Firefox add-on flaw leaves Apple and Windows computers open to attack

Most popular extensions are vulnerable!

[bill]

Firefox Add-On Flaw Leaves Apple And Windows Computers Open To Attack [threatpost.com]

Researchers warn hundreds of popular Firefox browser extensions are vulnerable to attack that could give hackers control of Mac OS X and Windows computers.

Researchers from Northeastern University say the flaw is tied to Firefox’s support for an older browser extension platform and the Mozilla Foundation’s plug-in vetting process for its Firefox browser. Researchers presented their findings last week at Black Hat Asia.

Exploits found included NoScript, Video DownloadHelper, and GreaseMonkey. Adblock Plus was unaffected. Apparently there's no fix for this. Mozilla is going to have to scrutinize their listed extensions much more closely, and the rest of us will have to cull extensions.

Some lamented last summer when Firefox announced it was going to adopt Chrome Add-Ons format [webmasterworld.com]. They wanted to continue to use the current extension model. Guess that won't be quite a great option going forward...

[Manswery]

This probably won't change anything on Mozilla's side. They're already transitioning to another add-on model, although maybe they'll try to scan better in the meantime or something. But hopefully it will convince developers and end-users to switch to the new addons and not complain too much about losing the old ones.