Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla patches Firefox zero-day abused in the wild

zdnet.com

Post reply on HN
Print view View original

71–80 of 111 posts

Re: Mozilla patches Firefox zero-day abused in the wild

#71

Post by AnaniasAnanas »

iandioch wrote: post #40
AnaniasAnanas wrote: post #30

Earlier quoted context omitted.

Anyone can run a fork though, I right now might be running my personal fork. This is part of the point of free software. Plus, you assume that the select few developers that are given the exploit information are trustworthy. The exploit being public from the first day is better than if even a single developer is untrustworthy or compromised.

I don't understand this logic. It's better to have everyone see it and to guarantee it is seen by a malicious actor, instead of only a small few seeing it and there being some small potential for it to be seen by a malicious actor?

It will be seen by a malicious actor anyway after the fix is released. The difference is that there will be more time for a malicious actor to act against a fork if an embargo is applied.

Re: Mozilla patches Firefox zero-day abused in the wild

#72

Post by user17843 »

thesorrow wrote: post #46

How to know if you have been infected ?

it looks like it specifically targets cryptocurrency owners.

If one has critical personal data on a computer and use it to casually browse the web, one should probably rethink that approach and use different physical devices for different purposes.

Re: Mozilla patches Firefox zero-day abused in the wild

#74

Post by AdmiralAsshat »

cozzyd wrote: post #10

Let's see how long it takes Fedora to deploy an update...

It's easy to get mad at Fedora when we don't have the latest-greatest at the time the announcement drops. But they hold the packages so that they can do additional QA beyond what Mozilla has already done and protect their users.

I'm sometimes disappointed, but after seeing some of the bugs they've caught during the Fedora-specific testing/QA builds, I can understand why they do it.

Re: Mozilla patches Firefox zero-day abused in the wild

#77

Post by fabianhjr »

sterlind wrote: post #37
CryptoBard wrote: post #23

Someone I know was hit by this in a very targeted attack on June 6th. They managed to capture the binary it dropped on their mac with some other gatekeeper bypass vulnerability (perhaps https://www.bleepingcomputer.com/news/security/new-unpatched... ). It is a mac port of the binary discussed in this research paper by Exatel: https://exatel.pl/advisory/paranoicy-raport-socexatel.pdf

Sounds extremely targeted, if an attacker is porting the attack to Macs (presumably a lot of work), and combining it with other loaders... I wonder how long this 0-day was in the wild. Your friend should probably be browsing as a non-admin in a continuously-reimaged VM, separate from an air-gapped machine, if you have those kinds of attackers after you. Spooky..

Just jail outside facing processes like firefox. (BSD Jails, Firejail in Linux and probably another solution on Mac)

Re: Mozilla patches Firefox zero-day abused in the wild

#78

Post by coldpie »

roblabla wrote: post #39
beezle wrote: post #8

Earlier quoted context omitted.

Please do not assume people are not running current release just because they are lazy and have not upgraded. The user experience was degraded at FF57 for many individuals who need extensions that will not work with ff>56 or that developers have abandoned out of frustration with Mozilla. When all the extensions I find necessary are functional (or with suitable replacements) I will switch.

If you don't want Firefox Quantum, you should still switch to a supported browser that kept XUL, such as Basilisk. Also I'm curious, what extensions are missing? Most of my pre-quantum extensions, such as Tree Style Tabs, have been updated now.

> I'm curious, what extensions are missing?

There are a couple I sorely miss. Disable Ctrl-Q died, and so did Toggle Animated GIFs. Now I have to keep an extra tab open with a warn-on-page-close handler to prevent Ctrl-Q fat-fingering from killing my session. And I've just disabled video/GIF animations entirely, instead of using the cool extension which let me start/stop them on demand.

I also used to have a cool cookie exporter extension, which was useful in combination with wget for scraping sites that required a login. I admit I haven't searched for a replacement, though, so maybe there is one.

Re: Mozilla patches Firefox zero-day abused in the wild

#79

Post by wlesieutre »

im3w1l wrote: post #70

Took me a good while to find out how to check my version and update, as that functionality has moved around in the UI.

If anybody else is hunting for this:

Hamburger menu -> Help -> About Firefox

Your version number is listed under the big heading, and if there’s an update available there should be a button next to that.

My question, I'm on beta channel and updated to 68.0b11 today and don't see detailed release notes.

67.0.3 (normal channel) lists "Security fix" https://www.mozilla.org/en-US/firefox/67.0.3/releasenotes/

But beta channel only says 68.0beta released May 22nd, no info on newer beta versions. This is the link in the about box: https://www.mozilla.org/en-US/firefox/68.0beta/releasenotes/

I totally get not wanting to write fine grained release notes on every single beta version, but 0-day fixed feel the kind of thing that ought to be explicitly pointed out. I'm assuming that the same fix from release channel was also pushed in the 68.0b11 update but a release note about that would be swell.

Re: Mozilla patches Firefox zero-day abused in the wild

#80

Post by kchr »

sterlind wrote: post #37
CryptoBard wrote: post #23

Someone I know was hit by this in a very targeted attack on June 6th. They managed to capture the binary it dropped on their mac with some other gatekeeper bypass vulnerability (perhaps https://www.bleepingcomputer.com/news/security/new-unpatched... ). It is a mac port of the binary discussed in this research paper by Exatel: https://exatel.pl/advisory/paranoicy-raport-socexatel.pdf

Sounds extremely targeted, if an attacker is porting the attack to Macs (presumably a lot of work), and combining it with other loaders... I wonder how long this 0-day was in the wild. Your friend should probably be browsing as a non-admin in a continuously-reimaged VM, separate from an air-gapped machine, if you have those kinds of attackers after you. Spooky..

Just speculation, but "targeting" in this case may be as trivial as checking the user agent header, or other "device recognition" tricks common in web development nowadays. I am sure there are hundreds of libraries that do this for you...
Post reply on HN