Comments on: Spyware via Firefox? It’s true.

By: Ralph Cook

Ralph Cook — Sun, 08 Jan 2006 05:36:55 +0000

I don’t think anyone who understands how malware works would argue that firefox solves the problem in general. I do think IE is MUCH more prone to be a problem, whether by poor programming or just being the biggest in the market doesn’t really matter to the poor users. I guess we’ll find out if Firefox ever equals its market share — let’s all try it!

It is interesting that the Sun site claims that this was only possible using the Microsoft VM — was the author using that VM? It wouldn’t likely have come with Firefox, so I guess it would have had to be on his machine already.

I, for one, am more in favor of user education than trying to disable anything that might be a problem. After all, phising scams and email attachments are STILL there, we can’t plug all the holes if the users insist on “just clicking on things”.

Disclaimer: I’m a 30-year veteran of the programming industry, and just got caught by a usenet message purporting to hold the group’s new charter in an HTML file that turned out to automatically download an EXE, so I just got done running a 2-hour scan on the machine to see if it got anything on here. And found this trojan-loader on the machine in places where it’s already been! Fortunately I refuse to run MS’s so-called Java VM, so that may have saved me. I refuse to run IE, also.

By: Pranab Salian

Pranab Salian — Thu, 24 Nov 2005 10:44:32 +0000

Here is what Sun has to say..

These malicious applets are designed to exploit vulnerabilities in the Microsoft VM (Microsoft Security Bulletin MS03-011).

If you are using the Sun JVM as your default virtual machine, these malicious applets cannot cause any harm to your computer.

http://www.java.com/en/download/help/cache_virus.xml

By: rick

rick — Wed, 28 Sep 2005 19:50:39 +0000

On a related issue, I’ve tried using the deployment.config with the mandatory setting and with the apporpriate deployment.properties file. It’s not working, though — still pulling my user settings.

With the mandatory setting, isn’t it supposed not to use my user settings? Did I miss something to enable this?

Thanks.
Rick

By: harrison

harrison — Wed, 21 Sep 2005 16:27:05 +0000

ok i just recently installed foxfire and after my next restart, i notice mt browser is much slower than before including my download speed also. Is foxfire doing all this? thanks

By: suzi

suzi — Wed, 31 Dec 1969 17:00:00 +0000

Excellent analysis and write up, Ed. Yours write up is quite a contrast with this newsletter from Spywareinfo.com. I'd be interested in your comments regarding the editor's article on Firefox and spyware.

By: Neil T.

Neil T. — Wed, 31 Dec 1969 17:00:00 +0000

The one point I would make is that you were using Java 5 Update 1. Sun have just released Update 2 so you might want to see if they have made the security warning dialog more intuitive. I didn’t see it in the changelog though, and you are right in saying that the security wanring’s message is too obscure for most users. And that More Details dialog is just scary.

By: Donna

Donna — Wed, 31 Dec 1969 17:00:00 +0000

Symantec's Norton AV detects it as Trojan.ByteVerify. http://www.dozleng.com/updates/topic4255

By: Ed Bott

Ed Bott — Wed, 31 Dec 1969 17:00:00 +0000

Well, the Java 5 Update 1 code was what I was offered by Firefox. After it was installed, Java’s Auto-Update module offered me Update 2.

And I just tested it – the security dialog box is exactly the same in Update 2.

By: John Hood

John Hood — Wed, 31 Dec 1969 17:00:00 +0000

…But the Spywareinfo.com author’s question still stands: Why target Firefox? It’s a problem for all browsers.

By: Ed Bott

Ed Bott — Wed, 31 Dec 1969 17:00:00 +0000

The developers of this exploit are clearly attempting to target Firefox, which has had 25 million downloads since last November and has gained a substantial amount of market share. The applet doesn’t run on Internet Explorer. It might run on Opera (I don’t have Opera installed here to test it), but Opera has minuscule share. the target is clearly Firefox, and this exploit was developed precisely because Firefox has been successful and because the formerly reliable ActiveX-based methods of installing spyware don’t work with it.

By: Priva

Priva — Wed, 31 Dec 1969 17:00:00 +0000

>The applet doesn’t run on Internet Explorer.
Lets keep this clear. Applets run on Java VM
IE also uses Sun’s Java and practically all XP users have Sun Java installed on their computer.

Applet itself runs nicely also with IE and Sun’s Java.

It is just that Lyricspy site has JavaScript launcher which decides installation method.
if (IE) use activeX installer
if (Netscape/Mozilla) use Java installer

The point is that there is nothing that prevent malicious sites using this applet approach with IE too instead of ActiveX or in cases where ActiveX installation fails.

By: Ed Bott

Ed Bott — Wed, 31 Dec 1969 17:00:00 +0000

Right, Priva. That was my point all along. There is nothing that prevents IE from running this as well. That’s not news. But there is nothing that prevents Firefox from running this, and that IS news.

By: Tim

Tim — Wed, 31 Dec 1969 17:00:00 +0000

Ed, Thanks for posting this analysis. I came to the same conclusions that you did after first hearing about this exploit. I think it is a very serious security flaw and find it appalling that an applet can execute arbitrary code from a temp directory. The implications or this are that NO target platform or application is immune from this exploit given enough time and energy by the malware authors.

By: martinelli

martinelli — Wed, 31 Dec 1969 17:00:00 +0000

Thank you for the information and the testing. Spyware vendors are looking for all the open doors eh? :^)

More important at this point is this. Does the installer work under limited user accounts? Is it able to install enough junk to infect IE or is this only able to happen to power users and above?

By: brad

brad — Wed, 31 Dec 1969 17:00:00 +0000

This is a Java problem. If you do not trust yourself not to click on things (or to clean up after yourself when you do) then you can disable this function.

Open the Java Control Panel; choose the “Advanced” tab; expand the “Security” option; clear all of the checkboxes labeled “Allow user to grant…”. Make double sure you clear the second such box.