Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla patches two use-after-free vulnerabilities (ab)used in the wild

mozilla.org

Post reply on HN
Print view View original

61–67 of 67 posts

Re: Mozilla patches two use-after-free vulnerabilities (ab)used in the wild

#61

Post by xorcist »

_rdvw wrote: post #45
upofadown wrote: post #26

Earlier quoted context omitted.

That seems to be quite focused on the situation with Firefox on the Android/Graphene environment. >It's basically universally agreed among security people that Firefox is less secure than Chrome. A reference would be nice here...

The biggest issue is that Firefox on Android runs all websites in the same process. https://bugzilla.mozilla.org/show_bug.cgi?id=1565196 Another example, third party Chromium builds like Vanadium or Mulch also go further and enable CFI on Android (still default disabled upstream last I checked).

Chrome also has what, at least from the outside, looks like a little more refined mitigations for WebGL.

That said, both browsers have huge attack surfaces. The best you can do for any of them is to disable WebGL, WebRTC, WebUSB etc. completely and only enable the ones you need. This does much more for your security when browsing the web than the differences between browsers.

The plugins for Firefox to expose this functionality have at least traditionally been a little bit more user friendly.

Opt-in javascript functionality would be the next step.

Re: Mozilla patches two use-after-free vulnerabilities (ab)used in the wild

#62

Post by SilasX »

melony wrote: post #46

What happened to rewriting the browser engine in Rust? Isn't the language supposed to prevent this sort of bugs?

And while we’re on the topic, even within C++, why isn’t Mozilla using better dev practices that avoid use-after-free bugs?

Re: Mozilla patches two use-after-free vulnerabilities (ab)used in the wild

#63

Post by _rdvw »

xorcist wrote: post #61
_rdvw wrote: post #45

Earlier quoted context omitted.

The biggest issue is that Firefox on Android runs all websites in the same process. https://bugzilla.mozilla.org/show_bug.cgi?id=1565196 Another example, third party Chromium builds like Vanadium or Mulch also go further and enable CFI on Android (still default disabled upstream last I checked).

Chrome also has what, at least from the outside, looks like a little more refined mitigations for WebGL. That said, both browsers have huge attack surfaces. The best you can do for any of them is to disable WebGL, WebRTC, WebUSB etc. completely and only enable the ones you need. This does much more for your security when browsing the web than the differences between browsers. The plugins for Firefox to expose this fu…

I maintain configs for both to do just that!

https://gitlab.com/divested/brace/-/blob/master/brace/etc/ch...

https://gitlab.com/divested/brace/-/tree/master/brace/usr/li...

Re: Mozilla patches two use-after-free vulnerabilities (ab)used in the wild

#64

Post by tgsovlerkhgsel »

kibwen wrote: post #35
tgsovlerkhgsel wrote: post #27

Earlier quoted context omitted.

Related: Mozilla fired parts of their security team (though likely not the people directly responsible for securing the browser) - https://news.ycombinator.com/item?id=24128865 Quote from one of the tweets confirming it: "They killed entire threat management team. Mozilla is now without detection and incident response."

But according to your own link, it was confirmed that they didn't do that? Did you mean to link to something else?

They fired part of their security team, namely the entire security response and threat management teams, according to that link and the linked tweets. They still have some security team left.

Re: Mozilla patches two use-after-free vulnerabilities (ab)used in the wild

#65

Post by concinds »

fulafel wrote: post #52
concinds wrote: post #20

Earlier quoted context omitted.

This is slightly outdated now, but here's the GrapheneOS explanation for why they don't recommend Firefox, and why they bundle Chromium-based forks instead. https://grapheneos.org/usage#web-browsing It's basically universally agreed among security people that Firefox is less secure than Chrome. It's up to you to decide is it's likely Mozilla's caught up in the (year?) since this was written,. Or if they'll ever be ab…

There are more factors affecting your safety as a user: how popular a target is the app? Eg a Linux desktop is thought to be less likely to get a malware infection than a Windows desktop, even though Windows has more security investment and attention and mechanisms (antivirus, quarantined files, etc) to defend against this. The same reasons might apply: Firefox too has a smaller market share and more discerning user…

> The same reasons might apply: Firefox too has a smaller market share and more discerning user base, so less attractive to target at least for mass malware.

Firefox is Tor Browser which is the most attractive target by far for 0 days. 0 days are often not targeted to a single individual anymore but are commonly used "in the wild" against mass targets, e.g. everyone who browses a political dissident website.

Re: Mozilla patches two use-after-free vulnerabilities (ab)used in the wild

#66

Post by fulafel »

concinds wrote: post #65
fulafel wrote: post #52

Earlier quoted context omitted.

There are more factors affecting your safety as a user: how popular a target is the app? Eg a Linux desktop is thought to be less likely to get a malware infection than a Windows desktop, even though Windows has more security investment and attention and mechanisms (antivirus, quarantined files, etc) to defend against this. The same reasons might apply: Firefox too has a smaller market share and more discerning user…

> The same reasons might apply: Firefox too has a smaller market share and more discerning user base, so less attractive to target at least for mass malware. Firefox is Tor Browser which is the most attractive target by far for 0 days. 0 days are often not targeted to a single individual anymore but are commonly used "in the wild" against mass targets, e.g. everyone who browses a political dissident website.

This sounds like a plausible factor but on the other hand, people who use Tor might be more security conscious and/or tech savvy, frequently run in a sandbox VM - and those unpatched vulnerabilities might get burned sooner if used on them. Any evidence or data would be interesting to see of course.

Re: Mozilla patches two use-after-free vulnerabilities (ab)used in the wild

#67

Post by Georgelemental »

wishawa wrote: post #42
Georgelemental wrote: post #29

Earlier quoted context omitted.

Kiwi Browser ( https://kiwibrowser.com/ ) is a FOSS Chromium for Android derivative that supports Chrome extensions.

Kiwi Browser is not FOSS. They have a skeleton GitHub repo with Chromium code. Their patches aren’t published.

Their patches do seem to be available under BSD here: https://github.com/kiwibrowser/src.next/blob/kiwi/LICENSE
Post reply on HN