Re:How to install silently malicious extensions for Firefox
by Svip on Wednesday January 16, 2013 @10:28AM
(#5067179)
You are correct. His point is that one can use this trick to install programs that Anti-Virus programs cannot detect, because they are part of the browsers, unlike perhaps a service.
Because while having control of a system is 'winning', one still wish to do damage relatively undetected (if one's intent is to use the machine as a zombie, for instance). And doing it through Firefox is a very undetectable way to do so.
Re:How to install silently malicious extensions for Firefox
by jerf on Wednesday January 16, 2013 @09:43AM
(#5066986)
I just carefully re-read the text, and it never quite claims this is a security issue with Firefox. (I did not watch the video, so if it's in there, I did not see it.) It just says a lot of various true things, and leaves the implication hanging in the reader's mind without addressing it. I agree that it would be improved if the author was more clear that this is just the way of things in our current user-based permission model and there isn't anything Firefox can do to truly stop this.
As a factual presentation, it is worth pointing out to interested people that Firefox's protection is only advisory, and not completely perfect.
To pull this off you need write access to Firefox's SQLite database.
If you have write access to Firefox's SQLite database you've already 'won', the system is already yours. You can do a lot more damage to the system than whitelisting a Firefox extension.
Sure you could argue that this is another place for malware to hide - but I don't that this is really a security flaw in Firefox.