Mozilla patches Firefox zero-day abused in the wild(zdnet.com)

255 pointsby Bendervor 7 Jahren104 comments

Mozilla patches Firefox zero-day abused in the wild

https://www.zdnet.com/article/mozilla-patches-firefox-zero-day-abused-in-the-wild/

110 comments

Someone I know was hit by this in a very targeted attack on June 6th. They managed to capture the binary it dropped on their mac with some other gatekeeper bypass vulnerability (perhaps https://www.bleepingcomputer.com/news/security/new-unpatched...). It is a mac port of the binary discussed in this research paper by Exatel: https://exatel.pl/advisory/paranoicy-raport-socexatel.pdf

sterlindvor 7 Jahren

Sounds extremely targeted, if an attacker is porting the attack to Macs (presumably a lot of work), and combining it with other loaders... I wonder how long this 0-day was in the wild.

Your friend should probably be browsing as a non-admin in a continuously-reimaged VM, separate from an air-gapped machine, if you have those kinds of attackers after you. Spooky..

saidajigumivor 7 Jahren

if an attacker is porting the attack to Macs (presumably a lot of work)

It's worth noting that a professional security and pentest company I know of had a Python-based exploit authoring DSL that automatically generated exploit code across a very wide range of processor architectures and OSes. This was about fifteen years ago.

stcredzerovor 7 Jahren

It's worth noting that a professional security and pentest company I know of had a Python-based exploit authoring DSL that automatically generated exploit code across a very wide range of processor architectures and OSes.

Makes sense. If entire OSes can be written in an intermediate representation, then exploits can be as well.

kseifriedvor 7 Jahren

You mean Core Impact? =).

saidajigumivor 7 Jahren

dingdingdingdingding!

admax88qvor 7 Jahren

What about that makes it sound targeted? Seems like standard vulnerabilities chained together, nothing specific to the "target"

FDSGSGvor 7 Jahren

> presumably a lot of work

How come?

fabianhjrvor 7 Jahren

Just jail outside facing processes like firefox. (BSD Jails, Firejail in Linux and probably another solution on Mac)

kchrvor 7 Jahren

Just speculation, but "targeting" in this case may be as trivial as checking the user agent header, or other "device recognition" tricks common in web development nowadays. I am sure there are hundreds of libraries that do this for you...

[deleted]vor 7 Jahren

ga-vuvor 7 Jahren

It's just hearsay, buddy.

You can't be sure the same bug was exploited.

campuscodivor 7 Jahren

Additional details about the Firefox zero-day:

https://twitter.com/campuscodi/status/1141279052893999104

ga-vuvor 7 Jahren

(1)

factismovor 7 Jahren

It's a JIT bug, you can see the fix here: https://hg.mozilla.org/releases/mozilla-release/rev/99a829d2...

fiveoakvor 7 Jahren

"This simplifies the code a bit because ElementAccessHasExtraIndexedProperty checks for length-overflow and sparse-indexes so the callers don't have to do that anymore."

simple code best code, the less opportunity you give people to shoot themselves in the foot the better

pdkl95vor 7 Jahren

Assuming this[1] test for sparse indexes with extra properties in the unfixed version of the file as part of the bugged code, the annotations suggest that the bug MIGHT have been (partially?) introduced by this[2] changeset. If so, that means all versions of Firefox >= 38.0a1 (21 Apr 2015) might be vulnerable to the bug.

If the bug is really that old, it's certainly possible it might have been abused in the wild, perhaps in more ways than the just the "targeted attacks" mentioned the report.

[1] https://hg.mozilla.org/releases/mozilla-release/rev/99a829d2...

[2] https://hg.mozilla.org/releases/mozilla-release/rev/6bfcb81d...

ademupvor 7 Jahren

"A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw."

I'm at a loss imagining how this might work, can anyone expound on this? How might this actually occur?

dangvor 7 Jahren

This quote is from https://www.mozilla.org/en-US/security/advisories/mfsa2019-1....

We merged that thread (https://news.ycombinator.com/item?id=20220804) into this one.

akerrovor 7 Jahren

> You are not authorized to access bug 1544386. To see this bug, you must first log in to an account with the appropriate permissions.

[deleted]vor 7 Jahren

TazeTSchnitzelvor 7 Jahren

One possibility would be that Array.prototype.prop incorrectly assumes `this` is an Array.

verroqvor 7 Jahren

One of the most obvious attacks is if two different typed objects have similar memory layouts you can use it to read/write fields.

Say you had class A and class B and they are confused with each other.

Suppose they have the following layout:

    struct A {
        int x
        void *f()
    }

    struct B {
        int x
        int y
        int z
    }

Then if you have a class A and you make the program think it's actually class B. You can imagine that if you control an object B you can update the fields x, y of a object B. Once this is prepared you can then use the object as type A and then run some code to trigger the call to A.f()

Obviously this is a trivial example but with depending on the vulnerability you can perhaps use it call protected functions and all kinds of memory corruption.

Attacks on JavaScript arrays tend to edit the 'size' field and change it to a really really large number, thus by simply indexing the array you can have unrestricted read/write access to a large section of memory.

chiivor 7 Jahren

> indexing the array you can have unrestricted read/write access to a large section of memory.

but won't the memory protection (write xor execute) stop the function pointer from jumping to the array body (since that's write memory)? Meh, i guess in actual practise, it's much more complicated than that...

ip26vor 7 Jahren

I'm not a software guy but JavaScript allows self modifying code (SMC)

verroqvor 7 Jahren

You can use ROP.

amaccuishvor 7 Jahren

It's in moments like this where I really dislike running Ubuntu and having to wait for the new build to be released.

kikoreisvor 7 Jahren

Updates have been out for a while now for both snaps and debs; here's the USN: https://lists.ubuntu.com/archives/ubuntu-security-announce/2...

zcidvor 7 Jahren

It should be available pretty soon. Void has already released the new version and they're a very small group.

jlgaddisvor 7 Jahren

You could download the 64-bit Linux build [0] and use it until a new Ubuntu package is available.

[0]: https://download.mozilla.org/?product=firefox-latest-ssl&os=...

amaccuishvor 7 Jahren

Thanks, for some reason I thought they only provided source and not builds.

beatgammitvor 7 Jahren

They're usually pretty quick, as in nearly as quick as rolling releases (and sometimes faster). Sure, they're not as fast as Mozilla, but usually it's out within a day or so if release, often quicker.

Daniel_skvor 7 Jahren

It takes days on Linux Mint. I just installed the binary directly from Firefox website and I get instant updates.

AnaniasAnanasvor 7 Jahren

Consider trying the debian package until it is updated in your system.

pjavor 7 Jahren

Currently in incoming btw:

https://incoming.debian.org/debian-buildd/pool/main/f/firefo...

simosxvor 7 Jahren

$ snap info firefox

...

channels:

  stable:        67.0.3-1    2019-06-18 (230) 221MB -

It is already available to use.

amaccuishvor 7 Jahren

I've looked at moving to the snap before but last I heard there's no way to import your current profile? And netflix doesn't work? If those two things are fixed I'd happily change over!

simosxvor 7 Jahren

By default, a snap package cannot touch your dot directories in your $HOME. That is good for your security.

You would need to copy once (or `rsync`) from `~/.mozilla/firefox/` to `~/snap/firefox/current/.mozilla/firefox/`.

mdanielvor 7 Jahren

For the former, I would imagine `rsync -Pav $whatever_old_ff_profile/ $HOME/snap/firefox/whatever/` would do that, since AFAIK snaps store user-specific persistent state outside of privileged directories

The alternative, and likely why no one has applied a great deal of pressure to that workflow, is to use the Firefox Sync account they've been pushing so hard

kd913vor 7 Jahren

Netflix for me works fine. You just need to tick the 'Play DRM content' setting.

My personal reason to use the snap is because it limits access to the home directory. So I can disconnect my home directory, camera and microphone and have a second layer of confidence that my browser won't leak any personal data.

That and it avoids Firefox leaking config files in my home directory.

If I want to upload a file, I simply move the file into a Downloads folder in it's SNAP home directory. This way, Im in control of what the browser can access.

user17843vor 7 Jahren

How useful is blocking third party scripts and frames against this?

im3w1lvor 7 Jahren

Took me a good while to find out how to check my version and update, as that functionality has moved around in the UI.

moontearvor 7 Jahren

The quickest way is and always was Help > About Firefox

wlesieutrevor 7 Jahren

If anybody else is hunting for this:

Hamburger menu -> Help -> About Firefox

Your version number is listed under the big heading, and if there’s an update available there should be a button next to that.

My question, I'm on beta channel and updated to 68.0b11 today and don't see detailed release notes.

67.0.3 (normal channel) lists "Security fix" https://www.mozilla.org/en-US/firefox/67.0.3/releasenotes/

But beta channel only says 68.0beta released May 22nd, no info on newer beta versions. This is the link in the about box: https://www.mozilla.org/en-US/firefox/68.0beta/releasenotes/

I totally get not wanting to write fine grained release notes on every single beta version, but 0-day fixed feel the kind of thing that ought to be explicitly pointed out. I'm assuming that the same fix from release channel was also pushed in the 68.0b11 update but a release note about that would be swell.

the_jeremyvor 7 Jahren

On mac, it's Firefox menu -> About Firefox, then wait for it to download the update and click restart

fencepostvor 7 Jahren

Can't really test from my phone, but isn't pressing and releasing the Alt key still a shortcut for displaying a menu bar if one exists?

ygjbvor 7 Jahren

Yes, on Windows.

fencepostvor 7 Jahren

Are there not comparable or identical shortcuts for keyboard users on most nix boxes and Macs? I admit to not being up to speed on Command/Option/Splat Mac shortcuts, but I wouldn't have expected the chrome to diverge that much between systems from a common code base.

cozzydvor 7 Jahren

Let's see how long it takes Fedora to deploy an update...

viraptorvor 7 Jahren

Being built already: https://koji.fedoraproject.org/koji/buildinfo?buildID=128978...

metta2uallvor 7 Jahren

I'm grateful to QubesOS for being able to easily browse in a disposable VM whilst waiting for the build. Even without QubesOS starting a disposable VM manually is probably worth the effort..

AdmiralAsshatvor 7 Jahren

It's easy to get mad at Fedora when we don't have the latest-greatest at the time the announcement drops. But they hold the packages so that they can do additional QA beyond what Mozilla has already done and protect their users.

I'm sometimes disappointed, but after seeing some of the bugs they've caught during the Fedora-specific testing/QA builds, I can understand why they do it.

jamesgeck0vor 7 Jahren

Delaying zero-day security patches for any length of time doesn't protect users.

AdmiralAsshatvor 7 Jahren

I don't like dealing in absolutes. There are valid reasons to hold a security patch for some period of time if the cure is worse than the poison. See, for example, some of the early Spectre/Meltdown mitigations that caused a 20% performance hit.

lunchablesvor 7 Jahren

Are you implying that Fedora has some history of being slow to update security vulnerabilities?

cozzydvor 7 Jahren

No, just genuine curiosity since I use Fedora systems and updating manually is much more work.

snakyvor 7 Jahren

The last Nightly Firefox build for Android to date is 68.0.a1 from 2019-05-04.

https://www.mozilla.org/en-US/firefox/android/nightly/all/

Does it contain the fix?

gruezvor 7 Jahren

Looks like nightly builds aren't being published. Even if you browse the directories manually, they're not there[1]. On google play[2] it's showing as updated, though.

[1] https://download-installer.cdn.mozilla.net/pub/mobile/nightl... although the ESR builds are coming in fine, so maybe something broke the build script?

[2] https://play.google.com/store/apps/details?id=org.mozilla.fe...

snakyvor 7 Jahren

While official ESR FAQ say there's no ESR for Android ever.

> Is Mozilla Firefox ESR available for Android and iOS?

> No. Firefox ESR will only be offered for Windows, macOS and Linux for desktop computers.

Play Store is confusing, because the actual version is "depends on your device".

robotbikesvor 7 Jahren

F-droid has a program called Firefox Updater which downloads the latest apk from Mozilla directly.

sp332vor 7 Jahren

I asked on twitter and they said nightly was not affected. https://mobile.twitter.com/FirefoxNightly/status/11411120523...

snakyvor 7 Jahren

That's kind of strange, especially considering the fact Nightly Android and Nightly Desktop are different versions.

sp332vor 7 Jahren

I haven't seen any indication that 68 was affected on any platform.

thesorrowvor 7 Jahren

How to know if you have been infected ?

user17843vor 7 Jahren

it looks like it specifically targets cryptocurrency owners.

If one has critical personal data on a computer and use it to casually browse the web, one should probably rethink that approach and use different physical devices for different purposes.

[deleted]vor 7 Jahren

(1)

[deleted]vor 7 Jahren

ga-vuvor 7 Jahren

This seems like an ideal vulnerability for exploits kits, to be honest. Crash and run code to drop malware on a system.

est31vor 7 Jahren

Firefox is supposed to have sandboxing, right? Does this sandboxing help against such attacks? As in: is there a second attack on the sandbox needed to get RCE?

lorenzhsvor 7 Jahren

From the article: "Following a request for additional details from ZDNet, Groß said "the bug can be exploited for RCE [remote code execution] but would then need a separate sandbox escape" in order to run code on an underlying operating system."

est31vor 7 Jahren

Replying to myself: the sandbox escape got fixed in 67.0.4: https://www.mozilla.org/en-US/security/advisories/mfsa2019-1...

misesvor 7 Jahren

Some one mentioned this is being used against crypto owners; get in and perhaps read session cookies for a web wallet? Or combine with another zero-day. Any one with this has serious resources and probably a good team.

AnaniasAnanasvor 7 Jahren

https://bugzilla.mozilla.org/show_bug.cgi?id=1544386

I find it really gross that they do not allow others to access it. This behavior damages the forks.

mookvor 7 Jahren

Mozilla used to open up the security bugs after the fix is out for a while.

I say used to because I notice that the security issues fixed in Firefox 66.0 (released in March according to the release notes) still appear to be private. I suspect the internal people that cared about it have left, and their process is now broken. Somebody might read this thread and poke people to open access, but it would have to be done as an exceptional step (given that it hasn't been the first time I've noticed this happening).

bzbarskyvor 7 Jahren

The same people who were in charge of opening up security bugs are still around and still in charge of it.

Security bugs are opened up once in-the-wild usage of affected versions is low enough, if I recall correctly. This usually takes a while after the fix is shipped. At no point were bugs opened up immediately after the Firefox release with the fix shipped. It's usually a year or so between the fix being shipped and the bug getting opened up, in my experience.

mookvor 7 Jahren

Ah, okay, thanks! My (very unreliable) memory thought it was sooner; that was why I picked 66 (released in March) rather than 67 (May).

The security issues in 60.0.2 (June 6 2018) is now public.

ygjbvor 7 Jahren

Unless things have changed dramatically since I left Mozilla, forks that are willing to be active in the Mozilla security community are able to get access to security bugs.

auscompgeekvor 7 Jahren

The source code for the fix is public. Presumably the bug report includes working exploit code. I don't see how this is "damaging" for forks.

AnaniasAnanasvor 7 Jahren

It is important to also understand what causes the issue, how it was exploited, etc. Plus I am pretty sure that they had the bug report before the fix was released.

lifthrasiirvor 7 Jahren

Are there any fork that modifies Firefox so thoroughly that one needs a context to patch SpiderMonkey?

icebrainingvor 7 Jahren

Mozilla can still give access for the developers of forks without opening it to the public before they (and the forks!) have managed to rollout a full update.

AnaniasAnanasvor 7 Jahren

Anyone can run a fork though, I right now might be running my personal fork. This is part of the point of free software.

Plus, you assume that the select few developers that are given the exploit information are trustworthy. The exploit being public from the first day is better than if even a single developer is untrustworthy or compromised.

iandiochvor 7 Jahren

I don't understand this logic. It's better to have everyone see it and to guarantee it is seen by a malicious actor, instead of only a small few seeing it and there being some small potential for it to be seen by a malicious actor?

AnaniasAnanasvor 7 Jahren

It will be seen by a malicious actor anyway after the fix is released. The difference is that there will be more time for a malicious actor to act against a fork if an embargo is applied.

beezlevor 7 Jahren

Really unhappy with Mozilla. Does this effect all versions of Firefox? Quantum only? The bug report itself is not viewable publicly either.

amaccuishvor 7 Jahren

True they could have been clearer on the versions affected, but tbh you should keep with the latest supported anyway.

Security bug reports are often restricted for some time after a new release to help prevent reverse engineering to find the bug.

floatingatollvor 7 Jahren

Mozilla was, Zdnet was not. https://www.mozilla.org/en-US/security/advisories/mfsa2019-1...

pdkl95vor 7 Jahren

The only additional information on that mozilla link is that the issue is "fixed in Firefox 67.0.3 and Firefox ESR 60.7.1". The only information about affected versions is that an unspecified set of "Firefox, Firefox ESR" are vulnerable.

The report doesn't include anything about which version introduced the bug. Is this a recent bug, or has it been around for many years? If it's old, is there any information available that might indicate how long malicious actors have been exploiting this vulnerability? Apparently the answer to the last question is "yes", as Mozilla claims that "We are aware of targeted attacks in the wild abusing this flaw." For how long? How many people might be affected?; "targeted" could mean a single individual or a very large group with some specifically targetable attribute.

There is a lot more to security than "just upgrade to the latest release". Also, while fears about public malicious actors learning from disclosure rarely outweigh the important benefits gained by allowing the public to defend themselves and learn form the incident, in this particular case where malicious actors are already exploiting the bug in the wild, there is little to be gained by keeping information hidden from the public.

floatingatollvor 7 Jahren

What right would the Firefox team have to invade the privacy of the "target" to detail who they are to the Internet as a whole?

HN users frequently complain that "automatically check for updates" is somehow an invasion of privacy. Meeting your demand, revealing the target of an attack publicly, would certainly be an invasion of privacy — one a thousand times more trust-violating than any auto-update check could be.

What of your needs is met by making such a request? What is your direct and personal benefit from knowing the target of the attack? Why are you willing to sacrifice the privacy of that target for that personal benefit?

snakyvor 7 Jahren

What about mobile versions? What about Beta, Developer, Nightly versions?

notafrogvor 7 Jahren

Firefox app on my Android phone was updated yesterday to 67.0.3, and the release notes mention the security fix.

snakyvor 7 Jahren

There's more than one mobile version.

Latest Android Nightly build is 68.0a1 from 2019-05-04.

Latest Android Beta build is 68.0beta, from May 21, 2019 (actually from APK name it's 68.0b11).

Latest iOS Release build is 16.0, from April 15, 2019.

By the way, latest Desktop Beta build is 68.0beta, from May 22, 2019, and latest Desktop Nightly build is 69.0a1, from May 20, 2019 - and there's no information about whether they affected too.

lorenzhsvor 7 Jahren

The iOS version should be unaffected, as Firefox for iOS does not include its own JS engine (it uses the one provided by the system), which is where this vulnerability is.

For the Desktop version at least, if you download the current beta (68.0beta11), you'll notice that it was built two days ago. The latest nightly was built today. The changelog for these is just not kept up to date.

beezlevor 7 Jahren

Please do not assume people are not running current release just because they are lazy and have not upgraded.

The user experience was degraded at FF57 for many individuals who need extensions that will not work with ff>56 or that developers have abandoned out of frustration with Mozilla. When all the extensions I find necessary are functional (or with suitable replacements) I will switch.

tonny747vor 7 Jahren

I would be more concerned about all the other vulnerabilities in FF56 then just this one.

https://www.cvedetails.com/vulnerability-list.php?vendor_id=...

amaccuishvor 7 Jahren

Well you are running an unsupported version, so Mozilla doesn't have to concern themselves with backports.

If you still want to use your extensions AND receive browser updates, you should move to a different browser (maybe waterfox?)

floatingatollvor 7 Jahren

Firefox 56 is unlikely to ever receive security patches every again. You are incredibly vulnerable by staying behind.

roblablavor 7 Jahren

If you don't want Firefox Quantum, you should still switch to a supported browser that kept XUL, such as Basilisk.

Also I'm curious, what extensions are missing? Most of my pre-quantum extensions, such as Tree Style Tabs, have been updated now.

coldpievor 7 Jahren

> I'm curious, what extensions are missing?

There are a couple I sorely miss. Disable Ctrl-Q died, and so did Toggle Animated GIFs. Now I have to keep an extra tab open with a warn-on-page-close handler to prevent Ctrl-Q fat-fingering from killing my session. And I've just disabled video/GIF animations entirely, instead of using the cool extension which let me start/stop them on demand.

I also used to have a cool cookie exporter extension, which was useful in combination with wget for scraping sites that required a login. I admit I haven't searched for a replacement, though, so maybe there is one.

gdfasfklshg4vor 7 Jahren

I get the annoyance with deprecating extensions. But seriously the <edit>main</edit> person you are harming by running vulnerable un-patched software is yourself.

EDIT: s/the only person/the main person/

sgiftvor 7 Jahren

If only this was true. People with unpatched software running are prime targets for inclusion in a botnet and then they are damaging other with their reckless behavior.

Zardoz84vor 7 Jahren

https://xkcd.com/1172/

Zardoz84vor 7 Jahren

Obligatory xkcd reference https://xkcd.com/1172/

userbinatorvor 7 Jahren

This is exactly the problem with the culture that's formed around software and the security industry in general --- people are using the excuse of "security" to force other utterly unwanted and hostile changes, and then act surprised and angry when people don't update.

Doubly so when the advice given is basically "bend over and take it" --- especially when Mozilla has made statements like this in the past:

https://blog.mozilla.org/security/2013/01/29/putting-users-i...

"Users should have the choice of what software and plugins run on their machine."

In any case, I hope NoScript is one of the extensions you're already using, because this is another vulnerability that requires JS to exploit. JS off by default already gets rid of the vast majority of them.

jamespovor 7 Jahren

Not sure how Mozilla are forcing anything

apostacyvor 7 Jahren

Mozilla has been very destructive, and I have had to restrain Firefox in a number of different ways. It's Updater.app will disregard your wishes and repeatedly download updates over and over again. This happened to me when I had to turn in an assignment and I was on a 2G connection a few years ago. Most of their updates are unidirectional, even though they don't need to be. And major features are quietly removed, as if it is just normal for your car's speedometer to disappear one morning. This ends up feeling like gas-lighting. At least Chrome's updates are small and hard to notice, but Firefox has all the same disregard for users, except they are very clumsy about it. And the official response from them has been that if their updates destroy your profile folder, that you should have made a backup and it was your fault for assuming that their software wouldn't do a destructive update.

userbinatorvor 7 Jahren

The tone-deafness of the comments here is astounding. The fact that these posts are rapidly downvoted further reinforces my point.

It's not just Mozilla, it's the whole "update culture": "you must take these important fixes for remotely-exploitable vulnerabilities, and also all of that other stuff" --- of which everyone would probably want the former, but no one really wants the latter.

When the "choice" of browsers that can view the majority of sites, including advanced JavaScript, is basically between Firefox or the various flavours of Chrom(e/ium), there is no real choice!

tl;dr: To say I am annoying with the state of things is an enormous understatement. The browser culture is getting more and more user-hostile and "security" is being used as an excuse to put users under the noose, this encouragement of "learned helplessness" is insane. Fuck this idiotic "it's for your security" bullshit.

apostacyvor 7 Jahren

I'm sorry you are getting downvoted. You are absolutely correct. I've gotten in many discussions about this exact same thing on HN. I at one point I had an exchange with someone about terrible bad Pale Moon was because it let users do things like override HSTS settings, and otherwise undo decisions that Mozilla had made.[1]

I actually have highly specialized profiles that make heavy use of XUL addons that I have developed over the years for very specific things, and I hate how careful I have to be that an update won't come and delete them. It would be one line of code to make a backup of a profile before "upgrading" it...

[1]: https://news.ycombinator.com/item?id=19527615

Anyway, it's a much bigger problem, and it's cultural as much as technological. And you're not alone and you're not crazy for seeing it.