Attack Surface Reduction Manifesto
All case studies

Where reduction worked

Mozilla

Removed FTP support from Firefox 90

A twenty-year-old cleartext protocol in every major browser was removed outright, and the attacks that needed it stopped working.

Removed: the FTP client built into Firefox. Version 88 disabled it by default in April 2021; version 90 deleted the support in July 2021, following Chrome, Safari and the other major browsers.

Outcome: every attack that depended on the browser fetching files over FTP stopped working, because Firefox does not support FTP anymore.

Mozilla’s account is blunt about why removal beat hardening. FTP “transfers data in cleartext, allowing attackers to steal, spoof and even modify the data transmitted”, and “to date, many malware distribution campaigns launch their attacks by compromising FTP servers and downloading malware on an end user’s device using the FTP protocol”. Nothing could fix that inside the protocol, and the browser’s own protections could not reach it either: “any modern automated upgrading mechanisms such as HSTS or also Firefox’s HTTPS-Only Mode, which automatically upgrade any connection to become secure and encrypted do not apply to FTP”.

So the code went. The awkward part is that the protocol still exists on the internet — Firefox users who need it are pushed to external applications, and web extensions can still register themselves as FTP protocol handlers. Mozilla removed the attack surface it owned and left the rest to the user’s judgement.

Sources: