May 31st, 2009

Microsoft sneaks in Firefox extension via Update

Posted by Joe Brockmeier @ 6:42 pm

Categories: Business and Open Source, security

Tags: Firefox Extension, Microsoft Corp., Security Update, Extension, Krebs, Security Administration, Patches, Microsoft Windows, Linux, Web Browsers

The good news is that Microsoft is writing extensions for Firefox. The bad news is, the Redmond giant is slipping the extension onto systems without notifying users and making it difficult to get rid of the extension. Even worse? It’s an extension that allows Web sites to install software onto users’ PCs behind the scenes — meaning that Firefox users on Windows may not be as safe as they think.

Brian Krebs, who originally recommended the .Net Framework that sneaks the extension into Firefox writes:

Anyway, I’m sure it’s not the end of the world, but it’s probably infuriating to many readers nonetheless. Firstly — to my readers — I apologize for overlooking this…”feature” of the .NET Framework security update. Secondly — to Microsoft — this is a great example of how not to convince people to trust your security updates.

Krebs is right: It’s not the end of the world. But it seems like a violation of user trust to monkey with a third-party program — and top it off by making it difficult to remove the extension without editing the Windows Registry. By using the update mechanism to sneak software onto the system, Microsoft is telling security conscious users to be suspicious of updates and to deploy them only after they’ve been widely vetted, or choose a more trustworthy vendor.

As a Linux user, it makes little difference to me what Microsoft does via Windows Update –users on openSUSE and other Linux distros can see exactly what updates will do to their system: Down to the source code, if they choose to take the time.

But, failing a source code audit, Microsoft could at least provide a full disclosure of the packages and features modified when a user runs Windows Update. Without that, users should be wary indeed of trusting Microsoft’s updates — and missing a trust relationship for security updates, users should be wary of running Windows in the first place.

February 2nd, 2009

More FOSS security scare-mongering

Posted by Joe Brockmeier @ 4:43 pm

Categories: Business and Open Source, Marketing FOSS, security

Tags: F/OSS, Open Source, Government, Security, Joe Brockmeier

With all the talk of open source and the Obama administration, it shouldn’t come as any surprise that the scare-mongering around FOSS security is going to be close behind — and here’s part of the first wave, fresh from Ernest M. Park.

Park is using a single data point (the Debian SSL issue from last Spring) to try to build uncertainty around the readiness of FOSS for government work, even though he admits proprietary software may be no more secure than FOSS. Here’s what Park has to say:

Now one of the arguments for open source is that their are more eyes looking over the code, since the code is openly available to be reviewed and changed by the community. This is true and one of the reasons that this bug was discovered. The open source system of discovering bugs is beneficial in that the number of people reviewing the code is far greater than proprietary software. But as the Debian OpenSSL case shows us, it might take up to two years before it is discovered or at least published. Within the past two years, this bug may have already been discovered and not published, with the finder exploiting the bug for all that time. The problem with community review is that it is a voluntary choice and not an obligation.

The problem with Park’s argument is this: Access to code is not necessary for discovery of vulnerabilities. Plenty of security holes are discovered in proprietary products without the results being published. Plenty of security holes have existed in proprietary products and been exploited long before the fix was available.

If Park wants to raise concerns about software security, he might start by asking if Microsoft is ready for government work.