I've recently red about firefox addons which makes the system vulnerable to security threats. And I also red that some antivirus software couldn't see it as a threat. Do you know of any workaround in order to avoid this. Or is there any application that can actually scan for a firefox addon to know if its acting maliciously or not.
I see 2 ways malicious add-ons could be detected:
- antivirus compagnies modify their software so they scan inside the XPI files and use signatures to identify rogue add-ons
- Mozilla implements a "black-list" system for extensions, updated frequently and telling the users the extension has been disabled for security reasons.
Number 2 is actually in place, they used it to disable some extensions, including a Microsoft .Net extension that was later re-enabled.
I think it's now on Mozilla's side to prevent bad add-ons to cause issues to the users, and bad reputation to Firefox.
Heuristic antivirus scans would probably not work, as they would search for code that modify the browser features ... and this is exactly what add-ons are made for!
You're comparing two pairs of shoes here: Malicious is not vulnerable. Yes, it can happen that poorly written AddOns are vulnerable...but normally they do not survive that long in the wild (due to their OpenSource character) to really abuse them. Also it might be that there are malicious AddOns out there...but they're for sure not on addons.mozilla.org. Every AddOn you install from that site is tested, reviewed and safe.
But I say it again and I have to shout it out loud, sorry: All AddOns from the official Mozilla-Site are safe!