As you may or may not know, I help run a few IRC Networks, and reading up on exploits and other security problems is a must.  Part of security is obscurity, i.e. how much can we hide the exploits so people don’t know about them, so they can’t use them, and the other part is openness.

The open source community usually responds very quickly to reports of exploits and fixes them. For instance, Joomla will not publicly announce that there is an exploit until they have fixed it, allowing webmasters a chance to patch them. This allows them to patch their sites before the exploit is known. While this works for most sites, the problem comes from what is know as a ZeroDay Exploit. In the Zero-Day case, the exploits are being used do not have a patch out there for them, and usually can be very dangerous to system administrators. They can range from sql injections to crashes to taking over a computer. Zero-Day’s suck.

Now, Background on the Firefox incident:

Firefox blocks some  nonstandard ports from being used to send commands to.  One of the ports that isn’t blocked by java script in Firefox is 6667.  6667 is the default IRC connection port.  With some java script code, attackers are able to get users to flood different IRC servers just by visiting a website.   The browser then floods the IRCD (IRC Server) with either random data, or a spam message.   Feel free to read about this more here.

I think that this type of attack is just the start, and until the Firefox and Open-Source community actually fix this type of exploit it will be used in more dangerous and evil ways.  While I do understand that sometimes a non-standard port has to be used,  for example Direct-Admin (Web interface configurator) might use port 1111, which would look like http://website.com:1111 .  I think a simple fix for this, is that any type of connection to a nonstandard HTTP port (80, 443) should have an opt in or prompt alerting that it could be used for abuse and that something including fishing could be up.

While every product will likely have some exploits and bugs with them, I do have to say that I have been very impressed with the Open-Source companies about how fast and accurately they actually fix bugs.

Adobe (Closed Source) for example, operates on a longer time frame to fix issues.  This example shows them being aware of an exploit on December 15th, but not expecting an update until Jan 12th.  That is a long time.

Just  a random rant.  Security is always important, and I wouldn’t think that going to my boss and saying, “This exploit can crash our program, and its widely known, however we don’t expect to fix it for a month” would go over to well.  I would expect a resolution or work around quickly.

Anyways. that is all for tonight. Thanks for reading and go Open Source