We are also at risk from rogue developers, people that have hacked/poisoned your trusted DNS provider, those that have modified your /etc/hosts, /etc/resolv.conf, windows\system32\drivers\etc\hosts (and/or related files), people that have hacked the update server and put there own malicious version there, and the unlocked workstation attack from an attacker with a USB flash drive with a malicious update that might sit down at your workstation and -pwn- you.
Steven > This information also posted (with html link goodness) to > http://paranoia.dubfire.net/2007/05/remote-vulnerability-in-firefox.html > > -------------------------- > Executive Summary > -------------------------- > > A vulnerability exists in the upgrade mechanism used by a number of > high profile Firefox extensions. These include Google Toolbar, Google > Browser Sync, Yahoo Toolbar, Del.icio.us Extension, Facebook Toolbar, > AOL Toolbar, Ask.com Toolbar, LinkedIn Browser Toolbar, Netcraft > Anti-Phishing Toolbar, PhishTank SiteChecker and a number of others, > mainly commercial extensions. > > Users of the Google Pack suite of software are most likely vulnerable, > as this includes the Google Toolbar for Firefox. > > The latest version of all of these listed, and many other extensions > are vulnerable. This is not restricted to a specific version of > Firefox. > > Users are vulnerable and are at risk of an attacker silently > installing malicious software on their computers. This possibility > exists whenever the user cannot trust their domain name server (DNS) > or network connection. Examples of this include public wireless > networks, and users connected to compromised home routers. > > The vast majority of the open source/hobbyist made Firefox extensions > - those that are hosted at https://addons.mozilla.org - are not > vulnerable to this attack. Users of popular Firefox extensions such as > NoScript, Greasemonkey, and AdBlock Plus have nothing to worry about. > > In addition to notifying the Firefox Security Team, some of the most > high-profile vulnerable software vendors (Google, Yahoo, and Facebook) > were notified 45 days ago, although none have yet released a fix. The > number of vulnerable extensions is more lengthy than those listed in > this document. Until vendors have fixed the problems, users should > remove/disable all Firefox extensions except those that they are sure > they have downloaded from the official Firefox Add-ons website > (https://addons.mozilla.org). If in doubt, delete the extension, and > then download it again from a safe place. > > In Firefox, this can be done by going to Tools->Add-ons. Select the > individual extensions, and then click on the uninstall button. > > ------------------------------------ > Frequently Asked Questions > ------------------------------------ > _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
