Researchers: Attackers could use holes in Firefox add-ons to target your PC

Researchers from Northwestern University discover how an attacker could write a malicious Firefox add-on that takes advantage of security holes in other Firefox add-ons to do its bidding.

It goes without saying that any given piece of computer code—be it an app, a part of your operating system, or even a browser plug-in—may contain flaws that could leave your PC open to attack. But a team of researchers from Northwestern University have come across a new method of attack that can take advantage of holes in one or more installed Firefox add-ons.

According to the team’s research paper (PDF), this newly discovered attack “leverages capability leaks from legitimate extensions to avoid the inclusion of security-sensitive API calls within the malicious extension itself.”

Put another way: Firefox doesn’t enforce any isolation between the add-ons you install, as Ars Technica notes, which could potentially result in security problems. As a result of this lack of isolation, researchers say, an attacker could write a malicious Firefox add-on that appears harmless, but can use security flaws in other installed add-ons to do its bidding.

In this sort of attack, the malicious add-on itself might not raise and security red flags, but it may still be able to wreak havoc on your PC.

What’s the actual risk of attack?

The implications of these so-called “extension-reuse vulnerabilities” are potentially serious, especially if you consider that, according to the research paper, “nine of the top 10 extensions contain a large number of such vulnerabilities” and that fact that it may only take “only one or two vulnerabilities” to launch an attack against your PC.

That said, the paper doesn’t get into the exact risk of an attack on any particular system, and measuring risk might be tricky given how different users will have a different combination of add-ons installed. That is, it’s relatively easy to attack a vulnerability in one popular piece of software, such as Flash Player. It’s more difficult to attack a combination of vulnerabilities at once because it’s less likely that all potential targets will have all the necessary add-ons installed.

Still, this is one area of security research we’ll want to watch closely.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags internet securityinternetbrowers

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Nick Mediati

PC World (US online)
Show Comments

Cool Tech

Toys for Boys

Family Friendly

Stocking Stuffer

SmartLens - Clip on Phone Camera Lens Set of 3

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?