? malware-like? behavior from Mozilla Firefox.

Mozilla started downloading an 'upgrade' to me a couple of days ago
without asking for permission, on this machine which runs Win98SE.
Isn't that virus-like behavior? Is Firefox software a security risk
on my machine? I don't like the idea that my browser can start an
executable and download a file. It seems like a flaw that others
could exploit to get access to my machine. I started using Firefox
a while back to get rid of IE, but even M$ IE hasn't started a
'critical update' without my permission (AFAIK). Thanks, dave
BTW: this machine runs Symantec AV and e-trust Pest Patrol in the
background at all times. PS: I am not a high-tech IT guy, just a
sincere amateur.

dave

dave wrote:

> Mozilla started downloading an 'upgrade' to me a couple of days ago
> without asking for permission, on this machine which runs Win98SE.
> Isn't that virus-like behavior? Is Firefox software a security risk
> on my machine? I don't like the idea that my browser can start an
> executable and download a file. It seems like a flaw that others
> could exploit to get access to my machine. I started using Firefox
> a while back to get rid of IE, but even M$ IE hasn't started a
> 'critical update' without my permission (AFAIK). Thanks, dave
> BTW: this machine runs Symantec AV and e-trust Pest Patrol in the
> background at all times. PS: I am not a high-tech IT guy, just a
> sincere amateur.


....this is configurable. You have it set to auto upgrade...turn it off. As
far a security you are still better of *not* using IE at all for
anything...


Imhotep

imhotep

On 7 Jun 2006 19:12:04 -0700, dave wrote:
> Mozilla started downloading an 'upgrade' to me a couple of days ago
> without asking for permission, on this machine which runs Win98SE.
> Isn't that virus-like behavior?

Well, your fingers do not seem broke, if you did not like it, why have
you not modified the preferences to not do things you do not want it
doing.


> Is Firefox software a security risk
> on my machine?

It is safer than IE.

> I don't like the idea that my browser can start an
> executable and download a file. It seems like a flaw that others
> could exploit to get access to my machine. I started using Firefox
> a while back to get rid of IE, but even M$ IE hasn't started a
> 'critical update' without my permission (AFAIK). Thanks, dave
> BTW: this machine runs Symantec AV and e-trust Pest Patrol in the
> background at all times. PS: I am not a high-tech IT guy, just a
> sincere amateur.

I thought Micro$oft has quit supporting updates for Win98SE.

Think about AV software,
Crackers create malware and start spreading it around.

AV vendor has to
o catch the malware,
o update database,
o test it,
o update database server,
o you have to download it sometime later.

You are unprotected the whole time.

I did not see pest control in the list for the current malware running loose.

http://isc.sans.org/diary.php?date=2...d510786029c988

My solution, Running Mandriva Linux Power Pack Edition. My system can
be dual booted for XP_home or linux.

If you have about 6 gig of free space you can do the same thing.

Bit Twister

dave wrote:
> Mozilla started downloading an 'upgrade' to me a couple of days ago
> without asking for permission,

Hm... where exactly is your problem? This behaviour is fully intended to
keep your installation up-to-date, and can be disabled.

> Isn't that virus-like behavior?

http://en.wikipedia.org/wiki/Computer_virus

Dunno how you came on that.

> Is Firefox software a security risk on my machine?

No, why?

> I don't like the idea that my browser can start an
> executable and download a file. It seems like a flaw that others
> could exploit to get access to my machine.

Wrong. The update address is strictly configured and the update is
verified via digital signatures. There's no chance that anything but
authorized Firefox updates can be installed that way.

> I started using Firefox
> a while back to get rid of IE, but even M$ IE hasn't started a
> 'critical update' without my permission (AFAIK).

Windows Automatic Update Service? The very same thing is true.

> BTW: this machine runs Symantec AV and e-trust Pest Patrol in the
> background at all times.

Now this is why you should actually worry.

Sebastian Gottschalk