Gallery

Microsoft must stop silently installing browser plugins

Posted on 9 Feb 2010 at 14:50

Davey Winder takes Microsoft to task for installing unwanted plugins on people's browsers

I’m not happy with Microsoft's security when it comes to browser plugins – in particular, when it comes to silently installing Microsoft plugins into non-Microsoft web browsers.

The Microsoft .NET Framework Assistant and Windows Presentation Foundation plugins were installed – without receiving informed consent from the users beforehand – into the Mozilla Firefox browser when Microsoft published a .NET patch back in May 2009. Those users who discovered these additions found they couldn’t easily remove them without hacking the Windows Registry, which isn’t good at all.

Microsoft did then bring out a removal tool for the Framework Assistant plugin, but stable doors and bolting horses come to mind.

Many people had no idea these plugins were even there until October, when Firefox threw up a warning about add-ons that might be causing a problem following the biggest Microsoft Patch Tuesday ever. I received such a warning on a machine here, informing me that the Microsoft .NET Framework Assistant 1.1 may be unstable or insecure, which surprised me because I’d never installed any add-ons for Firefox, ever.

I’m not so much concerned over the “is it or isn’t it” of a vulnerability as I am by Microsoft’s considering it okay to silently install the stuff in the first place

Mike Shaver, Mozilla’s Vice President of Engineering, explained that it had appeared there was a serious security vulnerability that could use the Framework Assistant as a vector for attack, and so it had been added to the Firefox plugin blocklist mechanism.

Within the week it turned out that this wasn’t the case and the plugin was removed from the blocklist, and Shaver confirmed that Mozilla was also working on a mechanism to re-enable the WPF plugin, ahead of its removal from the blocklist.

The thing is, I’m not so much concerned over the “is it or isn’t it” of a vulnerability as I am by Microsoft’s considering it okay to silently install the stuff in the first place. Microsoft might claim that the terms and conditions of the update stated, somewhere among the legalese, that it would do this and that I had therefore given my consent, but that sounds awfully like the kind of thing a dodgy spyware outfit would say when you discover it had managed to sneak unwanted software onto your computer.

I want clarity and consent to be right out in the open when it comes to the stuff that’s installed on my machine, and I expect better from Microsoft. A lot better.

Download a year of Davey Winder's Online Security columns by heading to our Free Downloads site