This is why everyone should consider running their web browser in a subuser: http://subuser.org
Firefox exploit found in the wild
211–220 of 277 posts
Re: Firefox exploit found in the wild
#212Earlier quoted context omitted.
Hi, I run the site https://scriptobservatory.org , which scans the internet and keeps track of what JavaScript people are sent as they browse the internet. Could you drop me an email with a copy of the exploit script (OR a list of a few unique strings found in the exploit script)? With that, I can search the history of what we've been sent to get a list of all webpages that this exploit has been seen on. Email is scr…
Cool, done!
Hi. I work as malware researcher in ESET. Could you please share sample and malicious URL?
email: cherepanov [at] eset [dot] sk
Re: Firefox exploit found in the wild
#213Earlier quoted context omitted.
Hi, I run the site https://scriptobservatory.org , which scans the internet and keeps track of what JavaScript people are sent as they browse the internet. Could you drop me an email with a copy of the exploit script (OR a list of a few unique strings found in the exploit script)? With that, I can search the history of what we've been sent to get a list of all webpages that this exploit has been seen on. Email is scr…
Cool, done!
Got it. Thanks very much!
Re: Firefox exploit found in the wild
#214Earlier quoted context omitted.
I disagree that this is innovation. What innovation and what benefits do I reap by using pdf.js? It's slower and has less features than okular. It's stuck inside a firefox window, so I cannot add a window rule for it (barring adding one for firefox in general). The same holds on windows: why would I use pdf.js when there are faster, lighter pdf readers (e.g. sumatra) or the actual adobe acrobat reader and its eight b…
Everyone is punished for Windows' Adobe Reader. I never got it either. PDF is not a web format. I would not want to read doc files in my browser either. Evince(-light) starts up in milliseconds.
> PDF is not a web format.
Sure it is: http://tools.ietf.org/html/rfc3778 ;)
> I would not want to read doc files in my browser either.
This doesn't make sense to me. Why should the viewer care about the implementation details of a document? If I click on a link to a document, I want to see the result in the browser, and I think that that's the correct default. Only if I'm clicking on something which produces something that isn't intended to be a document (an archive, for example) does opening another program make sense as the default.
Re: Firefox exploit found in the wild
#215How many PDF.js security vulnerabilities have been found so far? A quick Google search found only four: https://www.mozilla.org/en-US/security/advisories/mfsa2013-9... (another local file disclosure) https://www.mozilla.org/en-US/security/advisories/mfsa2015-3... (needs to be "combined with a separate vulnerability" to be exploitable) https://www.mozilla.org/en-US/security/advisories/mfsa2015-6... (needs to be "combi…
>It still is looking better than the plugin it replaced. Exploiting a bug in a memory unsafe language is much harder than writing some JavaScript. It is also much less reliable and platform specific. The real question is why the hell is Firefox not sandboxed?
It can be with Firejail: https://l3net.wordpress.com/projects/firejail/
Re: Firefox exploit found in the wild
#216Earlier quoted context omitted.
Because it is the only browser that is not tied hand-and-foot to some major global commercial player, and because each and every browser ever launched had security issues. Even lynx is not immune: http://www.cvedetails.com/vulnerability-list/vendor_id-5836/...
> Because it is the only browser that is not tied hand-and-foot to some major global commercial player Not close to true. There are hundreds of browsers out there. I used Surf[0] and Xombrero[1] for a number of years. [0] http://surf.suckless.org [1] https://opensource.conformal.com/wiki/xombrero
thank you! first time I hear about xombrero
Re: Firefox exploit found in the wild
#217How many PDF.js security vulnerabilities have been found so far? A quick Google search found only four: https://www.mozilla.org/en-US/security/advisories/mfsa2013-9... (another local file disclosure) https://www.mozilla.org/en-US/security/advisories/mfsa2015-3... (needs to be "combined with a separate vulnerability" to be exploitable) https://www.mozilla.org/en-US/security/advisories/mfsa2015-6... (needs to be "combi…
SumatraPDF is the only reasonable way to view a PDF safely. http://www.sumatrapdfreader.org/free-pdf-reader.html Not perfect but definitely not adobe or foxit and way safer than viewing in any browser.
What makes Sumatra safer than other FOSS PDF viewers like evince, okular, epdf, etc.?
Re: Firefox exploit found in the wild
#218Earlier quoted context omitted.
I disagree that this is innovation. What innovation and what benefits do I reap by using pdf.js? It's slower and has less features than okular. It's stuck inside a firefox window, so I cannot add a window rule for it (barring adding one for firefox in general). The same holds on windows: why would I use pdf.js when there are faster, lighter pdf readers (e.g. sumatra) or the actual adobe acrobat reader and its eight b…
printing from pdf.js in linux is a bit of a headache as well, compared to okular or evince. Usually takes about 10 times as long (no joke) to print a pdf from inside firefox.
That's if it works at all! I've found that pdf.js fails to print entirely when the document is sufficiently large. For example, when printing a scanned white paper from 20+ years ago.
Re: Firefox exploit found in the wild
#219Browsers are supposed to browse that's all. More and more stuff like this will come up with HTML5/JavaScript and people will begin to wonder why the world is jumping through all the JavaScript hoops to build a web app that is essentially a rich client app when they could use tools that are designed for that. Are they more or less secure, neither, once you can touch the user's filesystem the risk is the same which is…
So I shouldn't be upvoting your comment?
It was more a nostalgic sentiment I expressed, your point is valid though on a much smaller scale than a full PDF reader.
Re: Firefox exploit found in the wild
#220time to start running everything in it's own container, i don't like the idea of docker for production, but i like the idea of docker for my desktop, i want to now run every single command in a container, i can run firefox in a linux container, eg. https://bbs.archlinux.org/viewtopic.php?id=196327