And this is why we need working sandboxing on the desktop.
Have you seen subuser.org?
Firefox exploit found in the wild
221–230 of 277 posts
Re: Firefox exploit found in the wild
#222time to start running everything in it's own container, i don't like the idea of docker for production, but i like the idea of docker for my desktop, i want to now run every single command in a container, i can run firefox in a linux container, eg. https://bbs.archlinux.org/viewtopic.php?id=196327
Have you seen subuser.org?
Re: Firefox exploit found in the wild
#223I don't even want my browser to have a 'local file context', is there a way to switch such behavior off entirely until explicit permission is given? All these extra bells and whistles added to browsers to allow websites to pretend they're 'native apps' should require a very large switch to be thrown from 'safe' to 'unsafe' whenever an application requests such a thing. And what a pdf reader has to do with javascript…
Maybe run it inside a chroot jail? Hmm... that sounds like a good idea just on principle... there goes my morning. Of course, X11 is still a problem.
Subuser solves the X11 problem with the secure X11 bridge: http://subuser.org/news/0.3.html
Re: Firefox exploit found in the wild
#224I don't even want my browser to have a 'local file context', is there a way to switch such behavior off entirely until explicit permission is given? All these extra bells and whistles added to browsers to allow websites to pretend they're 'native apps' should require a very large switch to be thrown from 'safe' to 'unsafe' whenever an application requests such a thing. And what a pdf reader has to do with javascript…
Run the browser in a container or in a sandboxed environment (kindof like chroot, but note that chroot itself should not be used for security purposes). There may be docker containers with just firefox, if not it's easy to create one. Or use vmware, though that is much more heavyweight than sandboxing or containers.
That's what I do. I wrote subuser.org and now I run everything in a subuser.
Re: Firefox exploit found in the wild
#225How many PDF.js security vulnerabilities have been found so far? A quick Google search found only four: https://www.mozilla.org/en-US/security/advisories/mfsa2013-9... (another local file disclosure) https://www.mozilla.org/en-US/security/advisories/mfsa2015-3... (needs to be "combined with a separate vulnerability" to be exploitable) https://www.mozilla.org/en-US/security/advisories/mfsa2015-6... (needs to be "combi…
Tech lead of pdf.js here: All of the above exploits were issues with extension code in firefox, i.e. other extensions could have these issues too. If you were to use the web only version of pdf.js none of these exploits would apply.
Re: Firefox exploit found in the wild
#226just more reasons to run ad blocking software
Re: Firefox exploit found in the wild
#227I don't even want my browser to have a 'local file context', is there a way to switch such behavior off entirely until explicit permission is given? All these extra bells and whistles added to browsers to allow websites to pretend they're 'native apps' should require a very large switch to be thrown from 'safe' to 'unsafe' whenever an application requests such a thing. And what a pdf reader has to do with javascript…
Docker containers can sandbox GUI apps[0], but I don't know if it's secure enough. Maybe not. [0]: https://news.ycombinator.com/item?id=8426764
Most tutorials show sharing and X11 server, but that's not a great security solution as X11 is totally insecure. But I am working on this with my project subuser. See http://subuser.org/news/0.3.html
Re: Firefox exploit found in the wild
#228Re: Firefox exploit found in the wild
#229Semi off-topic: What does the security track record of Chrome's integrated PDF viewer (PDFium) look like? Should I make it Click-to-play or is it about as secure as any other part of the browser? Edit: NVD does list a bunch of vulnerabilities with "PDFium" in them [1], and I guess there are a few more from when it wasn't called PDFium yet, but I'm curious as to how an expert would interpret these numbers. [1] https:/…
And even latest here http://googlechromereleases.blogspot.co.il/2015/07/stable-ch... - 5 of them has pdfium
Guess I will click-to-play PDFium, like all other plug-ins. Thanks!
Re: Firefox exploit found in the wild
#230Earlier quoted context omitted.
Cool, done!
Hi. I work as malware researcher in ESET. Could you please share sample and malicious URL? email: cherepanov [at] eset [dot] sk
To people helping others on the internet who claim to be security professionals, remember to make sure that the person is actually trustworthy, so you're not helping criminals. Even though a_cherepanov is a new account with only this comment, I suppose their email domain makes them trustworthy enough: ESET is a Slovakian security company that's had a Wikipedia page for 5+ years.