5 ms·

They're installing a service that runs with elevated privileges to bypass UAC. I don't think it's a good thing to install that kind of loophole on your PC.

ars 15y ago
It's even worse to have people with ancient versions because firefox was installed by admin, but they (as they should) run as a regular user.
RDeckard 15y ago
As long as it's done right and only installs updates signed by Mozilla, then it is secure.
- shin_lao 15y ago
  I'll bet you a beer or whatever you like to drink we're going to see a flurry of exploits around this service. I happen to have written a similar service a couple of years ago for a very different purpose and let me tell you one thing: this is nothing less than a backdoor. You run a program from the service and make sure it runs in the user's session. The problem is, how do you decide a program is "legit"? You're going to tell me "you check against a digital signature". Except it doesn't work. You can only check parts of the binary, not the whole binary (as some content is unpredictable once it runs). The other big problem - assuming they have a perfect gateway - is that a vulnerability in Firefox could become catastrophic as it could go through the service to run as a privileged user and wreak havoc.
  - jsight 15y ago
    > You're going to tell me "you check against a digital signature". Except it doesn't work. You can only check parts of the binary, not the whole binary (as some content is unpredictable once it runs). I read this a few times, and I still don't get why you wouldn't check the whole binary. Care to elaborate?
  - zobzu 15y ago
    1: Firefox always used UAC for updates. Did it wreak havoc? Because believe it or not, UAC = admin rights. That's because Firefox always installed itself in program files. 2: You could exploit Google's update service as well. Do I see flurry exploits around it? Much much smaller code base. Much less complex tasks. 3: A digital signature signs the whole binary. Not parts of the binary. Do you know how this works? There's no such thing such as signing a partial binary.
    - deleted 15y ago
      [deleted]
  - sjwright 15y ago
    > You can only check parts of the binary, not the whole binary Not only would they be signing the binary in its entirety, they're almost certainly signing every single byte of the update package, right down to the very last manifest file and license agreement. > some content is unpredictable once it runs Yes, but "some" content isn't allowed to run.
- deleted 15y ago
  [deleted]
jlongster 15y ago
It's how Chrome does it too, I believe.
zobzu 15y ago
That's actually the right way to do it. How do you think Chromes does? Right, they're installing in the user area, not in the application area, to bypass UAC. That's wrong. Using a service that uses authenticated connections and signed installs is similar to what Windows Update does, for the right reasons. Best would be that Windows Update would be open to let any app hook into it for updates of course, but til then, that's as close as it gets.
- Dylan16807 15y ago
  A service to handle updates is good. A service per application to handle updates is not very good. Why is chrome bad? It at least can't lead to a system compromise.
  - Piskvorrr 15y ago
    Alas, that's more of a messy patch over Windows' lack thereof, IMNSHO (Windows Update indeed exists, and updates the Windows OS, but that's about all you can do with it).
    - gouranga 15y ago
      It will allow vendor patching but it costs money and is damn complicated so noone bothers.
  - zobzu 15y ago
    Why not? Since Chrome is in the user area, guess what, anything compromising Chrome can overwrite Chrome itself. It can then prompt you with UAC or simply have a user space trojan. (heh, and it can't compromise Firefox if it's also installed) An updater has a several magnitudes less code to audit (thousand, millions magnitudes?). In Firefox's case, if Firefox is compromised, it cannot modify itself (heh, it can compromise Chrome if it's also installed)
    - huhtenberg 15y ago
      If Firefox is in UAC'd location, then a Firefox compromise would simply drop an .exe or .dll into user's directory and set it up to be launched by Firefox. As an add-on, for example, or through the same exploit it used to enter the system. In other words, the installation location doesn't really matter. If the process is breached, the user context is f#cked regardless.
antihero 15y ago
Isn't this basically the equivalent of suexec?
Silhouette 15y ago
Has anyone got a link to a clear explanation of this new Mozilla Maintenance Service, please? I'm trying to find reliable information, but it's hard to see the wood for the trees in most of the documentation/commentary I'm finding. I did notice that something popped up on one of my computers, having triggered an alarm in one of my security tools. I automatically told it to block the installation, the same as I do for anything else that presumes to invite itself onto my system without first explaining what it does and asking my permission. It does seem to have sneaked in on my work PC, but seems to have configured the service to run with manual startup only. So what exactly triggers this service, and what kind of security implications are there? In short, do I really want this (given that I really don't care about absurdly frequent updates unless there's a security alert that requires an immediate fix) or should I nuke it?

ars 15y ago

It's even worse to have people with ancient versions because firefox was installed by admin, but they (as they should) run as a regular user.

RDeckard 15y ago

As long as it's done right and only installs updates signed by Mozilla, then it is secure.

shin_lao 15y ago
I'll bet you a beer or whatever you like to drink we're going to see a flurry of exploits around this service. I happen to have written a similar service a couple of years ago for a very different purpose and let me tell you one thing: this is nothing less than a backdoor. You run a program from the service and make sure it runs in the user's session. The problem is, how do you decide a program is "legit"? You're going to tell me "you check against a digital signature". Except it doesn't work. You can only check parts of the binary, not the whole binary (as some content is unpredictable once it runs). The other big problem - assuming they have a perfect gateway - is that a vulnerability in Firefox could become catastrophic as it could go through the service to run as a privileged user and wreak havoc.
- jsight 15y ago
  > You're going to tell me "you check against a digital signature". Except it doesn't work. You can only check parts of the binary, not the whole binary (as some content is unpredictable once it runs). I read this a few times, and I still don't get why you wouldn't check the whole binary. Care to elaborate?
- zobzu 15y ago
  1: Firefox always used UAC for updates. Did it wreak havoc? Because believe it or not, UAC = admin rights. That's because Firefox always installed itself in program files. 2: You could exploit Google's update service as well. Do I see flurry exploits around it? Much much smaller code base. Much less complex tasks. 3: A digital signature signs the whole binary. Not parts of the binary. Do you know how this works? There's no such thing such as signing a partial binary.
  - deleted 15y ago
    [deleted]
- sjwright 15y ago
  > You can only check parts of the binary, not the whole binary Not only would they be signing the binary in its entirety, they're almost certainly signing every single byte of the update package, right down to the very last manifest file and license agreement. > some content is unpredictable once it runs Yes, but "some" content isn't allowed to run.
deleted 15y ago
[deleted]

jlongster 15y ago

It's how Chrome does it too, I believe.

zobzu 15y ago

That's actually the right way to do it. How do you think Chromes does? Right, they're installing in the user area, not in the application area, to bypass UAC. That's wrong. Using a service that uses authenticated connections and signed installs is similar to what Windows Update does, for the right reasons. Best would be that Windows Update would be open to let any app hook into it for updates of course, but til then, that's as close as it gets.

Dylan16807 15y ago
A service to handle updates is good. A service per application to handle updates is not very good. Why is chrome bad? It at least can't lead to a system compromise.
- Piskvorrr 15y ago
  Alas, that's more of a messy patch over Windows' lack thereof, IMNSHO (Windows Update indeed exists, and updates the Windows OS, but that's about all you can do with it).
  - gouranga 15y ago
    It will allow vendor patching but it costs money and is damn complicated so noone bothers.
- zobzu 15y ago
  Why not? Since Chrome is in the user area, guess what, anything compromising Chrome can overwrite Chrome itself. It can then prompt you with UAC or simply have a user space trojan. (heh, and it can't compromise Firefox if it's also installed) An updater has a several magnitudes less code to audit (thousand, millions magnitudes?). In Firefox's case, if Firefox is compromised, it cannot modify itself (heh, it can compromise Chrome if it's also installed)
  - huhtenberg 15y ago
    If Firefox is in UAC'd location, then a Firefox compromise would simply drop an .exe or .dll into user's directory and set it up to be launched by Firefox. As an add-on, for example, or through the same exploit it used to enter the system. In other words, the installation location doesn't really matter. If the process is breached, the user context is f#cked regardless.

antihero 15y ago

Isn't this basically the equivalent of suexec?

Silhouette 15y ago

Has anyone got a link to a clear explanation of this new Mozilla Maintenance Service, please? I'm trying to find reliable information, but it's hard to see the wood for the trees in most of the documentation/commentary I'm finding. I did notice that something popped up on one of my computers, having triggered an alarm in one of my security tools. I automatically told it to block the installation, the same as I do for anything else that presumes to invite itself onto my system without first explaining what it does and asking my permission. It does seem to have sneaked in on my work PC, but seems to have configured the service to run with manual startup only. So what exactly triggers this service, and what kind of security implications are there? In short, do I really want this (given that I really don't care about absurdly frequent updates unless there's a security alert that requires an immediate fix) or should I nuke it?