How to install silently malicious extensions for Firefox
research.zscaler.com
research.zscaler.com
To pull this off you need write access to Firefox's SQLite database.
If you have write access to Firefox's SQLite database you've already 'won', the system is already yours. You can do a lot more damage to the system than whitelisting a Firefox extension.
Sure you could argue that this is another place for malware to hide - but I don't that this is really a security flaw in Firefox.
As a factual presentation, it is worth pointing out to interested people that Firefox's protection is only advisory, and not completely perfect.
Because while having control of a system is 'winning', one still wish to do damage relatively undetected (if one's intent is to use the machine as a zombie, for instance). And doing it through Firefox is a very undetectable way to do so.
Which is why for anything really sensitive I'm booting from a live CD, giving me a system which is "read-only" and not "phoning home" to see if there are updates.
It's a pain. But less of a pain than getting root'ed / admin'ed.
Signed binaries ain't helping either: we've seen several seemingly "legit" software signed with compromised keys.
False sense of security.
This does not increase privileges of the attacker: If the attacker can modify Firefox's profile directory it could also inject something into firefox or read the cookies directly.