Black Hat 2008: What’s next for Firefox security

Mozilla security chief [Window Snyder] made some surprising announcements about Firefox Next, Mozilla’s next major browser overhaul. In her chat at the Black Hat security conference, she introduced three new initiatives that focused on threat modeling, training, and vulnerability metrics. For the threat modeling initiative, she’s hired Matasano Security consultants to review Firefox’s code for weaknesses and recommend mitigation tactics to protect the browser from hacker attacks. This isn’t inherently unusual; what is abnormal is that the information, once the work is done, will be revealed to the public. The training initiative will have IOActive trainers working with Mozilla engineers on secure computer programming practices. At the end, according to [Snyder], online versions of the classes will be released to the public, along with the class materials. The last initiative revolves around security metrics, and is already in progress. Essentially, the project will ideally take the focus off of patch-counting and provide a better assessment of security and vulnerability issues. [Snyder] says “We’re in the early phase, working on incorporating feedback from the rest of the industry.” She also reveals some more Firefox developments, including possibly incorporating NoScript into the core browser and implementing protected mode, but they’re still a long way from becoming standard features.

Firefox 3 vulnerability


TippingPoint’s Zero Day Initiative reported a critical vulnerability affecting Firefox 3.0 yesterday. It includes the 2.0 versions as well. It’s unreleased and Mozilla is working on a fix already. Whatever the exploit is, it does require the user to visit a malicious site or click a link to executed. It came in 5 hours after the FF3 release, but since it affects previous versions, we wonder if the researcher was just sitting on it to be first. The Zero Day Initiative pays researchers for the exploits they submit.

Hacking Firefox menus


[Nick] sent in his quick hack for getting rid of extra menu options in Firefox 3, like the ever useless ‘Work Offline’ option. (OK, maybe modem lovers like it…) If you’re tired of seeing cluttered menu choices that you never use, [Nick]’s simple trick of editing the XML formatted XUL files in Firefox to clean things up. There’s some risk involved, but it’s nothing that a quick re-install can’t repair. The writeup includes a basic introduction to the XML tags, so you can probably do it. You can use a text editor right? (Just don’t forget to have the installer or a backup copy handy before you start playing around.)

Mozilla’s first public release


In honor of Firefox 3.0 download day, Waxy.org has posted the full Code Rush documentary. It spans March ’98 to April ’99, as the Mozilla team publishes the first source code and then the eventual AOL acquisition of Netscape. Embedded above is a short clip of [Jamie Zawinski] pushing the code live at 10AM on March 31, 1998. The hour documentary is well worth watching.

If you’re unsure about moving from FF2 to 3, MultiFireFox still works perfectly fine with the new release.

Get Firefox 3 early


It’s five hours till the official release of Firefox 3. We know your hands are sweating in anticipation, waiting to click that download link and contribute to the greatest World Record known to man… What? You don’t want your browser to have all the notoriety afforded to fat twins? Well then, let’s just go grab the file now since they’re already on the mirrors.

First, pick out a mirror from the official list. Navigate to the the directory of the Firefox 3.0 release: /pub/mozilla.org/firefox/releases/3.0/ You’ll be greeted by a message that says, “We’re not quite ready yet!” and that “Downloading them directly can harm our ability to distribute Firefox efficiently.” Also, you won’t be in the world record count. Think about that, jerk. All releases are named using a consistent pattern. Looking at an earlier release you can determine that the Mac version of 3.0 will be named: Firefox 3.0.dmg Add on the OS and language directories and it will look like this: /pub/mozilla.org/firefox/releases/3.0/mac/en-US/Firefox%203.0.dmg

You can find out more about the new release by reading Dria’s Field Guide to Firefox 3.

Exploit-Me Firefox XSS and SQL scanning addon


One of the best tools we saw at LayerOne was the Exploit-Me series presented by [Dan Sinclair]. Security Compass created these tools to help developers easily identify cross site scripting (XSS) and SQL injection vulnerabilities.

Continue reading “Exploit-Me Firefox XSS and SQL scanning addon”

Speed testing the latest web browsers


With the imminent release of Firefox 3 and Opera 9.5 being finalized this week, Lifehacker decided it was a good time to run the browsers head to head to see which was the fastest and least resource intensive. The testing system was a 2GHz 2GB Vista machine. The timing system used wasn’t directly hooked to the browser, so tests were repeated multiple times to improve accuracy. The cold start winner was Opera, but most browsers opened in about a second if they had been run recently. Safari did well loading content in multiple tabs at the same time, probably due to its short render times for JavaScript and CSS. The final test was memory usage; we’re sure many people will be happy to know that Firefox 3 RC3 only used 66% of the RAM required by the other three browsers.