Microsoft drive by plugin affects Firefox users
Hey guys, long time no see. I hope this topic hasn't been raised before, but today Firefox has recently been showing that a new plugin called Windows Presentation Foundation had been installed. I don't recall installing it, so I google the name. http://www.osnews.com/story/22358/Silent_Install_Firefox_Plugin_Backfires_on_Microsoft.
Whilst it's not okay in Microsoft's eyes for Google to install a plugin into Internet Explorer, increasing the potential surface area of attack, when Microsoft do it to Firefox, it's a different matter. Now a security hole has been found in a plugin that Microsoft have been silently installing into Firefox.
Along with .NET Framework 3.5 SP1, Microsoft have been silently installing a Windows Presentation Foundation Plugin that allows the embedding of XAML applications (an XML-based UI technology) in web pages, called XBAP (XAML Web App).
The exploit is drive-by, meaning that the victim only needs to be lured onto a web-page for the attack to be effective. The only safe thing to do until a patch is issued, is to open Firefox’s AddOn Manager and disable the WPF plugin.
Microsoft were caught earlier this year silently installing a “.NET Framework Assistant” plugin into Firefox, which could not initially be uninstalled. After some pressure from the press, Microsoft relented and provided an update to enable the uninstall button. That update then broke a number of other Firefox extensions.
The only thing that surprises me more, is that I’m not surprised that Microsoft could be this incompetent when it comes to the safety of all users of the web using Windows, regardless if they’re using IE or not.
With greater marketshare than ever before, and a firm position in the mainstream, every software vendor and their dog are wanting to integrate with Firefox. This has led to numerous unwanted, irritating and often uninstallable plugins to add themselves to Firefox. WPF is really only the tip of the iceberg.
Silently installing software on your computer that you are unaware of, is called malware in my book. Mozilla have the capability to blacklist plugins and addons if they misbehave or pose a threat. Frankly, if I were Mozilla, I would ban Microsoft’s plugins from Firefox until they provide an opt-in interface.
This also raises concerns with how Mozilla handle extensions and plugins being installed into the browser without the user’s permission. Whilst Firefox will bring up the AddOns Manager when a new extension is installed, the new extension is not disabled by default until you permit it (Mozilla are working on a proposal for this). External programs on the computer can install extensions into Firefox with nothing more than a registry key, and plugins that are added outside of Firefox itself will not be reported to the user (as in the case with WPF).
With good timing, Mozilla have been working on a Plugin Check system to ensure that users are kept up to date with plugins, which pose a security threat and are a part of the browser users are often unaware of. This follows Mozilla alerting users to an out of date Flash Player version on their landing page for updated Firefox versions.
HTML5 promises to reduce the need for plugins by providing much of the same functionality natively, in the browser via SVG, JavaScript and native video and audio elements. In my opinion, Mozilla need to take a hard stance and stop this plight of plugins as it may turn people off of using Firefox, not least lead to bad press as more plugins are used as exploit vectors in the face of growing Firefox marketshare.
Removal Instructions http://ffextensionguru.wordpress.com/2009/02/08/how-to-remove-microsoft-net-spyware-extension/
ffextensionguru.wordpress.com In Windows Explorer go to this location: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension This folder should contain 2 sub-folder and 2 files. Just in case for some odd reason you might need these files, create a zip or rar file containing these items and place it somewhere else. Delete everything in this folder, but leave the folder Restart Firefox and go to your add-ons list. The add-on should no longer be listed. In the address bar type about:config In the Filter field type general.useragent Look for an entry called general.useragent.extra.microsoftdotnet Right -click on the entry and select ‘reset’
and here as well http://www.annoyances.org/exec/show/article08-600)
annoyances.org Open Registry Editor (type regedit in the Start menu Search box in Vista/Windows 7, or in XP's Run window). Expand the branches to the following key: On 32-bit systems: HKEY_LOCAL_MACHINE \ SOFTWARE \ Mozilla \ Firefox \ Extensions On x64 systems: HKEY_LOCAL_MACHINE \ SOFTWARE \ Wow6432Node \ Mozilla \ Firefox \ Extensions Delete the value named {20a82645-c095-46ed-80e3-08825760534b} from the right pane. Close the Registry Editor when you're done. Open a new Firefox window, and in the address bar, type about:config and press Enter. Type microsoftdotnet in the Filter field to quickly find the general.useragent.extra.microsoftdotnet setting. Right-click general.useragent.extra.microsoftdotnet and select Reset. Restart Firefox. Open Windows Explorer, and navigate to %SYSTEMDRIVE%\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation. Delete the DotNetAssistantExtension folder entirely. Open the Add-ons window in Firefox to confirm that the Microsoft .NET Framework Assistant extension has been removed.