RSnake mentioned a few times already that he would like to see Adblock Plus extension turned into a firewall. I thought about how this can be done. It would be an extension for Adblock Plus (lets call it ABP Firewall here) with a static list of rules. Every time a request matches one of the rules ABP Firewall should deny it and show an icon in the status bar. The user can then click the icon and see in the log what happened. It should be possible to disable a rule globally or for one site only.
Instead of updating the list of rules ABP Firewall should force Firefox to check for extension updates more often so that an update to ABP Firewall (and with it to the rules) could be pushed to the users within a day or two - if it is necessary to stop some new attack. It is necessary to update the extension rather than the list because there is no guarantee that the rules language will be flexible enough - the extension code might need to be changed.
The difficult question is: what can be the rules for such an extension? Adblock Plus doesn't work on the HTML level so the response from the server cannot be filtered. But Adblock Plus is triggered for every request the browser makes to some server (actually, not necessarily a server - it works for all protocols including file:, about: and chrome:). It gets some data like the page where the request originated or HTML tag the request is attached to. So what can you with it?
1. Disallow some characters in URLs, e.g. %00 (null byte attacks), %0A|%0D (HTTP Response Splitting), %3C|%3E (XSS). The last one should already cause quite a lot of false positives however, adding %22 and %27 will do more harm than good (search engines always use method GET and people enter quotes there all the time).
2. Disallow unknown plugins by allowing only objects with types application/x-shockwave-flash, application/x-java-applet and probably a few others. Will stop things like
Yahoo Application State Plugin.
3. Disallow requests to subnets 192.168/16 and 10/8 subnets (rfc 1918) that don't originate from these subnets - port scanning. Problem is that intranets don't always use private address spaces, also DNS name resolution is a problem. If I can solve the DNS resolution problem, anti-DNS pinning problem should be solvable as well (don't allow access if source and target have different IP addresses even though the host names are identical).
4. Known worms can be blocked by URL - that's a case where an update would be pushed.
5. Disallow any requests to imaqeshack.us from myspace.com :)
What else can you think of? The problem is that the checking is done before the actual request is made so neither request headers nor POST data are available (I even think you cannot distinguish POST and GET requests). Also, XMLHttpRequest doesn't go through Adblock Plus at the moment (my patch to fix this awaits review).
