Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla patches Firefox zero-day abused in the wild

zdnet.com

Post reply on HN
Print view View original

101–110 of 111 posts

Re: Mozilla patches Firefox zero-day abused in the wild

#101

Post by AdmiralAsshat »

jamesgeck0 wrote: post #100
AdmiralAsshat wrote: post #74

Earlier quoted context omitted.

It's easy to get mad at Fedora when we don't have the latest-greatest at the time the announcement drops. But they hold the packages so that they can do additional QA beyond what Mozilla has already done and protect their users. I'm sometimes disappointed, but after seeing some of the bugs they've caught during the Fedora-specific testing/QA builds, I can understand why they do it.

Delaying zero-day security patches for any length of time doesn't protect users.

I don't like dealing in absolutes. There are valid reasons to hold a security patch for some period of time if the cure is worse than the poison. See, for example, some of the early Spectre/Meltdown mitigations that caused a 20% performance hit.

Re: Mozilla patches Firefox zero-day abused in the wild

#102

Post by kikoreis »

amaccuish wrote: post #2

It's in moments like this where I really dislike running Ubuntu and having to wait for the new build to be released.

Updates have been out for a while now for both snaps and debs; here's the USN: https://lists.ubuntu.com/archives/ubuntu-security-announce/2...

Re: Mozilla patches Firefox zero-day abused in the wild

#103

Post by verroq »

chii wrote: post #82
verroq wrote: post #42

Earlier quoted context omitted.

One of the most obvious attacks is if two different typed objects have similar memory layouts you can use it to read/write fields. Say you had class A and class B and they are confused with each other. Suppose they have the following layout: struct A { int x void *f() } struct B { int x int y int z } Then if you have a class A and you make the program think it's actually class B. You can imagine that if you control a…

> indexing the array you can have unrestricted read/write access to a large section of memory. but won't the memory protection (write xor execute) stop the function pointer from jumping to the array body (since that's write memory)? Meh, i guess in actual practise, it's much more complicated than that...

You can use ROP.

Re: Mozilla patches Firefox zero-day abused in the wild

#104

Post by userbinator »

jamespo wrote: post #69
userbinator wrote: post #66

Earlier quoted context omitted.

This is exactly the problem with the culture that's formed around software and the security industry in general --- people are using the excuse of "security" to force other utterly unwanted and hostile changes, and then act surprised and angry when people don't update. Doubly so when the advice given is basically "bend over and take it" --- especially when Mozilla has made statements like this in the past: https://bl…

Not sure how Mozilla are forcing anything

The tone-deafness of the comments here is astounding. The fact that these posts are rapidly downvoted further reinforces my point.

It's not just Mozilla, it's the whole "update culture": "you must take these important fixes for remotely-exploitable vulnerabilities, and also all of that other stuff" --- of which everyone would probably want the former, but no one really wants the latter.

When the "choice" of browsers that can view the majority of sites, including advanced JavaScript, is basically between Firefox or the various flavours of Chrom(e/ium), there is no real choice!

tl;dr: To say I am annoying with the state of things is an enormous understatement. The browser culture is getting more and more user-hostile and "security" is being used as an excuse to put users under the noose, this encouragement of "learned helplessness" is insane. Fuck this idiotic "it's for your security" bullshit.

Re: Mozilla patches Firefox zero-day abused in the wild

#105

Post by mook »

bzbarsky wrote: post #99
mook wrote: post #91

Earlier quoted context omitted.

Mozilla used to open up the security bugs after the fix is out for a while. I say used to because I notice that the security issues fixed in Firefox 66.0 (released in March according to the release notes) still appear to be private. I suspect the internal people that cared about it have left, and their process is now broken. Somebody might read this thread and poke people to open access, but it would have to be done…

The same people who were in charge of opening up security bugs are still around and still in charge of it. Security bugs are opened up once in-the-wild usage of affected versions is low enough, if I recall correctly. This usually takes a while after the fix is shipped. At no point were bugs opened up immediately after the Firefox release with the fix shipped. It's usually a year or so between the fix being shipped an…

Ah, okay, thanks! My (very unreliable) memory thought it was sooner; that was why I picked 66 (released in March) rather than 67 (May).

The security issues in 60.0.2 (June 6 2018) is now public.

Re: Mozilla patches Firefox zero-day abused in the wild

#106

Post by apostacy »

jamespo wrote: post #69
userbinator wrote: post #66

Earlier quoted context omitted.

This is exactly the problem with the culture that's formed around software and the security industry in general --- people are using the excuse of "security" to force other utterly unwanted and hostile changes, and then act surprised and angry when people don't update. Doubly so when the advice given is basically "bend over and take it" --- especially when Mozilla has made statements like this in the past: https://bl…

Not sure how Mozilla are forcing anything

Mozilla has been very destructive, and I have had to restrain Firefox in a number of different ways. It's Updater.app will disregard your wishes and repeatedly download updates over and over again. This happened to me when I had to turn in an assignment and I was on a 2G connection a few years ago. Most of their updates are unidirectional, even though they don't need to be. And major features are quietly removed, as if it is just normal for your car's speedometer to disappear one morning. This ends up feeling like gas-lighting. At least Chrome's updates are small and hard to notice, but Firefox has all the same disregard for users, except they are very clumsy about it. And the official response from them has been that if their updates destroy your profile folder, that you should have made a backup and it was your fault for assuming that their software wouldn't do a destructive update.

Re: Mozilla patches Firefox zero-day abused in the wild

#107

Post by apostacy »

userbinator wrote: post #104
jamespo wrote: post #69

Earlier quoted context omitted.

Not sure how Mozilla are forcing anything

The tone-deafness of the comments here is astounding. The fact that these posts are rapidly downvoted further reinforces my point. It's not just Mozilla, it's the whole "update culture": "you must take these important fixes for remotely-exploitable vulnerabilities, and also all of that other stuff" --- of which everyone would probably want the former, but no one really wants the latter. When the "choice" of browsers…

I'm sorry you are getting downvoted. You are absolutely correct. I've gotten in many discussions about this exact same thing on HN. I at one point I had an exchange with someone about terrible bad Pale Moon was because it let users do things like override HSTS settings, and otherwise undo decisions that Mozilla had made.[1]

I actually have highly specialized profiles that make heavy use of XUL addons that I have developed over the years for very specific things, and I hate how careful I have to be that an update won't come and delete them. It would be one line of code to make a backup of a profile before "upgrading" it...

[1]: https://news.ycombinator.com/item?id=19527615

Anyway, it's a much bigger problem, and it's cultural as much as technological. And you're not alone and you're not crazy for seeing it.

Re: Mozilla patches Firefox zero-day abused in the wild

#108

Post by kseifried »

saidajigumi wrote: post #92
sterlind wrote: post #37

Earlier quoted context omitted.

Sounds extremely targeted, if an attacker is porting the attack to Macs (presumably a lot of work), and combining it with other loaders... I wonder how long this 0-day was in the wild. Your friend should probably be browsing as a non-admin in a continuously-reimaged VM, separate from an air-gapped machine, if you have those kinds of attackers after you. Spooky..

if an attacker is porting the attack to Macs (presumably a lot of work) It's worth noting that a professional security and pentest company I know of had a Python-based exploit authoring DSL that automatically generated exploit code across a very wide range of processor architectures and OSes. This was about fifteen years ago.

You mean Core Impact? =).

Re: Mozilla patches Firefox zero-day abused in the wild

#109

Post by simosx »

amaccuish wrote: post #88
simosx wrote: post #45

Earlier quoted context omitted.

$ snap info firefox ... channels: stable: 67.0.3-1 2019-06-18 (230) 221MB - It is already available to use.

I've looked at moving to the snap before but last I heard there's no way to import your current profile? And netflix doesn't work? If those two things are fixed I'd happily change over!

By default, a snap package cannot touch your dot directories in your $HOME. That is good for your security.

You would need to copy once (or `rsync`) from `~/.mozilla/firefox/` to `~/snap/firefox/current/.mozilla/firefox/`.

Re: Mozilla patches Firefox zero-day abused in the wild

#110

Post by est31 »

est31 wrote: post #58

Firefox is supposed to have sandboxing, right? Does this sandboxing help against such attacks? As in: is there a second attack on the sandbox needed to get RCE?

Replying to myself: the sandbox escape got fixed in 67.0.4: https://www.mozilla.org/en-US/security/advisories/mfsa2019-1...
Post reply on HN