Sneaky Microsoft plug-in puts Firefox users at risk


Recommended Posts

Sneaky Microsoft plug-in puts Firefox users at risk

An add-on that Microsoft silently slipped into Mozilla's Firefox last February leaves that browser open to attack, Microsoft's security engineers acknowledged earlier this week.

One of the 13 security bulletins Microsoft released Tuesday affects not only Internet Explorer (IE), but also Firefox, thanks to a Microsoft-made plug-in pushed to Firefox users eight months ago in an update delivered via Windows Update.

"While the vulnerability is in an IE component, there is an attack vector for Firefox users as well," admitted Microsoft engineers in a post to the company's Security Research & Defense blog on Tuesday. "The reason is that .NET Framework 3.5 SP1 installs a 'Windows Presentation Foundation' plug-in in Firefox."

For the rest of the article

http://news.idg.no/cw/art.cfm?id=5CF0A4A7-...45F5A54F2136086

Consider that add-on uninstalled from my system. Idiots.

I just got the notice from Firefox today. Said the Microsoft.NET Framework Assistant and Windows Presentation Foundation would cause instability and you know what, I have noticed some hanging the last day or so with Firefox open that I never noticed before. Could be related or maybe not. Will see if the issue pops up again.

How do you remove plugins from the blocklist?

EDIT: Fixed. I had to turn off extensions.blocklist.enabled in about:config and reinstall the framework assistant. (Mozilla removed it from their repository. I found it here: http://mirror.atlanticmetro.net/mozilla/addons/9449/)

Do NOT block things on my computer without permission or a way to re-enable them, Mozilla.

Edited by GreyWolfSC
Probably.

It was also a .NET Framework 3.5 plugin getting installed on firefox anyway.

pretty much,yes

How do you remove plugins from the blocklist?

EDIT: Fixed. I had to turn off extensions.blocklist.enabled in about:config and reinstall the framework assistant. (Mozilla removed it from their repository. I found it here: http://mirror.atlanticmetro.net/mozilla/addons/9449/)

Do NOT block things on my computer without permission or a way to re-enable them, Mozilla.

your link is broken , remove the ")" from the end of the link

:)

I just got the notice from Firefox today. Said the Microsoft.NET Framework Assistant and Windows Presentation Foundation would cause instability and you know what, I have noticed some hanging the last day or so with Firefox open that I never noticed before. Could be related or maybe not. Will see if the issue pops up again.

same here, and also noticed my Firefox hanging recently. I'd prefer no Firefox secret installations from Microsoft if they are reading this ...

same here, and also noticed my Firefox hanging recently. I'd prefer no Firefox secret installations from Microsoft if they are reading this ...

It's not a secret Firefox installation. The plug-in is installed as part of the .NET Framework and Firefox picks it up automatically. If anything, we should complain to Mozilla for the browser not asking if the "found" plugin should be added. Their methodology could easily activate a hidden malware plugin the same way.

Strangely this morning when I turned my monitor on (My PC is on constantly) I had a warning from Firefox that it had disabled the Windows Foundation plugin (when checking the plugins it just says "known to cause security issues") and it directed me to the webpage https://en-gb.www.mozilla.com/en-GB/blocklist/

I just got the notice from Firefox today. Said the Microsoft.NET Framework Assistant and Windows Presentation Foundation would cause instability and you know what, I have noticed some hanging the last day or so with Firefox open that I never noticed before. Could be related or maybe not. Will see if the issue pops up again.

I got the message yesterday as well, right before firefox crashed on me. :no:

Mozilla is in your browser, disabling your addons ;)

screw that sh*t

its been all over the net how to disable/remove this Microsoft addon long before they enabled the option

i do not need Mozilla looking out for me

That's what I'm sayin'. I bet Mozilla wouldn't have liked it if Microsoft had uninstalled and blacklisted Firefox due to the crypto spoofing flaw.

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Supposedly it's fixed on Series consoles: https://support.forza.net/hc/e...e-Issues-in-Forza-Horizon-6 This game is so much better than FH5, and it's all because of the map. It's diverse, big, and so much to see and do. I've bought every single Forza Motorsport and Horizon game, and by far my least played is FH5 at 100 hours, followed by the latest Motorsport. They've finally made a good one with FH6
    • Sorry to be that guy but, Given Trump won again even after a failed first term it would appear attacking the other side is how to gain Government in America. Voters when it came down to it didn't give a s**t about those Democratic achievements and voted for Trump over an intelligent, qualified mixed race woman. We need to face up to this uncomfortable reality. There are more Americacan voters who support racism and christian bigotry along with defending and supporting pedophilia, adjudicated rapists, multiple time convicted felons etc than those who don't. Btw, that is how the world sees America now. Not that Trump voters care as they attempt to cocoon themselves in a white supremacy bubble.
    • That's not clickbait. Clickbait is headlines like, "You'll never guess what this person looks like now" for example. For goodness sake, take a look around the internet if you think this is clickbait. How do sites survive if people don't click through to articles? How many people in all honesty would have clicked this if it had your suggested headline? You and those upvoting your post won't be happy until the web is a couple of hundred websites all behind a paywall.
    • HopToDesk 1.46.2.0 by Razvan Serea HopToDesk aims to improve the user experience by providing a free, easy-to-use, and secure remote desktop solution for all major device types including Windows PC, Mac, Linux, Android, Chrome Books, iOS, and even Raspberry Pi devices. HopToDesk empowers you to connect, control, and collaborate with ease. Whether you're providing IT support, managing remote teams, or accessing your own devices from anywhere, HopToDesk offers a reliable and secure solution. HopToDesk does not and cannot monitor user activity as the application uses end-to-end encryption for all traffic, and does not make a distinction between personal and business use (both are allowed). Additionally, HopToDesk includes many of the main features of common remote desktop solutions such as Unattended Access, File Transfer, Live Chat, Wake-On-LAN, 2FA, Direct IP access, a Recent Session and Favorite list, and is available in over 20 languages. HopToDesk can run in portable mode or installed on desktop operating systems. Installation is optional, and will install the HopToDesk service which runs in the background and listens for incoming connections, allowing the device to be accessible at all times. Why Choose HopToDesk? Completely Free: Enjoy full access for both personal and commercial use—no hidden fees or limitations. End-to-End Encryption: All communications, including screen sharing, file transfers, and chats, are protected with robust encryption. Open Source: Contribute to and benefit from a transparent and community-driven project. No Account Required: Connect instantly without the need for sign-ups or subscriptions. Core Features Remote Control & Screen Sharing: Effortlessly access and manage remote devices. File Transfer: Securely send and receive files with drag-and-drop simplicity. Live Chat: Communicate in real-time during sessions. Multi-Monitor Support: Navigate multiple screens with ease. Clipboard Synchronization: Copy and paste seamlessly across devices. Wake-on-LAN: Power on remote systems remotely. Session Recording: Document sessions for future reference. Two-Factor Authentication: Enhance security with an additional verification layer. Custom Branding: Personalize your remote sessions with custom avatars. Unattended Access: Connect to devices without requiring user intervention. Network Customization: Adjust settings like TURN relays and signaling servers to suit your environment. Centralized Device Management Utilize the HopToDesk Dashboard to: Monitor device status in real-time. Generate invite links for easy device integration. Customize network settings and synchronize changes effortlessly. Add a personal touch with custom avatars displayed during remote sessions. Download: HopToDesk 64-bit | HopToDesk 32-bit | ~9.0 MB (Freeware) Download: HopToDesk ARM64 | 21.4 MB Link: HopToDesk Home Page | Screenshot Get alerted to all of our Software updates on Twitter at @NeowinSoftware
  • Recent Achievements

    • Reacting Well
      Almohandis earned a badge
      Reacting Well
    • First Post
      Cosminus earned a badge
      First Post
    • One Year In
      ThatGuyOnline earned a badge
      One Year In
    • Week One Done
      Jeroen Wilms earned a badge
      Week One Done
    • Week One Done
      rolfus earned a badge
      Week One Done
  • Popular Contributors

    1. 1
      +primortal
      477
    2. 2
      +Edouard
      181
    3. 3
      PsYcHoKiLLa
      119
    4. 4
      Steven P.
      84
    5. 5
      neufuse
      73
  • Tell a friend

    Love Neowin? Tell a friend!