Linux detractors often say that, if and when Linux becomes as popular as
Windows, it will attract just as many attacks - and prove just as
vulnerable. The popularity of Linux exceeds that of Windows in some areas,
but, so far, these attacks have not materialized. It is now beginning to
look like this upsurge in attacks may not target Linux directly. Instead,
the Firefox browser may become the target of choice.
Eric Johanson recently put out an advisory demonstrating
how "homograph attacks" can work against Firefox (and Konqueror). These
attacks take advantage of international domain names, which can be written
in non-ASCII character sets. The problem is that many non-ASCII characters
are rendered just like (or very nearly like) characters in the ASCII set;
as a result, a visually identical domain name can actually point somewhere
unexpected. An example provided by Mr. Johanson is
www.pаypal.com, which your browser renders as
www.pаypal.com. This technique, clearly, could be used for
phishing attacks - especially when one considers that SSL certificates can
contain non-ASCII characters too. It is said that a short-term workaround
for this problem is to turn off the network.enableIDN parameter in
the about:config screen, but this workaround does not work for
all users, and it does not persist across sessions.
Meanwhile, "mikx" has posted a set of three different Firefox
vulnerabilities. "Fireflashing" is a trick
that, in conjunction with the Flash plugin, can be used to trick a Firefox
user into changing configuration parameters. The "firedragging" vulnerability gets around some
restrictions to possibly allow a (Windows) user to put a web-supplied
executable file onto the desktop. And "firetabbing" circumvents the isolation between
sites when links are dragged to different tabs. All of these
vulnerabilities have been acknowledge by the Mozilla Project and fixes have
been committed.
These attacks are not truly devastating. They make certain kinds of
phishing and social engineering attacks easier, but, hopefully, should not
fool suitably careful users. But they do show that the level of interest in
Firefox vulnerabilities is on the increase.
Attacking many parts of a Linux system is hard. Security is generally
reasonably good, one hopes, and techniques like privilege minimization,
privilege separation and sandboxing help to contain any vulnerabilities
which do exist. The sheer variety of deployed Linux systems also works
against attackers; an exploit which works on one system may be useless
against the next. The role of diversity in ensuring the security of Linux
systems should not be underestimated.
Firefox, however, is widely deployed and quite similar on all systems. If
nothing else, the project's trademark policies tend to ensure that Firefox
deployments will not vary much. Firefox contains interpreters which will
certainly contain exploits of the "write once, run anywhere" variety.
Firefox is directly controlled by users who may have little interest in -
or knowledge of - security policies. And, in many (perhaps most) cases, it talks directly
to random sites all over the net. So of course Firefox is being eyed as a
possible entry point to otherwise secure systems.
The Firefox browser is popular for a reason: it is a solid, highly
featureful, highly useful program. It is also a huge and complex program.
Regardless of the skill of the Mozilla hackers, verifying and maintaining
the security of a code base that large is going to be a major challenge.
Expect some interesting times over the next few years as the security
claims made by the Mozilla Project - and by the free software community in
general - are put to the test.
Comments (24 posted)
