Vulnerabilities / Threats
4/13/2012
02:12 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Firefox To Require Permission For Plug-Ins

Mozilla hopes to make Firefox more secure by having users opt in for plug-ins.

Mozilla engineers are in the process of improving the security and speed of Firefox by implementing a permission switch for browser plug-ins.

In a blog post on Wednesday, Mozilla software engineer Jared Wein said that browser plug-ins are often the cause of security problems and system slowdowns and that "click-to-play" code has been added to Firefox nightly developer builds to control the activation of plug-ins.

"When plugins.click_to_play is enabled, plug-ins will require an extra click to activate and start 'playing' content," Wein explains. "This is an incremental step towards securing our users, reducing memory usage, and opening up the Web."

[ Read about Amazon's cloud-based search service. See Amazon Returns To Search Business With CloudSearch. ]

It may also further erode the usage of plug-in technologies such as Adobe Flash on desktop computers. In a Twitter post, privacy researcher Christopher Soghoian notes that the move "essentially kills Flash ads and Flash cookie tracking."

The impact of this new Firefox feature will depend on how it is expressed in default settings and on the various use cases that Firefox engineers end up supporting. For example, the click-to-play feature may include options to allow users to avoid having to reauthorize plug-ins on popular sites like YouTube. Mozilla does not want to make Firefox so secure it's a hassle to use. However, such conveniences could undermine potential security and privacy benefits of requiring users to approve plug-in operation.

Google Chrome has for a while now included a similar permission mechanism for plug-ins, accessed via Settings/Under the Hood/Privacy-Content Settings/Plug-ins. But Chrome's engineers evidently believe that users will have a better experience without having to approve plug-ins: "Run automatically" is singled out as the "recommended" option.

Mozilla is also considering whether to let previously granted plug-in approval expire if the plug-in has not been used in the past 30 days.

Apple recently adopted this expiration date approach to deal with the Flashback trojan that has affected over 600,000 Macs. In its security update released on Thursday, Apple said, "As a security hardening measure, the Java browser plug-in and Java Web Start are deactivated if they are unused for 35 days."

"Click-to-play" for plug-ins is scheduled to arrive in Firefox 14.

When picking endpoint protection software, step one is to ask users what they think. Also in the new, all-digital Security Software: Listen Up! issue of InformationWeek: CIO Chad Fulgham gives us an exclusive look at the agency's new case management system, Sentinel; and a look at how LTE changes mobility. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Bprince
50%
50%
Bprince,
User Rank: Ninja
4/14/2012 | 2:22:32 PM
re: Firefox To Require Permission For Plug-Ins
@readers: do you think this will have a positive impact on plugin security, and do you see it hurting the use of plugins overall?
Brian Prince, InformationWeek/Dark Reading Comment Moderator
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-2595
Published: 2014-08-31
The device-initialization functionality in the MSM camera driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, enables MSM_CAM_IOCTL_SET_MEM_MAP_INFO ioctl calls for an unrestricted mmap interface, which all...

CVE-2013-2597
Published: 2014-08-31
Stack-based buffer overflow in the acdb_ioctl function in audio_acdb.c in the acdb audio driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges via an application that lever...

CVE-2013-2598
Published: 2014-08-31
app/aboot/aboot.c in the Little Kernel (LK) bootloader, as distributed with Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to overwrite signature-verification code via crafted boot-image load-destination header values that specify memory ...

CVE-2013-2599
Published: 2014-08-31
A certain Qualcomm Innovation Center (QuIC) patch to the NativeDaemonConnector class in services/java/com/android/server/NativeDaemonConnector.java in Code Aurora Forum (CAF) releases of Android 4.1.x through 4.3.x enables debug logging, which allows attackers to obtain sensitive disk-encryption pas...

CVE-2013-6124
Published: 2014-08-31
The Qualcomm Innovation Center (QuIC) init scripts in Code Aurora Forum (CAF) releases of Android 4.1.x through 4.4.x allow local users to modify file metadata via a symlink attack on a file accessed by a (1) chown or (2) chmod command, as demonstrated by changing the permissions of an arbitrary fil...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
This episode of Dark Reading Radio looks at infosec security from the big enterprise POV with interviews featuring Ron Plesco, Cyber Investigations, Intelligence & Analytics at KPMG; and Chris Inglis & Chris Bell of Securonix.