Security exploits still target browser vulnerabilities, but attacks on browser plug-ins and vulnerable third-party controls such as Flash and Acrobat are becoming more common. That means Firefox users need to be as cautious as users of Internet Explorer.
The playing field for drive-by exploits through Web browsers appears to be
evening these days, thanks to the rise of exploits through third-party
controls. The chances of Firefox users being exploited are a lot better than
they used to be. This is especially true on Windows Vista.
Microsoft Security Intelligence Report
states, and I believe it based on
what I've seen on my own and through other vendors, that exploits through
third-party controls are the big thing now, saying, "more than 90 percent
of vulnerabilities disclosed in 1H08 affected applications, rather than
operating systems." Two more interesting and relevant quotes:
- For browser-based attacks on
Windows XP-based machines, Microsoft vulnerabilities accounted for 42
percent of the total. On Windows Vista-based machines, however, the
proportion of vulnerabilities attacked in Microsoft software was much
smaller, accounting for just 6 percent of the total.
- Microsoft software accounted
for 5 of the top 10 browser-based vulnerabilities attacked on computers
running Windows XP in 1H08, compared to zero of the top 10 on computers
running Windows Vista.
So Windows and Internet Explorer are a declining factor in
the exploitation of users through browsers on XP, and only a very small factor
What's filling in the non-Microsoft percentage? Third-party apps, with Adobe
Flash as the most important example. There are others, including Acrobat, but
Flash exploits, in the form of malicious SWF files, are very common now. Some
of them are as simple as redirects to a malicious site that tries to do other
things or just to sell you rogue software, but some are full-out buffer
overflows in Flash.
It's this latter type of exploit that is especially interesting. As a
general rule, a buffer overflow in the Flash ActiveX control for IE should work
as well in the Flash plug-in for Firefox. It's all Adobe code being compromised.
It needs to be said here that the most important thing you can do to protect
yourself against these attacks is to be aggressive about applying patches for
important third-party controls, like Flash and Acrobat. Adobe has gotten much
better about bringing out updates and the latest generations of these products
also employ mitigations like DEP and ASLR to fight exploitation even if a
vulnerability is invoked. As with most other products, the people getting
exploited are those running old versions.
I asked a few experts for guidance on this and didn't get as specific an
answer as I had wanted. Do such exploits work as well in Firefox? Are Firefox
users being exploited through these attacks? I also asked Adobe, which didn't
The experts I talked to agreed that, as a general matter, an exploit for a
browser plug-in is as likely to work in one browser as another. In some cases
they would work "out of the box." In other cases there may need to be
some modifications for each environment.
Researcher Thor Larholm
points out that
for the case where memory corruption occurs in an image rendering, you may need
to calculate heap offsets and partition the memory correctly before triggering
the exploit, but it's the same type of work for any browser; in the case of
Flash you can do it all in ActionScript. Does anyone do this work, or do they
just calculate the IE offsets and hard-code them into the exploit? No answers
from anyone; it could be done easily, we just don't know if it is being done.