How to install silently malicious extensions for Firefox

Re:How to install silently malicious extensions for Firefox by martinced on Wednesday January 16, 2013 @10:58AM (#5067336)

Plugins and automatic security updates (or any update for what it is worth) are two biggest security holes ever.

Which is why for anything really sensitive I'm booting from a live CD, giving me a system which is "read-only" and not "phoning home" to see if there are updates.

It's a pain. But less of a pain than getting root'ed / admin'ed.

Signed binaries ain't helping either: we've seen several seemingly "legit" software signed with compromised keys.

False sense of security.

[ Parent | on HN ]

Re:How to install silently malicious extensions for Firefox by atesti on Wednesday January 16, 2013 @01:30PM (#5068241)

Plugins are not security holes! Sure they make it slightly more accessible to e.g. steal browser passwords, but you can always inject code into other processes to do such things.

[ Parent | on HN ]

Re:How to install silently malicious extensions for Firefox by Armbrs on Wednesday January 16, 2013 @03:19PM (#5068821)

The presence of other security holes doesn't invalidate the existence of this one.

[ Parent | on HN ]

Re:How to install silently malicious extensions for Firefox by atesti on Wednesday January 16, 2013 @04:09PM (#5069045)

I really don't consider this a security hole!

This does not increase privileges of the attacker: If the attacker can modify Firefox's profile directory it could also inject something into firefox or read the cookies directly.

[ Parent | on HN ]