Firefox users flip out over sneak MS add-on
Silent, but deadly annoying
Firefox fans are up in arms after a recent Microsoft software update silently installed a Firefox extension that is difficult to remove.
Users agreeing to install a service pack for the .NET Framework (NET Framework 3.5 Service Pack 1) through Windows update were also pushed a Firefox add-on that is potentially difficult to remove once applied. This add-on - Microsoft .NET Framework Assistant - enables .NET apps to be installed with one click.
Annoyances.org, a Windows gripes site, reports that the update slaps IE-style behaviour on Firefox users, specifically the "ability for Web sites to easily and quietly install software on your PC".
Many Mozilla users might take umbrage to that in principle, even though there's no evidence of attacks in practice; but simply uninstalling early versions of the unwanted extra via Firefox's handy Add-ons interface is not possible because the uninstall button is disabled. This is because the update installs itself for all users of a machine, while the Firefox GUI only manages add-ons for a single profile at a time.
Users have to open up the bonnet of their PC and change settings in RegEdit to remove the potentially unwanted add-on.
Microsoft updated the extension so that it worked on a per-user basis through an update to the Microsoft .NET Framework Assistant issued last month. This software tweak makes the add-on easier to remove.
The original update came out in February, but the behaviour passed the media by before it was picked up in stories by the Washington Post (here), Slashdot and elsewhere over the weekend.
That such tomfoolery could have lain largely unnoticed for so long raises question about whether other Microsoft updates of the past might also have fiddled around with Firefox settings. ®
- Black Hat
- Common Vulnerability Scoring System
- Cybersecurity and Infrastructure Security Agency
- Cybersecurity Information Sharing Act
- Data Breach
- Data Protection
- Data Theft
- Digital certificate
- Identity Theft
- Kenna Security
- Palo Alto Networks
- Privacy Sandbox
- Trusted Platform Module
- Zero trust