4 ms·
If the attacker can add an environment variable, they can add a command-line switch or about:config value or modify my firefox binary or install an addon that s
by nodata 12y ago
If the attacker can add an environment variable, they can add a command-line switch or about:config value or modify my firefox binary or install an addon that saves my password fields.
- teddyh 12y agoWhile technically true, that did not prevent Shellshock from being a big deal.
- bodyfour 12y agoShellshock was a big deal because the attacker only needed to control the value of an environment variable, not its name. There are many vectors to provide a string that will end up stored in some environment variable, far fewer that will allow you to specify a particular name/value pair.
- vidarh 12y agoIf I carelessly execute ~/Downloads/some-binary, my environment variables and config settings are now suspect , while overwriting my firefox binary requires root access. As such, having the browser loudly warn (irrespective of settings) about such unsafe defaults is still vastly better.
- Animats 12y agoAs such, having the browser loudly warn (irrespective of settings) about such unsafe defaults is still vastly better. Yes. Loudly. As in "surrounds entire window with a red frame with INSECURE TEST MODE ENABLED", not as in "pops up notification that quietly fades out".
- nodata 12y agoBut poisoning your Firefox binary does not require root access. Just preload what you want.