171–180 of 277 posts
Earlier quoted context omitted.
In that case, is the issue actually specific to pdf.js? If it's written entirely in javascript, could this not be exploited some other way? Or does pdf.js have special permissions in this context?
Well, if I recall correctly, pdf.js is an add-on, so it has special permissions, just like any add-on.
Browsers are supposed to browse that's all. More and more stuff like this will come up with HTML5/JavaScript and people will begin to wonder why the world is jumping through all the JavaScript hoops to build a web app that is essentially a rich client app when they could use tools that are designed for that. Are they more or less secure, neither, once you can touch the user's filesystem the risk is the same which is…
Mobile is a different story of course, but also not portable.
In short I'm not sure what you're suggesting.
I find the first sentence fascinating, "Yesterday morning, August 5, a Firefox user informed us...". I'd love to know more about this person and their skill set. How was the exploit detected and isolated? How did this issue get reported and resolved in s day? Assuming the Mozilla way, I wonder what the bugzilla report will read when it comes out of embargo.
It's me. I discovered the exploit in the wild when I became a victim of it. Skill-set limited. I was able to identify it and understand what it basically does, but not much more.
Why is anyone still using this browser anyway? Firefox is the new IE6.
Earlier quoted context omitted.
Oh great. What could possibly go wrong, give javascript access to local storage through some 'hard to trigger' gate. That's just asking for it. Hindsight and all that but still, this is not a good idea. A browser should not use it's own internal language sandboxed for the web to have access to the local system through some loophole. It's only a matter of time before such a loophole becomes an exploit. I wonder if jav…
You haven't the slightest understanding of software security, PDF.js was written to replace a component authored in a memory-unsafe language for which exploits were being found at a rate measured in tens per year. Since introduction PDF.js has only had 2 holes that were directly exploitable, neither leading to remote code execution which was the default behaviour for pretty much any bug found in Acrobat. If you don't…
Thank you for your constructive advice.
And I note that so far my stuff written in 'memory unsafe languages' has been in production since '99 or so without a compromise to date over 100's of billions of requests.
Maybe it's not just the language.
And what business does a browser have with a .pdf file anyway, where does that end? excel sheets? word documents? proprietary format 'x'? Web browsers should stick to web browsing or at least have a mode where they will stick to just web browsing.
If at all possible it would be worth naming and shaming the advertising network that is allowing this exploit through. Why do advertising networks allow advertisers to exectue Javascript? What need is there for it? Every time one of these exploits that use advertising networks is found, it just increases the value of blockers such as uBlock. Whether you accept adverts or not, you shouldn't have to accept javascript b…
The person who found and reported the exploit said this particular exploit did not originate from an ad server[1].
Without disabling javascript, I have always argued that merely disabling 3rd-party iframe tags is a good first move[2]: significantly less breakage than disabling javascript, yet this will effectively step up security/privacy protection.
In the current case, the person who found it confirmed that just blocking 3rd-party frame tags would have foiled the exploit.[3]
[1] https://news.ycombinator.com/item?id=10021894
[2] https://github.com/gorhill/uBlock/wiki/Dynamic-filtering:-Be...
Since the vulnerability is in pdf.js, is the Tor Browser Bundle vulnerable?
the latest versions come with noscript, so not unless you explicitly enable javascript on that site
Earlier quoted context omitted.
It's me. I discovered the exploit in the wild when I became a victim of it. Skill-set limited. I was able to identify it and understand what it basically does, but not much more.
How long did it take between your discovery and mozilla fix?
Well, sending some user files to Ukrainian server is a bug. But sending hashes of your downloads to Google [1][2] is a feature, right? 1. https://support.mozilla.org/en-US/kb/how-does-phishing-and-m... 2. https://bugzilla.mozilla.org/show_bug.cgi?id=1138721
Why the new version number is "39.0.3" ? Did I miss "39.0.1" and "39.0.2" ?