$0.02 Regarding Firefox Security

For those who haven't heard, Symantec recently decided to fire a shot over Mozilla's bow regarding the security of their Firefox browser.

Read the ZDNews Story

After looking over Symantec's position, I've started to wonder if they're in Bill Gates' pocket.

Yes, Firefox has flaws. Show me a piece of software that doesn't! Have they had a fair number in the last 6 months? Absolutely! Is Symantec's analysis flawed? Very possibly.

I would be interested in comparing the first year of IE 6 vs the first year of Firefox 1.0. I suspect that there would be far more necessary patches, and far more of those would be critical, with IE. As well, I think it would be fair to compare the average amount of time for each browser's developer to release a patch once the vulnerability has been identified. However, Symantec didn't find/gather these stats, making their results questionable.

I guess some people figured that Firefox was a magic bullet for security. They're finding out now that there is no such thing as a truly SAFE browser, only ones that are less insecure. I still believe Firefox to be a safER and superior browser than IE.

Read Mozilla's Comeback on ZDNews

Current security efforts suffer from the flawed assumption that adequate security can be provided in applications with the existing security mechanisms of mainstream operating systems.

http://www.nsa.gov/selinux/papers/inevit-abs.cfm

Until the masses understand that security must be accomplished at the OS level you'll see this pattern in pop security (people being sheep).....if you want more security buy an OS that offers more assurance.

XP on a limited account is the shiznyte. Too bad the masses, including the majority on this site pretermit the Run-As feature and will NEVER understand the depths of XP security that was provided before the first faggy service pack was released.

I agree that the O/S is the place to implement the strongest security, but even a well locked-down Windows XP or Linux box is bound to be vulnerable to SOMETHING. It is the nature of humankind's creations to have flaws, and some of humankind to exploit those flaws.

I'm sorry, that statement needs elucidation.

I was stating that I agree with you that the O/S is where strong security should be implemented, but that relying on ANY software (and an O/S is ultimately software) is a mistake because even a well-secured O/S has flaws in its code and thus could be vulnerable to attack.

So we should go back to banging rocks together, eh?

This is an oft rehashed topic in many guises. We participate in a technical culture of 'Permit All'. That is forever going to be the root problem, until such a time as we switch to 'Deny All' as our default behavior. It won't happen, I believe. Microsoft and Apple are always talking about the new features, how fast and easy something is to use, and why it is so much better than all the previous versions.

The point is a 'Deny All' system is not really all that functional, in the way we identify 'functionality'...what, you mean I can't read my email, surf the net, and write code on the same system?!?

Let's add something meaningful to this old rhetoric or let it rest in peace.

Quote:

---

So we should go back to banging rocks together, eh?

---

Nope, I'd be screwed without my various and sundry electric gizmos. I just don't think we should assume/rely on ANY technology to keep us completely safe - every time we make a better mousetrap, nature builds a better mouse. ;)

Unfortunately, since I have no way to improve the root of the problem (i.e. people out to harm other people), there's not much more I can contribute.

I just noticed something hilarious.....zencoder you claim to have a CISSP but you have a get firefox sig. lol

Did you come away with any knowledge about application level security and its value?


That's the second person with a CISSP to openly do this.

I agree with !mitationRust OS level security must come first, how many windows applications
suggest not to run as *administrator*, this is normal with other OS like Linux and OpenBSD.

Bieng vulnerable to SOMETHING does not neccessary employ to be vulnerable to
everything. I haven't heard or seen a single case of linux or a bsd box being compromised
by a web browser, and it is common with microsoft's IE ( Insecure Explorer).

Seriously what is smarter? :
a) Configuring to your very important TFM (if your system has one)?

b) Or masking poor configuration with applications and blaming the OS when something goes wrong?

As long as you understand what real security is and what pop security is you have a head start in my book....... I mean you could seriously market another application and call it a lightning wall and the masses would flock to it. Why? Because people feel safe knowing "this is what everybody’s doing now to keep safe".

IE ships in a loose state just like a SOHO router...... and is extremely configurable...... which translates into: over your head to most.

The manual is pretty clear:

Quote:

---

Originally posted here by Microsoft TFM
Use separate accounts for administrative activity and general user activity. Individuals who do administrative work on the computer should each have two user accounts on the system: one for administrative tasks, and one for general activity.

---

Table 4.1 C2 Configuration Checklist :thumbsup:
God did he just say checklist?

I do think there's a valid point in the warning from Symantec. Think about it. In the past, Firefox was considered more secure. Yet it had quite a small marketshare and thus not too interesting for hackers. Not enough systems to attack. But Firefox has a bigger market-share now and that does mean it's security system will become more important too. If Firefox wants to increase it's marketshare then the security of Firefox must be improved a lot.
Then again, recently Opera became free and it seems to be an interesting alternative. And Netscape is still alive too. And I'm wondering if there are several more good alternatives. Of course, Firefox is pretty good but it's becoming a bigger target now it starts to gain a bigger marketshare.

Quote:

---

Originally posted here by !mitationRust
I just noticed something hilarious.....zencoder you claim to have a CISSP but you have a get firefox sig. lol

Did you come away with any knowledge about application level security and its value?


That's the second person with a CISSP to openly do this.

---

What are you talking about? Whats wrong with Firefox? Over IE? Or Opera? Or anything else?

What does my being a CISSP have to do with what software I think is acceptable for various reasons and needs? You make an observation without really explaining what you mean in depth. Let's hear it?

Ok, after all that's been said here, I'd like to try and bring the thread back to where it started, and maybe clarify where I was trying to go with it. BTW, I apologize for not being clear earlier.

My issue is not with Symantec stating that Firefox is less secure than IE. Based on their approach, they're absolutely correct. However, I don't think it was a fair/accurate comparison of the two browsers.

IE 6 was released in 2001. I don't know how many patches were released for it in the first year, but it would be interesting to see how many there were, and how many were critical, in comparison to the past year of Firefox. It might in fact turn out that Firefox has had a less secure first year of release (official release, not including betas & alphas) in comparison to IE 6. Instead of comparing the first full year of release, they are comparing a browser which has had the better part of 4 years to discover and work out issues to one which has had a full-version available for about a year.

Another point I unsuccessfully tried to make was that a comparison should have been done between the two browsers in relation to the average time from the discovery of an exploit, to the time a patch was officially released (and I don't consider 1.0.6 a proper patch because it disabled a feature - 1.0.7 was the PROPER patch for the issue).

All that being said, I do agree that Firefox HAD an advantage when its market share was tiny - good ol' Security Through Obscurity! Now, obviously not so much, though it still doesn't come close to matching the official deployment numbers of IE.

Now, if Symantec were to compare the browsers based on that criteria, I might be more inclined to believe that they were being impartial.

Obviously, there are users who felt that "more secure than IE" meant "there will never be any security issues." Its unfortunate that they chose to believe that, but as far as I know, nobody from Firefox has ever said that their product was completely impenetrable. My PERSONAL belief is that the native pop-up blocker, combined with the fact that at least some of the security issues were related to trying to help users avoid Phishing (something IE was slower to adpot), makes it an overal safER choice than IE. But ABSOLUTELY NOTHING will protect a user if they aren't educated in what to avoid.

BTW, if anyone finds the figures for these bits of historical info, I'd be very curious to know what the results are. I wasn't able to find the info I wanted, but maybe one of you industrious security gurus has sources I have yet to discover ;)

Quote:

---

Originally posted here by !mitationRust
I just noticed something hilarious.....zencoder you claim to have a CISSP but you have a get firefox sig. lol

Did you come away with any knowledge about application level security and its value?


That's the second person with a CISSP to openly do this.

---

Hey, seriously! Tell us what you mean.

You can't toss a gauntlet on the floor like that and then not reply.

You seem to have a view that indicates Firefox is obviously a ridiculous choice of application to use, and you seem to think it is blatantly obvious. I'm sure I'm not the only person here who has no idea what the position behind your statement is, so please enlighten us.

I'm sorry, that statement needs elucidation.

Quote:

---

Originally posted here by Katja
I do think there's a valid point in the warning from Symantec. Think about it. In the past, Firefox was considered more secure. Yet it had quite a small marketshare and thus not too interesting for hackers. Not enough systems to attack. But Firefox has a bigger market-share now and that does mean it's security system will become more important too. If Firefox wants to increase it's marketshare then the security of Firefox must be improved .

---

I agree but I think more people should be helping out to debug and improve Firefox if they want increased security instead of complaining about it, please remember it's community driven open source software is not meant to be about mooching and never giving back even if someone isn't a programmer they can do other things to help out:

http://www.mozilla.org/developer/

As a firefox user myself I feel that with its open source nature (suprising how IE is suddenly becoming open source too, I might add....) and therefore constant development/modification by the way of add ons makes it preferable over IE - although I suppose this is a spin off of this topic.

I agree with most of the comments made, one shouldn't just rely on a piece of software to keep them safe, nothing is perfect. What the statistics don't take into account is the knowledge of the users. A computer novice is likely to use IE, likewise someone with a little knowledge can use it in relative safety, but as my experience goes, the people who tend to use Firefox are more advanced and therefore less likely to do something stupid. On the other hand because its open source its easier to write an exploit for it (in theory).

As a firm believer in security in layers, I really don't see the relevance of messing about over the strength of a browser. Security isn't guaranteed in one piece of software!! As long as your not surfing from a mission critical server (If you are you should be shot) then the real deciding factor should be personal preference and features.

Quote:

---

I agree but I think more people should be helping out to debug and improve Firefox if they want increased security

---

Fine let's fix all of Firefoxes security issue right now.

Run Firefox as a process that only has access to cache directory, which the current user lacks access to and no user has exec right to. Read access and exec access should be provided only to Firefox's actually bin and config files. Encrypted pages should not be cached.

In this case even if firefox is exploited, it cannot use the current desktop UID to make any changes... trojans cannot be downloaded, and if remote control is gained... wow the attacker can write to non-executable cache or read config files.

In this case, firefox being compromised will have no impact on the system's security since the rouge process is in capable of doing anything beyond normal use.

Perhaps firefox should ship with a security template that simplifies this configuration.

cheers,

catch

Hmm,

Quote:

---

IE 6 was released in 2001. I don't know how many patches were released for it in the first year, but it would be interesting to see how many there were, and how many were critical, in comparison to the past year of Firefox.

---

Let's see:
IE, version 6.0.2800.1106, SP1 + 8 patches

That does sound like a lot of builds since 2001 to me ....

Cheers,

BrainStop

If Symantec is really concerned about the security flaws in Mozilla Firefox, then they should at least update or configure their Online Security Check to alloW FIREFOX'S Users do the task, below is the message I got when I tried to do it with a Firefox browser, and here's the link too:

http://security.symantec.com/sscv6/d...z&venid=symnis

and that's the message:


An error has occurred

Symantec Security Check is not compatible with your Web browser because:

Error 003

To run Security Scan, you must be using at least Internet Explorer 5.0, Netscape 4.5 or Safari 1.0.

To run Virus Detection, you must be using at least Internet Explorer 5.0.
Spacer



Cheers,

B.B

I think I may have mentioned this before, but there is nothing wrong with FireFox, or Netscape or Opera, or IE ... per se. The main problem is in how the software is implemented and managed.

I don't think the Symantec statement necessarily slams FireFox unfairly. FireFox is still at 1.something, so the road ahead is still a long one. It makes for a clean, responsive browser for individual users. From a managed network perspective, FireFox can be a very severe security problem.

IE can be maintained, updated and configured centrally on the network. There are numeous tools available to do this.

FireFox is currently for personal use and that is fine. When installed in a managed network, it cannot be configured, updated or maintained centrally (been there, tried that, got the coffee mug, moved on). The individual user must be trusted to perform the necessary actions to secure and maintain the application. If the user isn't diligent, then FireFox becomes a critical security issue. I had logs that showed where a user, using FireFox, infected a workstation and a server with a trojan/worm attack (on the day the vulnerability was announced), all before the installation could be updated/patched.

Things will get better and FireFox may become the golden child.

:)

Symantec based this on flaws found though. That doesn't exactly work comparing opensource to proprietry.

Of course there's going to be less found in IE if you can't see the source code!

Looking back at..8 patches,I think someone said?Along with SP1,SP2 and now SP3 for WinXP..all deemed very important updates..all this without MS releasing source code..think about what could happen if they did:P

Quote:

---

Symantec based this on flaws found though. That doesn't exactly work comparing opensource to proprietry. Of course there's going to be less found in IE if you can't see the source code!

---

Quote:

---

all this without MS releasing source code..think about what could happen if they did:P

---

Wow... you both know **** all about application security testing.

Do you honestly think that the most effecive way to test software is by having people read through volumes of code to ensure that correct techniques are used? You know who does that? OpenBSD, and wow is that a big steaming pile of pseudo security coupled with all the functionality one might have expected from an operating system in 1992... only slightly less robust.

Modern application testing is done with with resouce tracking, debuging tools, and fuzzing techniques... the availibility of the source only aids in more rapid development of exploits and root-kits.

Does this mean that code levels tests are useless? Of course not, they are just not an effective means of discovering vulnerable software and represent a marginal percentage of total discovered exploits within the open source community.

cheers,

catch

/me grins

Apologies catch..that post was just meant as humour..nothing else.Thanks though,you've given me something to think about.

Cheers.

OOps... flaws found? I meant flaws patched. Damn that just made me look stupid... :S

They're saying that there have been more flaws found and patched for Mozilla than IE.

I really should read what I post more carefully.

Anyway, we all know that Symantec are well into scaremongering. All their going on about a Mac OS X virus is just stupid. If it was really that likely to happen, it would have happened already. I'm not saying it's not possible, just a lot harder than Windows.

New product for the Security Wary
http://www.linuxinsider.com/story/43012.html

Quote:

---

Anonymizer Total Privacy Suite sits in the Firefox browser's toolbar as three rows of display windows or buttons. When the browser is updated and users install a newer version of Firefox, the privacy suite remains in the new running browser version, Itzhaki said.

The first row displays the real IP address of the Web site being visited. The second button launches the anti-spyware module. The third button deletes surfing history.

When the Firefox browser is connected to the Internet, the privacy suite automatically updates the signature file database from Anonymizer's server Get Linux or Windows Managed Hosting Services with Industry Leading Fanatical Support. Latest News about Servers.

"Although there's no such thing as perfect security on the Internet, Total Privacy Suite provides the highest level of identity protection available for Firefox users," Itzhaki asserted.

---