Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox exploit found in the wild

blog.mozilla.org

Post reply on HN
Print view View original

271–277 of 277 posts

Re: Firefox exploit found in the wild

#271

Post by tripzilch »

jacquesm wrote: post #175
_wmd wrote: post #63

Earlier quoted context omitted.

You haven't the slightest understanding of software security, PDF.js was written to replace a component authored in a memory-unsafe language for which exploits were being found at a rate measured in tens per year. Since introduction PDF.js has only had 2 holes that were directly exploitable, neither leading to remote code execution which was the default behaviour for pretty much any bug found in Acrobat. If you don't…

> If you don't want a browser that has some notion of "local file context" you should just sell your laptop and go live in a cave. Thank you for your constructive advice. And I note that so far my stuff written in 'memory unsafe languages' has been in production since '99 or so without a compromise to date over 100's of billions of requests. Maybe it's not just the language. And what business does a browser have with…

You know, they would try to render Word documents and Excel sheets if they could, if the formats weren't quite as Lovecraftian as they are, to display properly.

I bet they'd even try to render .PSD files.

So maybe PDF just hits the bad spot of being just not too arcane to implement, yet still being crazy enough to be a gigantic attack surface.

Re: Firefox exploit found in the wild

#272

Post by tripzilch »

mat2 wrote: post #250
lorenzhs wrote: post #122

Earlier quoted context omitted.

Not executing any JS is safer, sure, but that's beside the point. If you strive for absolute security, power off your computer and never touch it again. This is about what you can do to improve the situation without impairing usability. An adblocker doesn't impact usability (in most cases, it improves it significantly, through lower page load times and less space occupied by non-content), but prevents the vast majori…

Unfortunately, an adblocker impacts income of site owners. Otherwise, I would have used these programs since a long time, but now my conscience does not allow it.

Well, they can ask my conscience to not run an adblocker because otherwise it impacts their income. If it was just that.

But they cannot ask my conscience to open myself up to security issues because otherwise it impacts their income.

(note that I have read the rest of the thread and am aware that simply running an adblocker wouldn't have prevented this exploit)

(second note/disclaimer is that I do run µBlock, for the personal reason that I feel they also cannot ask my conscience to open my attention to energy-draining distractions because otherwise it impacts their income)

Re: Firefox exploit found in the wild

#273

Post by fukusa »

fukusa wrote: post #137
hokkos wrote: post #111

Earlier quoted context omitted.

How did you detected it ?

The script triggered a file dialog showing it was trying to access a local file. I opened the Developer Tools and saw all kinds of other files being accessed, including my private and public keys. I nearly got a heart attack. I quickly revoked all SSH keys and started monitoring the requests to narrow it down before I submitted the bug ticket with all the information I had, including the exploit script that was execu…

Update: I played around with the exploit some more to find out what exactly triggered the file dialog. Turns out my OS (Ubuntu 15.04) actually saved me.

When you try to open a file with Firefox it will first try to map the file to a mimetype using the ExternalHelperAppService (https://developer.mozilla.org/en-US/docs/How_Mozilla_determi...). In case a mimetype is found, a file dialog is shown so you can open the file with the right application, in case it is not, the contents of the file will be displayed in the browser. In this case my OS provided the ExternalHelperAppService with a mimetype for one of my public keys with the .pub file extension: application/vnd.ms-publisher. Of course that's not the correct mimetype for the public key file, but that's basically what saved me by showing a file dialog because it found a mimetype. All other files had no file extension so no mimetype was found.

I also discovered that my private keys were all encrypted with a passphrase so even though they have been compromised it was not as bad as I initially believed.

Re: Firefox exploit found in the wild

#274

Post by lorenzhs »

tripzilch wrote: post #272
mat2 wrote: post #250

Earlier quoted context omitted.

Unfortunately, an adblocker impacts income of site owners. Otherwise, I would have used these programs since a long time, but now my conscience does not allow it.

Well, they can ask my conscience to not run an adblocker because otherwise it impacts their income. If it was just that. But they cannot ask my conscience to open myself up to security issues because otherwise it impacts their income. (note that I have read the rest of the thread and am aware that simply running an adblocker wouldn't have prevented this exploit) (second note/disclaimer is that I do run µBlock, for th…

Note that uBlock can be configured to block third party frames, which would have prevented the exploit

Re: Firefox exploit found in the wild

#276

Post by rockdoe »

sp332 wrote: post #248
rockdoe wrote: post #240

Earlier quoted context omitted.

It is? Same FAQ page you listed: "When you download an application file, Firefox will verify the signature. If it is signed, Firefox then compares the signature with a list of known safe publishers. For files that are not identified by the lists as “safe” (allowed) or as “malware” (blocked), Firefox asks Google’s Safe Browsing service if the software is safe by sending it some of the download’s metadata."

I don't suppose I could just disable that part, without disabling the part I quoted above?

You can in about:config, just Google for it.

Re: Firefox exploit found in the wild

#277

Post by ak4g »

mappu wrote: post #266
_wmd wrote: post #61

Earlier quoted context omitted.

For comparison, NIST NVD lists 445 CVEs for Acrobat, or at least 17 per year since introduction. However CVEs haven't been maintained since the early 90s, so that number should be much higher. I think pdf.js does just fine.

>CVEs haven't been maintained since the early 90s Can you clarify what you mean by this?

The wording was confusing for me too. At first reading I understood it as saying CVEs were no longer being issued for Acrobat, which definitely isn't the case. I assume the intended meaning was that Acrobat was first released in 1993[0], but the first CVE was CVE-1999-0001 (source: downloaded the raw dump from [1], ran grep -m1 CVE-....-0001).

But, I'm doubtful there would have been all that many CVEs issued for Acrobat from 1993-1998. There was only one CVE that mentioned "Acrobat" each year from 1999-2001, and three in 2002. The more recent years are the fun ones - but I have no idea whether that's a result of freshly-introduced exploitable bugs or just increased attention.

[0]: https://en.wikipedia.org/wiki/Adobe_Acrobat_version_history

[1]: https://cve.mitre.org/data/downloads/index.html

Post reply on HN