The IT Nerd

If you think Firefox is secure, you may want to think again. At Pwn2Own this year, every major browser was exploited at least once. But Firefox was exploited the most. Why is that? I’ll let Sid Stamm, senior engineering manager of security and privacy at Mozilla tell you:

“Pwn2Own offers very large financial incentives to researchers to expose vulnerabilities, and that may have contributed in part to the researchers’ decision to wait until now to share their work and help protect Firefox users,” Stamm said. “Mozilla also offers financial rewards in our bug bounty program, and this program’s success has inspired other companies to follow suit.” 

Perhaps that’s true. Mozilla now pays researcher only $3,000 per vulnerability. Someone who finds a bug at Pwn2Own $50,000. Having said that, here’s something to consider. Could it be that Firefox is simply insecure and Mozilla really needs to step up their game? Perhaps. Mozilla is going to rapidly fix anything that was exploited at Pwn2Own, but you can bet that a whole lot of people are going to look at Firefox a whole lot closer for anything that they can exploit. And some of them will be interested in crime and not scoring a bounty from Mozilla.

So is Firefox insecure? We’ll find out soon enough.

Everybody is jumping into the phone market. The latest entrant is the Mozilla who announced on Sunday that they’re going to be releasing phones with a Firefox based OS:

The Mountain View, Calif.-based foundation said Sunday that phones running Firefox OS will appear this summer, starting in Brazil, Colombia, Hungary, Mexico, Montenegro, Poland, Serbia, Spain and Venezuela.

Why would they do that? Here’s a good reason:

Mozilla Foundation has an ally in phone companies, who are interested in seeing an alternative to Apple and Google, particularly one coming from a non-profit foundation. Thirteen phone companies around the world have committed to supporting Firefox phones, Mozilla said, including Sprint Nextel in the U.S., though it gave no time frame for a release. Other supporters include Telecom Italia, America Movil of Mexico and Deutsche Telekom of Germany. DT is the parent of T-Mobile USA, but plans to sell Firefox phones first in Poland.

It will be interesting to see if they can make it work. This is a market that is dominated by Apple and Google. I’m dubious if a third player can really make this work. But Firefox has the brand name recognition that may help this work and if the price is right, they may be able to make a go of it. The one thing I’ll point out is that there’s no timetable for the release of this phone in the USA. Strange. I’m not sure how to read that yet. Perhaps it will become clear as plans for this phone moves forward.

The latest version of Firefox has hit the streets. Version 12 is available for download here. But if you read the release notes, there is one new feature of interest:

Windows: Firefox is now easier to update with one less prompt (User Account Control)

Sounds harmless enough. But check out this blog post and you’ll find this:

Firefox simplifies the update process for Windows users by removing the user account control dialog (UAC) pop-up while maintaining the security of your system

What this means is simple. The browser will now update itself without needing you to do anything other than clicking allow on the User Account Control dialog found in Windows Vista or Windows 7 once. In short, it’s just like Chrome which has worked like this for some time. You’ll excuse me, but I am not overly thrilled by this. Why? Now you have part of your browser running as a high privileged service on your computer. What could possibly go wrong with that? Something or someone could leverage that to do something like spread a virus for example. I’m sure that I could come up with other scenarios, but you get the idea.

So far, I haven’t found a way to disable silent updates. But if I do, I will post it here. Having said that, there is a version of Firefox called Firefox Extended Support Release that doesn’t have this behavior. So if you are someone in a IT environment who wants to control how the browser is updated, this is an option for you.

Oh, I should note that as far as I can tell, this is a Windows only thing. Users on other operating systems shouldn’t need to worry about this. Yet.

UPDATE: Here’s how you disable silent updates. Go to the Tools menu and choose Options. Then click Advanced. You should see this:

Choose something other than “Automatically install updates” as well as uncheck “use a background service to install updates” and Firefox will not silently update.