PluginUpdating
Problem Statement
Our users often get hacked via vulnerable third party plug-ins.
Proposal
Add scripts on common landing pages to check for vulnerable plug-ins and assist the user in updating them.
Components
- Script and alert on landing pages
- Page that checks all the common plug-ins and assists in the update
Landing pages
First Run
Add an alert that checks the first time a user opens Firefox:
Message: We detected that some of your media plug-ins are vulnerable, click here for more info.
This is non-invasive, as we do not want to have the user have trouble getting started with Firefox.
This will lead the user to the plug-in check page.
comment [morgamic] -- please eliminate the "click here". A "more info" that is a hyperlink should be sufficient. "click here" is bad wording for a hyperlink because it's non-descriptive. When I was messing with it, "Update your plug-ins." seemed even better -- but just pick something besides "click here". :)
comment clouserw -- "vulnerable" is a pretty strong word. Are we actually detecting that they are using versions that are vulnerable, or just that they are using outdated versions?
comment polvi -- The goal is to detect vulnerable plug-ins, not outdated ones (although, they often go hand in hand). Regarding "click here", I agree, but we are trying to structure the language such that it avoids demanding something of the user.
Updated
Add similar alert to the "you've been updated" page which leads to the plug-in check page.
Implementation
It will be easiest to check the basic functionality in Javascript. Bug 282258 has a script that should work for flash and java.
UpYourPlug page
This page will do a check on common plug-ins and see if they are vulnerable or not. An example implementation can be found here.
Plug-ins to check:
Future plug-ins to check:
- Windows media player (system update)
- Real player (system update)
- Quicktime (system update)
Mock-up
Here is a cheesy mock-up of the idea for the plug-in update check page.
Implementation
The actual checks need to be implemented in javascript. The following use cases should be handled accordingly:
- Plugin installed and up to date: An green "OK" box displayed linked to vendor
- Plugin installed and out of date: A red "need update" box displayed linked to vendor
- Plugin not installed: A gray "not installed" box displayed.
Java on the Mac
Since only the java embedding plugin gives version information to javascript, we cannot check for this case without a java applet. In this case, display a gray "check with vendor" box that links to Sun's java plugin page.
Non-Firefox Browsers
If a non Firefox browser hits this page, we need to display a notice: "This page is only supported when using Firefox". Then all the checks should be a gray "check with vendor" box that link accordingly.
Determining the latest secure version
Ideally we would talk to the upstream provider and get the latest secure version. However, initially we can just maintain a file that includes the latest versions of the plug-ins.
We found an insecure plug-in, now what?
After we detect that a plug-in is out of date, we should open the vendor page in a new tab.
One major concern is that each plug-in update needs a browser restart.
Java
Sun provides an update check. Linking here should provide a sufficient starting point for getting java up to date.
Flash
Adobe provides an update check. The user will be offered to navigate to this page for the update.
Schedule
A rough timeline...
- First run revamp launch ~ August 24th
- Finish UpYourPlug page ~ August 24th
- Launch page and add detection to first run page - August 31th
- Add detection to updated page - September 7th
QA Matrix
All platforms for Firefox < 2.0.0.7
| Flash version | Quicktime | Java | firstrun notice | Flash | Quicktime | Java | |
|---|---|---|---|---|---|---|---|
| >= 9.0r47 (win,mac) | >= 7.2.0 | >= 1.5.0_07 | no | green | green | green | |
| >= 9.0r48 (lin) | >= 7.2.0 | >= 1.5.0_07 | no | green | green | green | |
| < 9.0r47 (win,mac) | >= 7.2.0 | >= 1.5.0_07 | yes | red | green | green | |
| < 9.0r48 (lin) | >= 7.2.0 | >= 1.5.0_07 | yes | red | green | green | |
| >= 9.0r47 | < 7.2.0 | < 1.5.0_07 (all) | yes | green | red | green | |
| >= 9.0r47 | >= 7.2.0 | < 1.5.0_07 (all) | yes | green | green | red |
References
Postmortem
- be more specific about copy and mock-up layout
- note when the alerts should display
- s/sans/without/