Will Design Flaws Flunk Firefox? Firefox 2 Potentially at Critical Risk Sean Michael Kerner
The open source Mozilla Firefox Web browser is potentially at risk from design flaws that could allegedly let attackers take whatever they want from users' computers. Radware Security researcher Itzik Kotler is alleging that he can exploit Mozilla Firefox, and he's going to demonstrate how at Black Hat.
Kotler's exploit framework for Firefox is called Jinx, and it utilizes JavaScript to enable an attacker to read anything from a user's hard drive. Jinx could potentially put millions of users at risk if Kotler is correct in his risk assessment. Mozilla is concerned about the issue, though it isn't certain of what the risk actually is to users.
Kotler admitted to InternetNews.com that he specifically targeted Firefox to find vulnerabilities. "People are hacking Internet Explorer every day, and if I did the same thing on IE people would just say it's just another IE vulnerability," he said.
"I wanted to do something different," Kotler explained. "People say that it's Firefox — it's not supposed to be as bad, and it's supposed to be safer and more secure, so I took it as a challenge."
Kotler explained that his intention was to create a form of malware that didn't rely on virtualization or SQL injection but rather is completely dependent on the browser itself.
"The basic thing that Jinx implements is that it will download files from your computer and send it to a remote Web site," he said.
Kotler argued that Jinx goes beyond a basic cache reading exploit of the type that was discussed at Black Hat in 2006. Jinx is a full hard drive read allowing the attacker to access anything on the drive.
Reading a user's hard drive contents alone wasn't enough for Kotler who claimed that function alone bored him after a period of time.
"I got bored with it so I made it into a bot and interactive, so I can manage multiple Jinx instances," Kotler said. "We end up having a complete framework all in JavaScript in the browser without code injection or virtualization. It's just you, Firefox, and us."
To execute the Jinx framework, Kotler explained that he uses a file URI (define) handler as a way to dig into the target system.
Mozilla had a number of high-profile issues with URI handling in the last year. In fact Mozilla rearchitected Firefox 3 so that it would not be at risk from the same sorts of issues that plagued Firefox 2. The third iteration was released earlier this year.
As it turns out, Kotler admitted that Jinx in its current implementation only affects Firefox 2 and not Firefox 3 specifically because of how Firefox 3 handles URIs. That said, he did note that he is confident that if he spent more time on research he could figure out a way to attack Firefox 3 or any other browser.
"I would say that if I would have the target and the time, I'm pretty sure it's portable and that this could work on any other browser that has Ajax support," Kotler said.(Ajax (define)
stands for Asynchronous JavaScript and XML.)
Kotler claims that he e-mailed his presentation to Window Snyder, Mozilla's chief security officer to disclose the issues he had discovered.
Snyder told InternetNews.com that she had received an e-mail from Kotler only last Friday about the presentation.
"My concern is that Firefox 2 is still in use and even though the same functionality isn't in Firefox 3, anything that could potentially hurt our users is a concern," Snyder said. "We're very concerned about this."
Snyder argued that Kotler did not give Mozilla enough time to evaluate the security issues prior to disclosing them.
"It would have been great if they contacted us beforehand, before they released the information so we could evaluate it and see how it might affect our users," Snyder said. "Giving us the opportunity to protect our users before it's available to attackers is always preferable."
That said, the fact that Kotler may well have discovered a security flaw within Firefox is actually a positive thing for Mozilla overall.
"We always appreciate when people work on Firefox security because it does help us," Snyder said. "Once we know about it, we can fix it, but it's easier to protect our users when we have time to fix an issue before it's available publicly."
