Don't trust Google Toolbar, researcher says

Don't trust Google Toolbar, researcher says

Trivial oversight allows Wi-Fi attacks

Article comments

Popular Firefox browser plug-ins are not doing enough to secure their software, a security researcher has said.

Many widely used Firefox extensions, including toolbars from Google, Yahoo and AOL do not use secure connections to update themselves, according to Christopher Soghoian, a security researcher who blogged about the issue.

Soghoian is best known as the researcher who attracted the attention of the FBI late last year after publishing a tool that could be used to print fake boarding passes.

The Indiana University doctoral student discovered the Firefox issue last month while examining network traffic on his computer. He noticed that many of the most popular Firefox extensions are not hosted on servers that use the Secure Sockets Layer (SSL) web protocol. SSL web sites, which begin with "https://," use digital certificates to provide users with some level of assurance that they're not connecting with a fake server.

Although the corporation behind Firefox, Mozilla, hosts the majority of Firefox extensions on its own SSL-enabled web site, it is common for commercial extension-makers such as Google to host their software on an unsecured site, Soghoian said in an interview.

This leaves users vulnerable to a "man-in-the middle" attack, where Firefox could be tricked into downloading malicious software from a site it mistakenly thought was hosting an extension.


Send to a friend

Email this article to a friend or colleague:

PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.

We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
* *