Sneaky Microsoft plug-in puts Firefox users at risk


Recommended Posts

Sneaky Microsoft plug-in puts Firefox users at risk

An add-on that Microsoft silently slipped into Mozilla's Firefox last February leaves that browser open to attack, Microsoft's security engineers acknowledged earlier this week.

One of the 13 security bulletins Microsoft released Tuesday affects not only Internet Explorer (IE), but also Firefox, thanks to a Microsoft-made plug-in pushed to Firefox users eight months ago in an update delivered via Windows Update.

"While the vulnerability is in an IE component, there is an attack vector for Firefox users as well," admitted Microsoft engineers in a post to the company's Security Research & Defense blog on Tuesday. "The reason is that .NET Framework 3.5 SP1 installs a 'Windows Presentation Foundation' plug-in in Firefox."

For the rest of the article

http://news.idg.no/cw/art.cfm?id=5CF0A4A7-...45F5A54F2136086

Consider that add-on uninstalled from my system. Idiots.

I just got the notice from Firefox today. Said the Microsoft.NET Framework Assistant and Windows Presentation Foundation would cause instability and you know what, I have noticed some hanging the last day or so with Firefox open that I never noticed before. Could be related or maybe not. Will see if the issue pops up again.

How do you remove plugins from the blocklist?

EDIT: Fixed. I had to turn off extensions.blocklist.enabled in about:config and reinstall the framework assistant. (Mozilla removed it from their repository. I found it here: http://mirror.atlanticmetro.net/mozilla/addons/9449/)

Do NOT block things on my computer without permission or a way to re-enable them, Mozilla.

Edited by GreyWolfSC
Probably.

It was also a .NET Framework 3.5 plugin getting installed on firefox anyway.

pretty much,yes

How do you remove plugins from the blocklist?

EDIT: Fixed. I had to turn off extensions.blocklist.enabled in about:config and reinstall the framework assistant. (Mozilla removed it from their repository. I found it here: http://mirror.atlanticmetro.net/mozilla/addons/9449/)

Do NOT block things on my computer without permission or a way to re-enable them, Mozilla.

your link is broken , remove the ")" from the end of the link

:)

I just got the notice from Firefox today. Said the Microsoft.NET Framework Assistant and Windows Presentation Foundation would cause instability and you know what, I have noticed some hanging the last day or so with Firefox open that I never noticed before. Could be related or maybe not. Will see if the issue pops up again.

same here, and also noticed my Firefox hanging recently. I'd prefer no Firefox secret installations from Microsoft if they are reading this ...

same here, and also noticed my Firefox hanging recently. I'd prefer no Firefox secret installations from Microsoft if they are reading this ...

It's not a secret Firefox installation. The plug-in is installed as part of the .NET Framework and Firefox picks it up automatically. If anything, we should complain to Mozilla for the browser not asking if the "found" plugin should be added. Their methodology could easily activate a hidden malware plugin the same way.

Strangely this morning when I turned my monitor on (My PC is on constantly) I had a warning from Firefox that it had disabled the Windows Foundation plugin (when checking the plugins it just says "known to cause security issues") and it directed me to the webpage https://en-gb.www.mozilla.com/en-GB/blocklist/

I just got the notice from Firefox today. Said the Microsoft.NET Framework Assistant and Windows Presentation Foundation would cause instability and you know what, I have noticed some hanging the last day or so with Firefox open that I never noticed before. Could be related or maybe not. Will see if the issue pops up again.

I got the message yesterday as well, right before firefox crashed on me. :no:

Mozilla is in your browser, disabling your addons ;)

screw that sh*t

its been all over the net how to disable/remove this Microsoft addon long before they enabled the option

i do not need Mozilla looking out for me

That's what I'm sayin'. I bet Mozilla wouldn't have liked it if Microsoft had uninstalled and blacklisted Firefox due to the crypto spoofing flaw.

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • "to in-game content custom-made for the brands" Which EA will turn around and charge customers extra for in an attempt to double dip.
    • NirLauncher 1.30.24 by Razvan Serea NirLauncher is a suite of more than 200 of NirSoft's excellent portable freeware Windows utilities, and provides an interface that makes it easy to find and launch the tools you need. Which works for us - because there's something here for everyone. Have you forgotten a password stored in your browser or email client, for instance? Recovery tools here may be able to find them for you. Maybe you'd like to check your hard drive health? A disk tool will display its S.M.A.R.T. data (if the drive supports this), so you can view read/ write errors, temperature and other useful details. Is your system unstable? The System Utilities section includes several tools that can help to explain why your PC might be crashing. And there are a host of other programs on offer in categories like "Network Monitoring", "Web Browser Tools", "Video/ Audio Related Utilities", "Outlook/ Office Utilities" and more. Please note, perhaps because a few of these tools can be used maliciously (the password revealers, say), some antivirus programs will flag them as threats. We've never had a problem with any NirSoft tool, though, and you can read more on this issue at the author's site. NirLauncher is an excellent set of free tools, and a must-have for everyone's portable troubleshooting toolkit. NirLauncher Features: NirLauncher can be used from USB flash drive without need of any installation. NirLauncher and all the utilities in the package are completely freeware, without any Spyware/Adware/Malware. This package doesn't contain any 3-party software, toolbars, Web browser plugins, or other unwanted surprises. It will not install any software on your system and it will not change your Web browser homepage or other settings on your system. NirLauncher package includes variety of tools that you may need for your daily computer use, including utilities to recover lost passwords, to monitor your network, to view and extract cookies, cache, and other information stored by your Web browser, to search files in your system, and more... For every utility in the package, you can easily run it, view the help file, or jump to the Web page of the utility. When using it from USB flash drive, the configuration of every utility is saved into .cfg file on the flash drive. On x64 systems, NirLauncher automatically run the x64 version of the utility, when there is a separated x64 version. NirLauncher also allows to add more software packages in additional to the main NirSoft package. NirLauncher allows you generate plugin files for BartPE (Launcher -> Generate BartPE Plugin Files), so you can easily use the utilities of NirSoft from a bootable live windows CD. Additional packages (Piriform, SysInternals...) and instructions are available on the Nirlauncher download page. Note: This zip file below is password-protected. The password for extracting the files is nirsoft9876$ Download: NirLauncher 1.30.24 | 39.8 MB (Freeware) Link: NirLauncher Home Page | Screenshot Get alerted to all of our Software updates on Twitter at @NeowinSoftware
    • What people who support this position of LibreOffice do not understand is that EuroOffice is not made to appease the open source enthusiasts (I am also one) and evangelists. EuroOffice was made because some European companies wanted independence from Microsoft Office Suite, which is something installable on your computer. This move to independence was pushed by public institutions and governments in Europe, as well. Using a proprietary FORMAT as default, does not make you dependent on MS. The actual program does. A format can be changed with a simple update in the future in a dystopian world where MS would manipulate the format to lock others out. However, using MS Office proprietary format, guarantees that all the current documents used by companies, organizations, institutions, etc, will be compatible with EuroOffice and the suite will have the best chances at adoption, especially by slow moving organizations like governments and the public sector. It is as simple as that. For the same reason, even the UI is incredibly similar to MS Office. For the same reason (adoption) the choice was made to be open source. Not because EU particularly loves open source ideologically, but because it gives the best starting point to create trust in the project and amass developers and contributions to the project quickly, to catch up with proprietary projects like MS Office. I don't understand how people don't realize it.
    • How old is this tip? Seems 15-20 years old? Processor states for the CPU under Windows power options has been a thing for a long, long time. It certainly isn't new or hidden... Also, with laptops it doesn't make any difference what OS you are running, all of them are configured for battery longevity over performance, for obvious reasons. Wanted to add as well that most systems in use currently do burst as setup in the uefi bios settings, and usually when a setting is "hidden" like this in Windows it's because it's either obsolete or it is redundant--doesn't override the bios and the CPU drivers. There is a lot of crap in the registry that needs to come out...;) It's hamless and might consume 1-2kb of space in total, though.
  • Recent Achievements

    • Week One Done
      Jeroen Wilms earned a badge
      Week One Done
    • Week One Done
      rolfus earned a badge
      Week One Done
    • One Month Later
      Leroy Jethro Gibbs earned a badge
      One Month Later
    • Conversation Starter
      flexorcist earned a badge
      Conversation Starter
    • One Month Later
      AndreaB earned a badge
      One Month Later
  • Popular Contributors

    1. 1
      +primortal
      512
    2. 2
      +Edouard
      205
    3. 3
      PsYcHoKiLLa
      136
    4. 4
      ATLien_0
      90
    5. 5
      Steven P.
      85
  • Tell a friend

    Love Neowin? Tell a friend!