NPAPI plugins such as Adobe Flash and the Oracle Java applet plugin have well-deserved reputations for endless security advisories. The design of NPAPI, in which arbitrary, unsandboxed, unsigned code is loaded directly into the browser’s address space and exposed directly to untrusted inputs from all Internet sites, would never be repeated in today’s threat environment.
A cynical view could include these reasons, in addition to security, for deprecating NPAPI. NPAPI plugins were great for niche market products with, perhaps, a few thousand users who needed to quickly develop browser-neutral software to break out of what is available in HTML and JavaScript. There is no opportunity for web browser vendors to “monetize” the plugin or restrict distribution to an app store in any way, nor any opportunity for the web community to create a controversy over what does or does not belong in web technology only the end user has any say in the matter. There is no need to get anyone’s permission and no central authority for distributing the plugin.
The good side of the NPAPI is that it allows third parties to extend web browsers in almost-arbitrary ways. Indeed, such basic modern browser features as reading PDF files through the browser and playing sound and video replace old implementations provided using plugins.
The Netscape Plugin Application Programming Interface (NPAPI) is a relic of a simpler time on the Internet where programmers focused on just making it work - now - and not on security concerns. If you are interested in brushing up on some x86–64 assembly, basic reverse engineering and hex editing, take a look at this blog. I use only basic GNU binutils tools to focus on the “bits and bytes” and not on how to use a particular tool. By focusing on removing a restriction added to Mozilla Firefox between version 52 ESR and 60 ESR, I show from the ground up how to edit a binary to bypass a plugin check, with mixed results. Did you know it is possible to change the behavior of a compiled program by editing the machine code directly rather than recompiling it from source? Though well-known by hackers, firmware engineers, and other low-level types, this can be intriguing to those whose main focus is in other areas of computer science. Binary Patching: Attempting to Restore NPAPI Support to Firefox 60 ESRĪbstract.
0 kommentar(er)
