Hacker News Reader

Comment by ianbicking | Hacker News Reader

A big problem for a lot of Firefox users is addons that are side-loaded into a profile. Like when you download some junk and it comes with an installer that injects an addon into your profile. This is a good expose on what even a seemingly legitimate site like download.com does: http://www.howtogeek.com/198622/heres-what-happens-when-you-... (and several of the malware examples in that article are side-loaded addons).

Unfortunately hoops aren't enough to fix this problem, because hoops generally involve some flag that you've gone through the hoop, and the installer can easily fake that.

View on HN

Couldn't those installers patch Firefox to remove the signing requirement? Or, if they don't get sufficient privileges to modify the executable, patch the user's Firefox process in memory?

Yeah, this might end up being just a salvo in a longer battle. But maybe part of the problem is that some of these malware authors are lying to themselves and believe they are just grayhat hackers, and once you start patching executables it becomes a bit clearer you are a blackhat. So far download.com isn't distributing actual rootkits. They could of course. And yet still they probably won't.

Relatedly I did notice when putting my own addon through the signing process that there was a checkbox specifically for sideloaded addons, with the implication that the checks would be even more stringent. I'm not sure if that's enforced or not, or how.

Chrome did a similar change which led to a pretty spectacular drop: http://blog.chromium.org/2015/05/continuing-to-protect-chrom...

How is that Mozilla’s problem? If you close all the “hoops” the rogue installer can just simply replace Firefox with its own build of “Firefox.”

I truly don’t understand why Mozilla is trying to do Microsoft’s job.

Except that's malicious to a much greater extent -- an extent that ought to catch the attention of anti-virus software makers.

I don’t see how antivirus software completely failing to protect its users from “easy” attacks (rogue extension drops) should inspire any confidence they can protect you from more sophisticated attacks. Oh yeah this gun is useless now, but wait till they roll in with tanks!

Never mind the entire idea of antivirus software is completely ridiculous from security PoV and basically a scam to have people pay for a false sense of security.

Reply on news.ycombinator.com