Language Selection

English French German Italian Portuguese Spanish

Silent installs of add-ons still possible in Firefox

Filed under
Moz/FF

A security researcher has demonstrated how it is still possible to silently install extensions, or as Mozilla calls them add-ons, for the open source Firefox web browser. In a blog post, Julian Sobrier of ZScaler detailed the process, which makes use of the fact that Firefox uses an Sqlite3 database to maintain information about which add-ons are installed and, of those, which ones have been approved by the user.

This feature, introduced in Firefox 8, was designed to stop toolbars and other applications adding in their own add-ons without informing the user. Sobrier's technique shows though that the mechanism is relatively easy to overcome. Add-ons have privileged access to the browser and therefore a malicious add-on could do anything including stealing the user's history, modifying pages' contents or disabling security features in the browser.

rest here




More in Tux Machines

Python 3 Support Added To The GNOME Shell

The GNOME Shell 3.15.2 release fixes some visual glitching, improves the layout of the extension installation dialog, supports the CSS margin property, and offers other bug fixes and minor enhancements. Most notable to GNOME Shell 3.15.2 though is there's finally Python 3 support. Many GNOME components have long ported their Python 2 code to Python 3 while GNOME Shell's Python support has just received the Py3 treatment. Details on GNOME's overall Python 3 porting work can be found via this Wiki page. Read more

Clonezilla Live 2.3.1-15 Now Available with Check for 32-bit Libraries

Clonezilla Live is a Linux distribution based on DRBL, Partclone, and udpcast that lets users perform bare metal backup and recovery with ease. The developers have just upgraded the system and it's now at version 2.3.1-15. Read more

Workaround Found for Annoying Workspace Switcher Bug in Ubuntu 14.10

The virtual desktops on Ubuntu systems have been working very well in the last few editions, but it looks like there is a problem in Ubuntu 14.10, at least for the system I'm running. The desktop locks up with the workspace switcher activated. Read more

Inside Cisco's OpenStack Cloud Strategy

Cisco first got involved with the open-source OpenStack cloud platform in 2011 with the Bexar release and initially was focused mostly on networking. Over the last several years, Cisco's OpenStack involvement and product portfolio have grown beyond just networking. Read more