Thursday, May 08, 2008

Annoying Journalism from Robert McMillan, IDG News Service

The following is a story about Mozilla Firefox browser being infected with a trojan in the Vietnamese language version which may or may not be included with the version you (and I ) have downloaded.

There, I just encapsulated the whole story - and even my beef - where Robert McMillan or his editor could not.

My complaint is this: why didn't they say that most versions include all language packs, or most of the thousands of downloads recently, contain the Trojan. The article does not say "if you downloaded the English version you have nothing to worry about" or "99 percent of cases affect those poor Vietnamese sods that use Firefox". They do say we should disable the plugin, but does that mean even though I do not use it (Vietnamese) that the plugin will cause problems Sure, sure, I have a decent anti-virus program, etc, will re-install, etc. Maybe I just feel cranky today.


Why cannot he be more precise?

Got to rush, must re-install my browser.


Mozilla warned Wednesday that a malicious program inserted adware code into a Firefox plugin that has been downloaded thousands of times over the past three months.


Because of a virus infection, the Vietnamese language pack for Firefox 2 was polluted with adware, Mozilla security chief Window Snyder said in a blog posting. "Everyone who downloaded the most recent Vietnamese language pack since February 18, 2008 got an infected copy," she wrote. "Mozilla does virus scans at upload time but the virus scanner did not catch this issue until several months after the upload."

Mozilla is now going to add additional scans of its software to prevent this kind of thing from happening in the future, she said.
The Xorer Trojan

The malware in the language pack is from the Xorer Trojan, according to discussion on Mozilla's Bugzilla developer Web site, which indicates that Mozilla developers first discovered the issue on Tuesday.

"I think it (happened) just because the author's local network was infected with the virus, so it modified HTML files," wrote developer Hai-Nam Nguyen. "The infected code just display(s) annoying banner but it can't propagate."

Mozilla missed the code during its initial scan because antivirus vendors had not yet added detection for Xorer into their products, Snyder said in an interview. Antivirus vendor Panda Security first detected Xorer on Feb. 28, 10 days after the infected plugin was published.Firefox developers have now scanned all of their plugins. The Vietnamese language pack is the only one that had this kind of code, she said.

The open-source browser maker does not know how many people were infected with the adware, but the plugin was downloaded more than 1,200 times in the past week and has been downloaded 16,667 times since November.
Disable Plug-In

On Wednesday afternoon, the Web page for the plugin was off-line as Mozilla scrambled to come up with a new, adware-free version of the language pack. In the meantime, users of the software should disable the plugin, Snyder said.

Xorer added a script to the Vietnamese language pack's HTML files that would have taken Firefox users to adware servers as they were surfing the Internet, Snyder said. Snyder did not know exactly how the adware code was added, but she said that this kind of problem could affect any software provider-- open source or not. "In most software development environments the developers aren't kept in a dark cave," she said. "They browse the Web or take those laptops to a coffee shop ""It's just a fact of life," she added.Other vendors have been hit with similar problems. In late 2006 Apple shipped Video iPods that contained the RavMonE.exe virus. And late last year, retailer Best Buy shipped digital picture frames that contained malware.Although some might say Mozilla's incident underscores the risks of open-source software development, this type of issue could crop up at a company like Microsoft too, said Eric Schultze, chief technology officer at Shavlik Technologies. "Most products that ship today include HTML files in them," he said via instant message. "Any one of them could suffer from this."Mozilla was already doing the right thing scanning their code before upload, Schultze said. "But it shows the need to have tight security on developer systems."

End

2 comments:

Hinesy said...

The publishing industry is in major distress, advertising trends have become extremely unpredictable and all the big IT trade houses like IDG are challenged to maintain revenues while they figure out how to adjust their strategies.

As a result, editors are trying to get as many eyeballs and ad impressions as possible for every story. So, they do tend to leave something like a headline more open ended before pointing out that something may actually be a more specialized problem.

You can say that over-hyping the impact of something like a security threat is shameless pandering for hits, but unless they are truly mis-reporting or exagerrating you just have to accept that the trade media is playing a losing numbers game at present and has to resort to this sort of thing to sustain itself as it figures out the new landscape.

Anonymous said...

Hey I just stumbled across this.

You're right. We do write headlines and ledes in hopes of encouraging people to read the stories.

You say.

The article does not say "if you downloaded the English version you have nothing to worry about"

This is a good point. Sometimes I forget to take a step back and state what it (to me) the obvious. Thanks for pointing that out.


On the other hand, what you wrote here is not accurate.

The following is a story about Mozilla Firefox browser being infected with a trojan in the Vietnamese language version which may or may not be included with the version you (and I ) have downloaded.

If I had said what you wrote, I'd have been rightly flamed for saying that there was a Trojan in Firefox, when there wasn't. There was a Trojan on the plugin developer's computer, which injected this dodgy html code into the plugin.

Feel free to drop me a line anytime... I'm robert_mcmillan@idg.com I appreciate feedback, so long as it's fair. :-)