Accessing physical memory

Discussion in 'ProcessGuard' started by DanL, Feb 15, 2005.

Thread Status:
Not open for further replies.
  1. DanL

    DanL Registered Member

    Joined:
    Nov 25, 2004
    Posts:
    159
    I'm a new user of process guard and have noticed Firefox occasionally tries to access memory.
    This usually happens if I click the local radar in motion from the national weather service.

    I have denied it so far and I think it might have caused the Dr. Watson debugger crash once.

    Is this normal? Is it OK to allow Firefox access to memory temporary or always?

    Thanks

    Dan
     
  2. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    Hi DanL, I only have the defaults set but you may want to let it have access to memory if it is causing you a problem.

    Other users will probably offer their settings which will help you to decide :)

    HTH Pilli
     
  3. DanL

    DanL Registered Member

    Joined:
    Nov 25, 2004
    Posts:
    159
    Thanks for the reply.

    I only experienced the crash once, but it did happen after denying FF access to memory.
    I trust Firefox but wasn't sure why it needed access to memory.

    Dan
     
  4. sukarof

    sukarof Registered Member

    Joined:
    Jun 22, 2004
    Posts:
    1,714
    Location:
    Stockholm Sweden
    I get that too now and then . It´s just some occational websites that forces ff to read the memory, dont know why tho... The site runs as it should even tho I deny FF to access the memory. . I belive it crasched my FF too once or twice, but the websites werent that important anyway :) I cant see why I should allow FF to access the memory. I feel safer that way :)
     
  5. earth1

    earth1 Registered Member

    Joined:
    Oct 17, 2004
    Posts:
    177
    Location:
    Kansas, USA
    Hi Dan,

    I don't know much about the language (XUL?) for writing Mozilla/Firefox plugins, but it may be capable of something that requires physical memory access. I've never had a physMem alert from Firefox, but I do not use that plugin.

    It may be possible to create a malicious plugin based on that or other capabilities. Even if you trust Firefox, it may not be safe to trust its plugins. For that reason, I would also be reluctant to give Firefox any special privileges. At the very least, download plugins only from a trusted source.
     
  6. DanL

    DanL Registered Member

    Joined:
    Nov 25, 2004
    Posts:
    159
    So far I have always denied permission and will continue.
    I didn't think it was a plugin issue, which plugin are you referring to?

    Dan
     
  7. earth1

    earth1 Registered Member

    Joined:
    Oct 17, 2004
    Posts:
    177
    Location:
    Kansas, USA
    Sorry, I should have quoted from both posts. I was guessing that the alert might be related to the code for the weather service plugin, but only because I haven't seen Firefox trigger a physMem alert in five months of using it with PG. It may, however, not be plugin related at all.

    There has been some discussion here lately, for instance, this thread. Searching Wilders with the terms firefox and plugin will likely turn up others.

    EDIT: Perhaps you aren't even using their plugin (oops?).
     
    Last edited: Feb 16, 2005
  8. gottadoit

    gottadoit Security Expert

    Joined:
    Jul 12, 2004
    Posts:
    601
    Location:
    Australia
    Guys,
    How about including the urls to the pages that throw the alerts, if anyone is keen enough to check that would be the information needed to start
     
  9. DanL

    DanL Registered Member

    Joined:
    Nov 25, 2004
    Posts:
    159
  10. earth1

    earth1 Registered Member

    Joined:
    Oct 17, 2004
    Posts:
    177
    Location:
    Kansas, USA
    When I visited the URL it does tell me that I need to install a plugin. Still doesn't mean that the plugin is connected, but I'm guessing it might be.
     
  11. sukarof

    sukarof Registered Member

    Joined:
    Jun 22, 2004
    Posts:
    1,714
    Location:
    Stockholm Sweden
    Yup, got the warning and block from Processguard, but the site works fine even tho It denies FF to access the memory.
    I didn´t get any warning about any plugin. Is that a Firefox plugin?

    The attachment shows the plugins I have with Firefox.
     

    Attached Files:

  12. earth1

    earth1 Registered Member

    Joined:
    Oct 17, 2004
    Posts:
    177
    Location:
    Kansas, USA
    What I got was Firefox's typical "Install Missing Plugin" bar with the majority of the page an empty rectangle sporting the green, "Click here to download plugin" puzzle piece. I clicked to see what was offered and got the "Plugin Finder Service" window telling me no suitable plugins were found. I don't have a clue what it was looking for. Looking at your list of plugins, I don't have QuickTime Movie or Windows Media A/V, so either could be possibilities.

    EDIT: I don't have any of the plugins on your list, I just thought those two sounded apropos.
     
  13. DanL

    DanL Registered Member

    Joined:
    Nov 25, 2004
    Posts:
    159
    The site works fine for me even though I do not allow access to memory.
    I've never needed a plugin for that site, used it for many years with several different computers.

    Dan
     
  14. DanL

    DanL Registered Member

    Joined:
    Nov 25, 2004
    Posts:
    159
    Here's my list of plugins. I did not install these so they either came with FF or
    automatically imported from IE.
    The exception being shockwave for my comcast homepage, but that's not
    necessary for the weather service.

    Dan
     

    Attached Files:

  15. earth1

    earth1 Registered Member

    Joined:
    Oct 17, 2004
    Posts:
    177
    Location:
    Kansas, USA
    Hi Dan,

    Sorry for the confusion earlier, I forgot that I'd booted a partition that still runs Firefox version 1.0PR. So I went back to radar site again today, and Firefox was able to tell me that it wanted to install the Java Runtime Environment. I'm not sure if java can access physical memory, but maybe so.

    Also, the only plugin that my Firefox 1.0 lists is Adobe Acrobat for PDF which I suspect is the same plugin that IE would use to render PDF. It may be that the rest of yours are really IE plugins too.
     
Thread Status:
Not open for further replies.