Securing Your Firefox

While its popularity suffers from a decline in the past year or two, Firefox is still a great browser which has a lot of things to offer. One of those things is the ability to control whether a plug-in will start automatically when the relevant content is being loaded, or should the browser ask for the end-user’s permissions to activate the plug-in on a per-site basis.

When can the above functionality be most useful? When defending against malware. The sad truth is that being infected via a drive-by malware is something that can happen to anyone, regardless the security measures being taken (e.g using Linux or OSX, having an anti-virus running or using a browser which is not IE). Due to the increased efforts in making it secure, Firefox has very little known vulnerabilities in the core browser engine, forcing the bad guys to opt for its plug-ins as the attack vector.

Unfortunately, Adobe (maker of Flash and Reader) and Oracle (maker of Java) are still doing a so-so job in terms of making secure software, thus it is recommended to have their plug-ins run only when the user approves them to run.

As a matter of fact, I’d recommend getting rid of Java and Reader entirely, yet Flash is still needed for many sites, thus cannot be discarded easily.

So how could one make Firefox ask for a permission to run such plug-ins? Easy:

1. Open the “tools” menu and choose “add-ons” (ctrl-shift-a for non OSX users).
2. Choose the “plug-ins” tab on the left panel.
3. Choose “ask to activate” for the not-so-secure plug-ins.
    

That’s it. Have a safe browsing.

Nice Exploitation Technique In PDF Files

Warning - security related post. Stay clear if you feel disgusted from Windows Internals and Security.

A friend of mine just posted a great piece about a clever shellcode technique called egghunting. If you're into this kind of stuff, I recommend reading it.

Also, if anyone is interested in some more details about the Adobe Acrobat Reader vulnerability described in the above post, please leave a comment, and I'll dedicate a separate post for that.

Respect

Usually I don't publish stuff I do at work in this blog, since we have a different blog for that, and most of the stuff doesn't justify re-writing or there's nothing I can elaborate.
This time it is different, since Bruce Schneier has quoted us, which is something that's considered as a great respect in the security community.

The URLZone trojan is very sophisticated, since it fakes the displayed balance in the bank site, so the end user could never tell the money was stolen. Also, the trojan uses the current opened session to the bank, so it doesn't need to send the account credentials nowhere.

If you like to read a great technical analysis of this trojan, you can find it in our blog.