Click here to receive your FREE subscription to Campus Technology
News
U Indiana Grad Student Exposes Firefox Vulnerability
6/8/2007
Christopher Soghoian, a grad student at Indiana University's School of Informatics, has discovered a security flaw associated a number of big-name commercial extensions to the Firefox Web browser.Soghoian, who made a name for himself in security circles last year when he exposed a security problem in airline boarding passes, said although he contacted many of the companies associated with the Firefox discovery, none had responded as of last week.
Soghoian said a vulnerability exists in the upgrade tool used by several Firefox extensions, including Google Toolbar, Google Browser Sync, Yahoo Toolbar, Del.cio.us Extension, Facebook Toolbar, AOL Toolbar, Ask.com Toolbar; LinkedIn Browser Toolbar, Netcraft Anti-Phishing Toolbar, PhishTank SiteChecker and a number of other commercial extensions to the browser.
Users are vulnerable to having spyware and other malicious code placed their computers because of the vulnerability, Sobhoian said.
However, most open source or hobbyist Firefox extensions are not vulnerable to the attack, including those available via the official Firefox Addons website at http://addons.mozilla.org.
Soghoian said he notified Firefox's Security Team, as well as Google, Yahoo, and Facebook, about the problem about 45 days ago but that as of May 30, none had released a fix. Until vendors have fixed the problems, users should remove/disable all Firefox extensions except those that they are sure they have downloaded from the official Firefox Addons website.
"The bitter irony here is that by downloading an anti-phishing toolbar, you're currently making yourself more vulnerable than if you had never downloaded it at all," Soghoian told Wired magazine. "It's totally trivial to spot. This is in no way a major piece of computer security research. The work of attempting to harass the vendors into fixing the flaw has taken far more time than finding it."
Soghoian created a stir last November when, in trying to highlight a flaw in the nation's airline security procedures, he put a tool on his website letting anyone create fake boarding pass. He was visited by FBI agents, who seized his computers and other equipment but was not charged in the incident.
Visit the link below to see a demo of an attack against Google's Browser Sync and a full analysis of the flaw.
Read More:
Paul McCloskey is a contributing editor for the Campus Technology group of publications.
Cite this Site
copy text (above) for proper citation
Recommended Reading
- Sun, Stanford Working To Archive History
In May in San Francisco, experts from leading universities, libraries, and research institutions around the world met as part of an ongoing effort to address a pressing issue: archiving the world's history, right up to today.
- The Quilt Coalition Rolls Out XO Communications for High-Capacity Network Services
The Quilt, a coalition of 28 regional network organizations, has added XO Communications Services to its authorized vendor list. The Quilt represents 200 universities and thousands of other educational institutions across the United States. With this new relationship, Quilt members can purchase XO's high-speed IP transit and network transport services at competitive rates.
- Wimba Classroom 5.2 Expands Classroom Capture Support, Adds MP3 Downloads
At the NECC 2008 conference in Texas this week, Wimba launched a new version of Wimba Classroom, the virtual classroom component of the company's Collaboration Suite. The new 5.2 release expands options for classroom capture and adds a variety of other functional and ease of use features.
- Automation Chimera: Education Is Not Management
The lure of automating workflow online so human intervention is minimized is continually reinforced in the minds of higher education administrators by examples of automated campus systems such as financials, student information systems, and other enterprise systems. But what's good for management is not always good for learning.
- Cognos Releases BI Software for Linux-based IBM System z Mainframe
Cognos, which IBM acquired in January, has released an update to its business intelligence software that will run on the Linux operating system on IBM System z mainframes. IBM Cognos 8 BI was being developed by the two companies prior to the acquisition, but assimilation of Cognos into IBM accelerated development.
- Facebook and Collegiality: A Serendipitous Social Niche
Facebook is a way to greet a colleague as if she or he is on your own campus: a wave at a distance, a hello at the corner burrito place, a honk as you both leave the campus parking lot. Informal collegiality has been extended over the miles.
