Software // Enterprise Applications
News
8/2/2007
07:20 PM
Connect Directly
RSS
E-Mail
50%
50%
Repost This

Mozilla Delivers Security Tools, Previews Firefox 3 At Black Hat

Now Mozilla is making its JavaScript fuzzer available to anyone who wants to use it, and it'll be followed later this year by fuzzers for the HTTP and FTP protocols.

Browser security has long been criticized as a flawed construct, but that hasn't stopped browsers from being the default interface for most of the Web's users.

In a bid to improve browser security, both within Firefox and among competing browsers, the Mozilla Foundation Thursday announced several open-source security testing tools, in addition to several security enhancements coming with Firefox 3, scheduled for availability by the end of the year.

Mozilla has been using an open-source application security testing tool, known as a fuzzer, for JavaScript to detect and fix dozens of security bugs in Firefox, Mozilla director of ecosystem development Window Snyder said Thursday at the Black Hat USA 2007 conference in Las Vegas. The JavaScript fuzzer found 280 bugs in Firefox, 27 of which were exploitable.

Now Mozilla is making that JavaScript fuzzer available to anyone who wants to use it, and it'll be followed later this year by fuzzers for the HTTP and FTP protocols.

"The FTP and HTTP protocol fuzzers act like fake servers that send bad data to sites," Snyder told InformationWeek.The HTTP fuzzer emulates an HTTP server to test how an HTTP client handles unexpected input. The FTP fuzzer likewise tests how an FTP client handles unexpected data.

Mozilla worked with Microsoft, Apple, and Opera before making the JavaScript fuzzer widely available in order to reduce the possibility that the tool might be used to expose vulnerabilities in those browsers. All of these browser vendors reviewed the tool and let told Mozilla know that they were okay with the release, Snyder said.

Mozilla's presentation also included a look at some of the new security features for Firefox 3. Expect Firefox 3 to include new phishing and malware protection, extended validation certificates, improved password management, and a security user interface. Knowing that Web users rarely look at the symbols and other information located around the perimeter of the browser page, also known as the chrome, Firefox 3 is designed to make sure that suspected Web forgeries aren't missed, "even though users don't look for them," Mozilla Project co-founder Mike Shaver said Thursday at Black Hat.

In some cases Firefox 3 will not only issue a warning that a site is unsafe, it will prevent the user from accessing that site, "so the users can't just ignore the warnings," Shaver said. "This feature is not without controversy of course."

Mozilla's Black Hat announcements follow the release earlier this week of Firefox 2.0.0.6, designed to fix vulnerabilities that could allow the Firefox browser to pass dangerous data to third-party applications like Microsoft's Internet Explorer. Mozilla's new workarounds and patches come just a few weeks after the organization delivered Firefox 2.0.0.5, which included patches for several other vulnerabilities.

The company is hoping this proactive approach to security will alleviate the need for such incremental browser updates.

Comment  | 
Print  | 
More Insights
Building A Mobile Business Mindset
Building A Mobile Business Mindset
Among 688 respondents, 46% have deployed mobile apps, with an additional 24% planning to in the next year. Soon all apps will look like mobile apps and it's past time for those with no plans to get cracking.
Register for InformationWeek Newsletters
White Papers
Current Issue
InformationWeek Elite 100 - 2014
Our InformationWeek Elite 100 issue -- our 26th ranking of technology innovators -- shines a spotlight on businesses that are succeeding because of their digital strategies. We take a close at look at the top five companies in this year's ranking and the eight winners of our Business Innovation awards, and offer 20 great ideas that you can use in your company. We also provide a ranked list of our Elite 100 innovators.
Video
Slideshows
Twitter Feed
Audio Interviews
Archived Audio Interviews
GE is a leader in combining connected devices and advanced analytics in pursuit of practical goals like less downtime, lower operating costs, and higher throughput. At GIO Power & Water, CIO Jim Fowler is part of the team exploring how to apply these techniques to some of the world's essential infrastructure, from power plants to water treatment systems. Join us, and bring your questions, as we talk about what's ahead.