Windows 10: Firefox Add-ons attacked

From the article, you would need to download a malicious Add-On that would then exploit your already installed add-ons . So not much danger unless you download crap add-ons without reading reviews or otherwise get informed.

 

I think, that for average user, the most dangerous can be PUPs which you install with other well rated programs. These can be stand alone programs as well as browser add-ons.
So I can't agree with you, that this is not a problem. Bad guys will always find their way.

 

Ars Technica calls it "proof of concept," too. These "proof of concept" articles are always amusing... Ever notice how the hackers who who develop these "concepts" (and so give the bad guys new ideas) are called "security researchers," while the guys who actually develop the hacks that the "proof of concept" publicizes are called "malicious hackers"? I see little difference between the two groups. They are all hackers.

But anyway, as with most "proof of concepts" it is highly unlikely this kind of thing might ever work well because so many elements have to be precisely aligned--elements over which the hacker has no control. There is no "safe" list, etc., because there exists no threat... No one has been exploited by this particular concept and may never be, so atm everything is "safe."

 

Agree with the second part, but can't with the first.

Of course they (good and bad guys) are both hackers. I see your point, but security researchers are not making direct money with security holes they find. This can be some of the most brilliant scientist in their field. They have to publish papers and have to attend conferences. If they don't ... they loose position.

But security breach that is published is no real threat anymore. Company can fix it. So, there exists both, good and bad guys (hackers).

Of course, just my opinion *Smile

 

I think the bad and good hackers are interchangeable really.

Plenty of black hats get employed by system security companies and become white hats. I must also assume that white hats could also change their colour to black for reasons only known to themselves.

For now I'm continuing to use Firefox as my main browser until some concrete evidence comes out about extensions.

 

Agreed

 

Agreed

 

For now I'm going to continue using Firefox/Pale Moon and all my extensions. IMHO with all the security updates your just as safe/unsafe with Firefox as you are with other browsers. *Smile

 

IMO, it depends on whether they warned the company (Mozilla in this case) prior to releasing the info to the public (at least a few weeks).

Isn't the "security researchers" warning delay 90 days?
I'm always seeing that number mentioned whenever there is a controversial "security warning" issued.

Agreed.
Who installs random unknown add-ons on a regularly basis? *Confused

Although I mostly use PM these days, my current add-ons (9) have been "field tested" for ~7 years.

I have FF installed in Windows VMs and Linux Mint.
The only new add-on I've added to my "standard set" has been Classic Theme Restorer (since FF29).

This will be more problematic once this trick is shoehorned into the most popular add-ons (via dodgy updates?).

FF users with installed add-ons:

• 2011 - ~85%
• 2016 - ~60%

https://blog.mozilla.org/addons/2011...-add-on-users/
http://news.softpedia.com/news/mozil...d-498566.shtml