Will Design Flaws Flunk Firefox?

Datamation content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More .

LAS VEGAS — The open source Mozilla Firefox Web browser is potentially at risk from design flaws that could allegedly let attackers take whatever they want from users’ computers. Radware Security researcher Itzik Kotler is alleging that he can exploit Mozilla Firefox, and he’s going to demonstrate how at Black Hat.

Kotler’s exploit framework for Firefox is called Jinx, and it utilizes JavaScript to enable an attacker to read anything from a user’s hard drive. Jinx could potentially put millions of users at risk if Kotler is correct in his risk assessment. Mozilla is concerned about the issue, though it isn’t certain of what the risk actually is to users.

Kotler admitted to InternetNews.com that he specifically targeted Firefox to find vulnerabilities. “People are hacking Internet Explorer every day, and if I did the same thing on IE people would just say it’s just another IE vulnerability,” he said.

“I wanted to do something different,” Kotler explained. “People say that it’s Firefox — it’s not supposed to be as bad, and it’s supposed to be safer and more secure so I took it as a challenge.”

Kotler explained that his intention was to create a form of malware that didn’t rely on virtualization or SQL injection but rather is completely dependent on the browser itself.

“The basic thing that Jinx implements is that it will download files from your computer and send it to a remote Web site,” he said.

Kotler argued that Jinx goes beyond a basic cache reading exploit of the type that was discussed at Black Hat in 2006. Jinx is a full hard drive read allowing the attacker to access anything on the drive.

Reading a user’s hard drive contents alone wasn’t enough for Kotler who claimed that function alone bored him after a period of time.

“I got bored with it so I made it into a bot and interactive, so I can manage multiple Jinx instances,” Kotler said. “We end up having a complete framework all in JavaScript in the browser without code injection or virtualization. It’s just you, Firefox and us.”

To execute the Jinx framework, Kotler explained that he uses a file URI (define) handler as a way to dig into the target system. Mozilla had a number of high-profile issues with URI handling in the last year. In fact Mozilla rearchitected Firefox 3 so that it would not be at risk from the same sorts of issues that plagued Firefox 2. The third iteration was released earlier this
year.

As it turns out, Kotler admitted that Jinx in its current implementation only affects Firefox 2 and not Firefox 3 specifically because of how Firefox 3 handles URIs. That said, he did note that he is confident that if he spent more time on research he could figure out a way to attack Firefox 3 or any other browser.

“I would say that if I would have the target and the time, I’m pretty sure it’s portable and that this could work on any other browser that has Ajax support,” Kotler said.(Ajax (define)
stands for Asynchronous JavaScript and XML.)

Kotler claims that he e-mailed his presentation to Window Snyder, Mozilla’s chief security officer to disclose the issues he had discovered.

Snyder told InternetNews.com that she had received an e-mail from Kotler only last Friday about the presentation.

“My concern is that Firefox 2 is still in use and even though the same functionality isn’t in Firefox 3, anything that could potentially hurt our users is a concern,” Snyder said. “We’re very concerned about this.”

This article was first published on InternetNews.com.