In a recent blog post on the Mozilla Security Blog, the Firefox-maker revealed the steps it has taken to protect users from code injection attacks by making its browser more secure.
The company has hardened its browser by removing “potentially dangerous artifiacts” from the Firefox codebase, including inline scripts and eval()-like functions, according to the firm's platform security and privacy engineer Christoph Kerschbaumer.
Inline scripts were removed in an effort to improve the protection of Firefox's 'about' protocol which is often referred to as about: pages. These about: pages allow users to do things such as display network information, view how their browser is configured and see which plug-ins they've installed.
- Mozilla launches Firefox Send
- Security flaw in Logitech app allowed for keystroke injection attacks
- Mozilla now charges for "premium" Firefox support
However, since these about: pages are written in HTML and JavaScript, they employ the same security used by web pages, which are also vulnerable to code injection attacks. For instance, an attacker could inject code into an about:page and use it to change configuration settings in Firefox.
Code injection attacks
To help protect Firefox users against code injection attacks, Mozilla decided to rewrite all of its inline event handlers and to move all inline JavaScript code for all 45 of its about: pages to “packaged files”. The company also set a strong Content Security Policy to make sure that any injected JavaScript code is unable to execute.
Kerschbaumer explained how this new measure can help protect against code injection attacks, saying:
“Instead JavaScript code only executes when loaded from a packaged resource using the internal chrome: protocol. Not allowing any inline script in any of the about: pages limits the attack surface of arbitrary code execution and hence provides a strong first line of defense against code injection attacks.”
Additionally, Mozilla has warned developers against using the eval() function which it described as a “dangerous function, which executes the code it's passed with the privileges of the caller”. By rewriting all eval()-like functions, the company has reduced the attack surface in Firefox further.
- Keep your devices secured with the best antivirus software
Viz ZDNet
