Mozilla’s Security Tools for Firefox 2.0 Will Not Impact Internet Explorer
Mozilla offered official assurance of the fact that the security tools released for Firefox 2.0 will not impact rival browsers. Internet Explorer, Opera and Safari are not affected by the open source security utilities built especially for Firefox. Furthermore Microsoft, Apple and Opera all gave their O.K. for the release of the JavaScript fuzzer for Firefox 2.0 after Mozilla submitted the tool to its competitors for evaluation. In this manner, Mozilla ensured that the fuzzer would not lead to the discovery of security vulnerabilities and the subsequent exploits in competitor products.
During the “Building and Breaking the Browser” session at Black Hat 2007 in Las Vegas, Window Snyder, the Director of Ecosystem Development at Mozilla Corporation together with Mike Shaver, co-founder of the Mozilla project, presented security tools used to bulletproof the open source browser. “We discussed the methods and tools that Mozilla uses to secure the Firefox browser. These tools include a fuzzer for Javascript, which has led to the discovery and resolution of dozens of critical security bugs. Fuzzers are tools that generate a large amount of input in order to test the robustness of a piece of software and can be used to identify potential vulnerabilities. This is the tool we discussed in our presentation, the first in a series of security tools that we intend to make publicly available,” Snyder revealed.
Essentially, the fuzzer is designed to build random strings with JavaScript statements and expressions and bombard the JavaScript engine with input. It is important to note that the input, sometimes malformed with syntax errors, is delivered as functions to the engine. The obvious role of the tool is to automate the process of sniffing out security flaws. Microsoft, Apple and Opera all received versions of the fuzzer beforehand.
“The responsible sharing of security tools is an important way to contribute to the overall health of the web. We worked with Microsoft, Apple, and Opera to reduce the possibility that this tool might adversely affect users of those browsers. All of these browser vendors reviewed the tool and let us know that they were okay with the release,” Snyder added.
Tags: Firefox, Internet, javascript_engine, opera, security_bugs, security_tools, syntax_errors, Web
Loading ...
coComment - on 07 Aug 2007 at 1:30 am #
view blog[IMG]
Asa Dotzler on 06 Aug 2007 at 8:28 pm #
This is not quite correct:
“Mozilla offered official assurance of the fact that the security tools released for Firefox 2.0 will not impact rival browsers. Internet Explorer, Opera and Safari are not affected by the open source security utilities built especially for Firefox.”
The Opera Desktop team has already thanked Mozilla for the tool because it helped them discover at least 4 flaws in their JavaScript implementation, at least one with security implications.
The tool can be used to find flaws in other browsers’ JS implementations but Mozilla made the tool available to the other browser teams with plenty of lead time so they had a chance to find and fix any problems before the tool was released. Just as there is responsible disclosure of security flaws, so should there be with disclosure of security tools. We think, and the other vendors agreed, that our release was responsible, and even better, it was helpful.
- A
Mozilla’s Security Tools for Firefox 2.0 Will Not Impact Internet Explorer | PCTips Box on 07 Aug 2007 at 4:21 am #
[...] Mozilla’s Security Tools for Firefox 2.0 Will Not Impact Internet Explorer Web, Internet Add comments [...]
Mozilla’s Security Tools for Firefox 2.0 Will Not Impact Internet Explorer | PCTipsBox on 01 Nov 2007 at 11:34 pm #
[...] Mozilla’s Security Tools for Firefox 2.0 Will Not Impact Internet Explorer Web, Internet Add comments [...]