission switch for browser plug-ins.

In a blog post on Wednesday, Mozilla software engineer Jared Wein said that browser plug-ins are often the cause of security problems and system slowdowns and that "click-to-play" code has been added to Firefox nightly developer builds to control the activation of plug-ins.

"When plugins.click_to_play is enabled, plug-ins will require an extra click to activate and start 'playing' content," Wein explains. "This is an incremental step towards securing our users, reducing memory usage, and opening up the Web."

[ Read about Amazon's cloud-based search service. See Amazon Returns To Search Business With CloudSearch. ]

It may also further erode the usage of plug-in technologies such as Adobe Flash on desktop computers. In a Twitter post, privacy researcher Christopher Soghoian notes that the move "essentially kills Flash ads and Flash cookie tracking."

The impact of this new Firefox feature will depend on how it is expressed in default settings and on the various use cases that Firefox engineers end up supporting. For example, the click-to-play feature may include options to allow users to avoid having to reauthorize plug-ins on popular sites like YouTube. Mozilla does not want to make Firefox so secure it's a hassle to use. However, such conveniences could undermine potential security and privacy benefits of requiring users to approve plug-in operation.

Google Chrome has for a while now included a similar permission mechanism for plug-ins, accessed via Settings/Under the Hood/Privacy-Content Settings/Plug-ins. But Chrome's engineers evidently believe that users will have a better experience without having to approve plug-ins: "Run automatically" is singled out as the "recommended" option.

Mozilla is also considering whether to let previously granted plug-in approval expire if the plug-in has not been used in the past 30 days.

Apple recently adopted this expiration date approach to deal with the Flashback trojan that has affected over 600,000 Macs. In its security update released on Thursday, Apple said, "As a security hardening measure, the Java browser plug-in and Java Web Start are deactivated if they are unused for 35 days."

"Click-to-play" for plug-ins is scheduled to arrive in Firefox 14.

When picking endpoint protection software, step one is to ask users what they think. Also in the new, all-digital Security Software: Listen Up! issue of InformationWeek: CIO Chad Fulgham gives us an exclusive look at the agency's new case management system, Sentinel; and a look at how LTE changes mobility. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Bprince
50%
50%
Bprince,
User Rank: Ninja
4/14/2012 | 2:22:32 PM
re: Firefox To Require Permission For Plug-Ins
@readers: do you think this will have a positive impact on plugin security, and do you see it hurting the use of plugins overall?
Brian Prince, InformationWeek/Dark Reading Comment Moderator
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2227
Published: 2014-07-25
The default Flash cross-domain policy (crossdomain.xml) in Ubiquiti Networks UniFi Video (formerly AirVision aka AirVision Controller) before 3.0.1 does not restrict access to the application, which allows remote attackers to bypass the Same Origin Policy via a crafted SWF file.

CVE-2014-5027
Published: 2014-07-25
Cross-site scripting (XSS) vulnerability in Review Board 1.7.x before 1.7.27 and 2.0.x before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via a query parameter to a diff fragment page.

CVE-2014-5100
Published: 2014-07-25
Multiple cross-site request forgery (CSRF) vulnerabilities in Omeka before 2.2.1 allow remote attackers to hijack the authentication of administrators for requests that (1) add a new super user account via a request to admin/users/add, (2) insert cross-site scripting (XSS) sequences via the api_key_...

CVE-2014-5101
Published: 2014-07-25
Multiple cross-site scripting (XSS) vulnerabilities in WeBid 1.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) TPL_name, (2) TPL_nick, (3) TPL_email, (4) TPL_year, (5) TPL_address, (6) TPL_city, (7) TPL_prov, (8) TPL_zip, (9) TPL_phone, (10) TPL_pp_email, (11) TPL_authn...

CVE-2014-5102
Published: 2014-07-25
SQL injection vulnerability in vBulletin 5.0.4 through 5.1.3 Alpha 5 allows remote attackers to execute arbitrary SQL commands via the criteria[startswith] parameter to ajax/render/memberlist_items.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Sara Peters hosts a conversation on Botnets and those who fight them.