MacDailyNews - Where Mac news comes first

 MacDailyNews Poll

Deal of the Day

5 Day Most Commented

Opinion Archive

Current Headlines

Latest Joy of Tech

  • Latest Joy of Tech!

MacNN

AppleInsider

Macworld UK

TUAW

MacRumors

Yahoo! Finance AAPL

iTunes Top 10 Albums

Mac OS X Downloads

Mon, Mar 15, 2010 - 10:49 AM EDT  —  AAPL: 223.51 (-3.09, -1.36%)  |  NASDAQ: 2358.99 (-8.67, -0.37%)

Mozilla overlooked malware-laced Firefox for WIndows add-ons; Macintosh unaffected
Friday, February 05, 2010 - 02:16 PM EDT

"Two Firefox add-ons available for months on Mozilla's website infected users with malware that stole passwords and opened a backdoor on Windows machines, the open-source browser maker has confirmed," Dan Goodin reports for The Register.

"The add-ons, available on an experimental section of Mozilla's official add-on download site carried trojans that have been detected since 2008 by commercial anti-virus products," Goodin reports. "And yet they weren't removed until late January and earlier this week because a scanning tool used to vet add-ons during upload failed to catch the malicious files."

MacDailyNews Take: Any questions about why Apple vets apps for iPhone, iPod touch, and, soon, iPad, before making them available to customers?

Goodin continues, "'If a user installs one of these infected add-ons, the trojan would be executed when Firefox starts and the host computer would be infected by the trojan,' a note on Mozilla's add-on blog stated. 'Uninstalling these add-ons does not remove the trojan from a user's system.' Instead, infected users will need to thoroughly scan their machines with an anti-virus program. Or better yet, use multiple scanners, or simply reinstall the operating system to be on the safe side."

MacDailyNews Take: Ah, the bad ol' "Wipe and Reinstall." At least Windows sufferers will be intimately familiar with the procedure.

Goodin continues, "This isn't the first time Mozilla has served malware-laced add-ons... Both infections affected only Windows users of the open-source browser."

Full article here.

MacDailyNews Take: Good thing you saved that $129.50 upfront when you bought that WIndows box instead of that Mac you really wanted; the thieves who just stole that and more out of your bank account thank you, we're sure. Well, if you're currently stuck on a Windows box, at least you can get a real browser for free until you move up to a Mac. It's the big brother of the one you already use on your iPhone and/or iPod touch: Click here for more info and download link for Safari for Windows.

Bookmark and Share

Always -- Free ground shipping with orders over $50 at the Apple Store.

Reader Feedback: = registered.
Unregistered users: Feedback from multiple usernames are subject to deletion. Off-topic and posts from suspected astroturfers will be removed.

Reader feedback page 1 of 1 pages:
Feb 05, 10 - 03:28 pm Comment from: orenokotodazo

Hmmm... and one more reason I don't like FF, even for Macs...

Feb 05, 10 - 03:31 pm Comment from: JAYGEE

FF is no Chrome.

Feb 05, 10 - 03:35 pm Comment from: Jubei

End the suffering and just get a Mac! Any Mac or iPad when it comes out.

Feb 05, 10 - 03:54 pm Comment from: TheMightyFinder

I don't mind Firefox. I fact, I often find that it opens web pages slightly faster than Safari. However, it takes over a minute for the application to open on my Mac, so Safari is my browser of choice.

Feb 05, 10 - 03:55 pm Comment from: Joe

I think Firefox is awful. I don't understand the love of it. I've not yet found a plug in that is useful.

Feb 05, 10 - 03:56 pm Comment from: Sarasota

I like FireFox, but even it is suffering from bloat, so I use WebKit and Minefield en lieu of FF or regular Safari.

Never really used Camino much, but I have it.

Feb 05, 10 - 03:57 pm Comment from: Cubert

This reminds me of the malicious app on the Android site over Christmas that would steal your banking info. It was up for about 10 days before Google caught it.

You get what you pay for!

Feb 05, 10 - 03:58 pm Comment from: Rob

So what are the names of those Add-ons?

Feb 05, 10 - 04:19 pm Comment from: Poppy

Firefox is wonderful, especially the add-ons and themes. I would be much more concerned with Apps having access to all information on the iPhone, including GPS data, without any sort of user prevention than I would a simple browser add-on trojan.

Feb 05, 10 - 04:29 pm Comment from: Poppy

Let me explain myself further if I may.

OS X is very secure because of file permissions and a secure root user. So if a browser exploit occurs, and it occurs in Safari too, your computer is safe.

Windows isn't the same, so a browser exploit pawns it completely.

On the other hand, all Apps on the App Store have the potential to access your personal information, recent calls, pictures, GPS data etc., stuff that is very very private and personal. Stuff not normally put into a computer, yet there is no way to tell which Apps can have access to what information on the iPhone.

Therefore it's a simple matter to get people to download some "fart app" and then access the private data later, because Apple allows this to occur with no user intervention ability.

There is a "There's a virus for that" video on CNBC that explain the problem and Apple's lack of attention to it.

Good day. :D

Feb 05, 10 - 04:29 pm Comment from: Gabriel

@ Poppy

Yes, because having a "simple browser add-on trojan" (which can carry out spam attacks or download files resulting in criminal charges) is *far* less damaging than Apps which have access to much (but not all) of your iPhone user data.

Puh-leeze.

Feb 05, 10 - 04:32 pm Comment from: anaknipedro

FF place in my heart has been replaced by Chrome. I love the omnibar. In fact, I often use Chrome over Safari.

Feb 05, 10 - 04:40 pm Comment from: Digits McGee

"simply reinstall the operating system" what an oxymoron

Feb 05, 10 - 04:44 pm Comment from: Gabriel

I'm a fan of Firefox on OS X, though I've been less enthused about saying so since Mozilla's embarrassing comments regarding the EU "browser ballot" proposal.

Additionally, their mind-bogglingly inconsistent stance of shunning H.264 because it's a patent-encumbered multi-vendor standard, while continuing to embrace Flash video which is a patent-encumbered single-vendor browser plugin, leaves me scratching my head and wondering if they're going to be left behind in the quickly-approaching HTML5 video wave.

I enjoy the flexibility of Firefox and its wide range of add-ons, which provides me a higher degree of control over my browsing experience. It also allows me to replace the godawful default theme for OS X, which is truly atrocious - why don't they use these themes instead?

Firefox is still indispensable to me, and my first browser of choice... but even when sitting there idle it likes to chew up far too much of my CPU. I dearly wish the Firefox folks would stop grandstanding on issues like browser ballot ordering or trying to push Ogg Theora onto a world which clearly isn't buying it, and focus on actually doing things to make their browser better.

Feb 05, 10 - 04:56 pm Comment from: Poppy

"Yes, because having a "simple browser add-on trojan" (which can carry out spam attacks or download files resulting in criminal charges) is *far* less damaging than Apps which have access to much (but not all) of your iPhone user data...pleeese..." - Gabriel


Uh, yes, even if malware downloads illegal images to your computer, it's not as bad as a device using that's constantly giving your current location away to persons unknown who might mean you or your loved ones physical harm.

Feb 05, 10 - 04:59 pm Comment from: Poppy

By the way the best Firefox add-ons I have found are: Adblock Plus, BetterPrivacy, Ghostery, NoScript, NoSquint, FastestFox, FlagFox, and the Yomemite theme as it has the best color match and doesn't interfere to much.

I'm tired of the Apple grey theme. Sky blue is much more cheerful.

Good day. and I love my Mac by the way. :D

Feb 05, 10 - 05:53 pm Comment from: KingMel

I have used the FireFTP plug-in from time to time for website uploads. And there are a couple of web sites at work that are incompatible with Safari for some reason (undoubtedly designed by a Microsoft IT pinhead). Other than that, I use Safari.

One of my few gripes against Apple - I would still like to see QuickTime become more universal without the various add-ins (Perian) or supplemental apps (VLC). I sometimes wonder what these apps include besides video playback...

I would much rather have a wider range of codecs included with QT. Second best would be the ability to add the codecs to QT.

Feb 05, 10 - 06:13 pm Comment from: m159

I recently set up a PC > Mac switcher. She had been using FF on her PC, so I was exposed to it in the transition. Really, Firefox's look is amateurish and butt-ugly compared to Safari. She agreed, and so I switched that also. She says it's faster now too, but that may be the machine, I don't know.

Feb 05, 10 - 08:16 pm Comment from: Sir Gill Bates

@ Rob,

"So what are the names of those Add-ons?"

http://blog.mozilla.com/addons/2010/02/04/please-read-security-issue-on-amo/

Feb 05, 10 - 08:47 pm Comment from: Predrag

Poppy,

How do you propose one downloads such a malicious app? Even if someone creates an innocuous 'iFart' app that has malicious payload, how on Earth would they get it on App Store? I have no doubt that even some automated vetting system surely checks for these things and would catch the code easily.

When you have a house in the richest and safest gated neighbourhood of the wealthiest town, complete with private security sentries and sophisticated burglar alarm system, you can afford not to have to lock the front door to your house (i.e. give root access to your apps).

Feb 05, 10 - 09:23 pm Comment from: Gabriel

@ Poppy – A couple more fatal flaws in your logic:

1) A malicious iPhone app can only run while you have that app open. A Trojan can run constantly in the background on a multitasking PC OS.

2) All iPhone apps which use the location framework must explicitly ask the user permission to do so. And even if you do grant those scary tinfoil-hat evil apps permission to access your location – as noted above – the app has to actually be running in order for it to do this.

Your fearmongering seems to be based on the false assumption that malicious programs can run constantly in the background on the iPhone, just like on today's PCs. This is clearly false, so your argument holds little merit.

Feb 05, 10 - 10:19 pm Comment from: Jay

I present a metaphor...

Windows is like an old bomb car, always having problems, always breaking down, but you don't want to let it go because she works most of the time and gets you comfortably from A to B. Here's comes the mechanic (IT Guy) to fix it up after another breakdown. After some hard work, sweat, tears and money, it's all fixed and doesn't he feel proud. The proud feeling of fixing that car, getting it running again!

Now insert a magical car which doesn't need regular servicing, rarely breaks down but is a bit more expensive. The mechanics would HATE it! No more work for them, no proud feeling of fixing that car, the troubleshooting until it works. IT Guys are addicted to that.

It's a whole new world people! Embrace it!

Feb 06, 10 - 12:07 am Comment from: AppleMacMan

WOW, I just uninstalled a FF theme on my Mac because I had this gut feeling it might not be safe. I have no proof it's a trojan but I didn't want to take any chances.

I wish we had the names of these two extensions. Anyway on a Mac I find that nothing is better than Safari with ClickToFlash & Glims plugins. 

Feb 06, 10 - 12:55 am Comment from: Sir Gill Bates

@ AppleMacMan,

"Two experimental add-ons, Version 4.0 of Sothink Web Video Downloader and all versions of Master Filer were found to contain Trojan code aimed at Windows users. Version 4.0 of Sothink Web Video Downloader contained Win32.LdPinch.gen, and Master Filer contained Win32.Bifrose.32.Bifrose Trojan. Both add-ons have been disabled on AMO."

http://blog.mozilla.com/addons/2010/02/04/please-read-security-issue-on-amo/

Feb 07, 10 - 01:01 pm Comment from: silverhawk

Safari Version 4.0.4 in Snow Leopard is extremely fast and stable. I see no reason to have any other browser. I ditched FF a year ago but only recently updated to SL.

Reader feedback page 1 of 1 pages:

Always -- Free ground shipping with orders over $50 at the Apple Store.

Add Your Feedback:

Register or Login

Name:

Email: (optional)

Emoticons | Allowed HTML Tags

Remember my info   Notify me of follow-up comments?

Please enter the "MDN Magic Word" you see in the image below: