Popular Firefox browser plug-ins are not doing enough to secure their software, a security researcher has said.
Many widely used Firefox extensions, including toolbars from Google, Yahoo and AOL do not use secure connections to update themselves, according to Christopher Soghoian, a security researcher who blogged about the issue.
Soghoian is best known as the researcher who attracted the attention of the FBI late last year after publishing a tool that could be used to print fake boarding passes.
The Indiana University doctoral student discovered the Firefox issue last month while examining network traffic on his computer. He noticed that many of the most popular Firefox extensions are not hosted on servers that use the Secure Sockets Layer (SSL) web protocol. SSL web sites, which begin with "https://," use digital certificates to provide users with some level of assurance that they're not connecting with a fake server.
Although the corporation behind Firefox, Mozilla, hosts the majority of Firefox extensions on its own SSL-enabled web site, it is common for commercial extension-makers such as Google to host their software on an unsecured site, Soghoian said in an interview.
This leaves users vulnerable to a "man-in-the middle" attack, where Firefox could be tricked into downloading malicious software from a site it mistakenly thought was hosting an extension.