Firefox exploit found in the wild • Hacker News Board

Re: Firefox exploit found in the wild

#251

Post by slrz » Fri, Aug 07, 2015, 7:19 PM UTC

mike_hearn wrote: post #139

_wmd wrote: post #61

Earlier quoted context omitted.

For comparison, NIST NVD lists 445 CVEs for Acrobat, or at least 17 per year since introduction. However CVEs haven't been maintained since the early 90s, so that number should be much higher. I think pdf.js does just fine.

pdf.js does a lot less, of course. Really you should compare Firefox to Acrobat, as they are both rich media rendering apps with a lot of functionality.

One of the points of something like pdf.js is that in most cases you don't need all that extra fluff. You just want to look at some PDF. So doing less is exactly what allows pdf.js to be (more) secure.

Re: Firefox exploit found in the wild

#252

Post by EpicDavi » Fri, Aug 07, 2015, 7:24 PM UTC

drvortex wrote: post #243

zobzu wrote: post #174

Earlier quoted context omitted.

Dat hate

Umm, no. See Firefox gives no one any reason to hate it based on idealogy. It's a pro-consumer, pro-internet user, privacy-respecting, standards-compliant browser. What is not to love in this ideology? All the same, as of 2015, it is a poor implementation of a browser from the technical point of view. Not because it was designed badly, but because it has simply not kept up.

> Not because it was designed badly, but because it has simply not kept up.

How has it not kept up?

Re: Firefox exploit found in the wild

#253

Post by bm98 » Fri, Aug 07, 2015, 7:26 PM UTC

rplnt wrote: post #48

wereHamster wrote: post #21

Earlier quoted context omitted.

Run the browser in a container or in a sandboxed environment (kindof like chroot, but note that chroot itself should not be used for security purposes). There may be docker containers with just firefox, if not it's easy to create one. Or use vmware, though that is much more heavyweight than sandboxing or containers.

Wouldn't selinux be enough? Browsers have no business touching files outside of ~/.mozilla or whatever.

I've run Firefox in a Red Hat/Fedora SELinux sandbox [1] [2] for the past 5 years or so. It is a little more tedious for things such as file uploads/downloads and cut-and-paste -- but worth it, IMHO.

[1] http://danwalsh.livejournal.com/31146.html

[2] http://www.bress.net/blog/archives/195-Firefox-in-a-sandbox-...

Re: Firefox exploit found in the wild

#254

Post by fukusa » Fri, Aug 07, 2015, 7:32 PM UTC

ergothus wrote: post #231

All the comments thus far have focused on the un/reasonableness of the vulnerability, plus some potshots at FF. I've not seen any discussion about how this exploit is targeting dev keys. I find that as a data point that we've turned the corner: The coder in this case decided to grab auth keys/passwords (with a presumably low rate of success). As logical as it may be (without RCE, not much more they could have done wi…

As far as I understand with this exploit it was only possible to read files, not write to them or compromise the targets in some other way. With that in mind, it makes sense to target keys. Because the keys are an indirect way to compromise new targets.

Re: Firefox exploit found in the wild

#255

Post by orting » Fri, Aug 07, 2015, 7:40 PM UTC

drvortex wrote: post #243

zobzu wrote: post #174

Earlier quoted context omitted.

Dat hate

Umm, no. See Firefox gives no one any reason to hate it based on idealogy. It's a pro-consumer, pro-internet user, privacy-respecting, standards-compliant browser. What is not to love in this ideology? All the same, as of 2015, it is a poor implementation of a browser from the technical point of view. Not because it was designed badly, but because it has simply not kept up.

I am curious. Could you highlight some of the technical problems with Firefox?

Re: Firefox exploit found in the wild

#256

Post by Nexxxeh » Fri, Aug 07, 2015, 8:16 PM UTC

ctb_mg wrote: post #182

These browser vulnerabilities have got me thinking that I should start browsing in a VM. Has anyone moved to this level of isolation? Steve Gibson on the last Security Now podcast said he's been experimenting with Sandboxie... Sandboxie looks like a paid closed source solution, I'm not sure they give me a compelling value proposition over something like a light linux distro under VirtualBox.

I was for a while, using a W7 VM on VirtualBox. I hooked it up to the VPN interface so that if the VPN dropped, I wasn't leaking traffic and it couldn't access the local network or host machine without significant difficulty.

It was initially for minimising the risk of false positives while testing remote access from the network I was on at the time.

Probably not enough to be hacking NSA, but it quickly added layer of protection from leaking stuff.

Re: Firefox exploit found in the wild

#257

Post by zobzu » Fri, Aug 07, 2015, 8:36 PM UTC

orting wrote: post #255

drvortex wrote: post #243

Earlier quoted context omitted.

Umm, no. See Firefox gives no one any reason to hate it based on idealogy. It's a pro-consumer, pro-internet user, privacy-respecting, standards-compliant browser. What is not to love in this ideology? All the same, as of 2015, it is a poor implementation of a browser from the technical point of view. Not because it was designed badly, but because it has simply not kept up.

I am curious. Could you highlight some of the technical problems with Firefox?

Ha, the hn fud. Not like if theres going any real answer to this

Re: Firefox exploit found in the wild

#258

Post by kuschku » Fri, Aug 07, 2015, 8:42 PM UTC

martius wrote: post #184

fluidcruft wrote: post #97

Earlier quoted context omitted.

Maybe run it inside a chroot jail? Hmm... that sounds like a good idea just on principle... there goes my morning. Of course, X11 is still a problem.

sudo unshare -m bash -c "mount --make-rslave /home ; mount -n --make-rprivate -o bind /tmp/empty /home ; sudo -u $(whoami) firefox -ProfileManager -no-remote" - creates an empty directory, - fork the mount table for the new bash process and its children (requires privileges), - unshare /home (required if / is mounted in shared mode [1]), - hide /home by mount-binding the empty directory, - start firefox in unprivileg…

Still doesn’t fix X11 access

Re: Firefox exploit found in the wild

#259

Post by shimshim » Fri, Aug 07, 2015, 9:12 PM UTC

_wmd wrote: post #210

_joev wrote: post #157

Earlier quoted context omitted.

That's not true. There have been PDF.js exploits that lead straight to RCE. This has the additional downside of leading to immediate compromise on every platform. Example (used by Mariusz Mlynski to win Pwn2Own this year): https://www.mozilla.org/en-US/security/advisories/mfsa2015-3...

Thanks for the link, and bummer, too late to edit my comment.. now I'll be wrong on the Internet for perpetuity :)

join the club

Re: Firefox exploit found in the wild

#260

Post by Kadilov » Fri, Aug 07, 2015, 9:20 PM UTC

fukusa wrote: post #228

a_cherepanov wrote: post #212

Earlier quoted context omitted.

Hi. I work as malware researcher in ESET. Could you please share sample and malicious URL? email: cherepanov [at] eset [dot] sk

Done.

Hi fukusa, I know a Russian website (not a news site, it is webdev oriented) that triggers some PDF error in Firefox 35 and does not do that with latest Firefox 39.0.3. I sent a bug report to owners 6 days ago (just because PDF errors on a webpage are strange) and they have not fixed it yet. Could you check this website? I can send you an URL the way you prefer.