Firefox is critically flawed - bit-tech.net Forums

Tim S · 2nd Oct 2006, 10:33

http://www.bit-tech.net/news/2006/10...ically_flawed/

DougEdey · 2nd Oct 2006, 10:36

No biggie in my view, I reckon "some time" to Mozilla is two weeks. It'd take that long for some annoying **** to devise a virus to attack this section.

And I don't go on nefarious websites.

BioSniper · 2nd Oct 2006, 10:36

Ooooohhh dear. Thats really not good

Shame that a good chunk of people using firefox possibly won't know how to turn Javascript off.
Guess I best do that..

specofdust · 2nd Oct 2006, 10:39

Quote:

Originally Posted by article

"I think it is unfortunate because it puts users at risk, but that seems to be their goal."

What a stupid person. Hackers release info like this to the general public all the time, it's not uncommon, and seems pretty much de rigueur for OSS. For her to say that shows a clear lack of apreciation, which she should have; the hackers showed the firefox devs, and the entire community, that there is a problem with the browser and that it needs to be fixed.

edit: should add, there's a fix here

Tim S · 2nd Oct 2006, 10:42

Quote:

Originally Posted by specofdust

What a stupid person. Hackers release info like this to the general public all the time, it's not uncommon, and seems pretty much de rigueur for OSS. For her to say that shows a clear lack of apreciation, which she should have; the hackers showed the firefox devs, and the entire community, that there is a problem with the browser and that it needs to be fixed.

Well, I think she wanted them to use Firefox's 'report a bug' function and discuss the flaws directly with the Mozilla team. However, I guess that there would be no time pressure for Mozilla to fix the bug in that way. It's horses for courses.

BioSniper · 2nd Oct 2006, 10:43

Worst part though spec is if you read the whole article on Zdnet they apparently know of 30 unpatched issues but they aren't willing to disclose them to the Mozilla team and instead wish to use them to their own advantage when they could be earning $500 per exploit under the bounty system the team has..
Kinda sad really.

specofdust · 2nd Oct 2006, 10:44

Quote:

Originally Posted by Tim S

Well, I think she wanted them to use Firefox's 'report a bug' function and discuss the flaws directly with the Mozilla team. However, I guess that there would be no time pressure for Mozilla to fix the bug in that way. It's horses for courses.

But as you say, with no time pressure they could have taken as long as they felt like to get around to it, and in that time other people could have found and exploited the problem. It may be wide open right now, but at least users can turn javascript off, the firefox team have to fix it as a priority, and black hats are aware that whatever nefarious deeds they do are going to be negated by the users turning javascript off and the firefox team shortly fixing the problem.

airchie · 2nd Oct 2006, 10:47

NoScript is a great extension for FF which should help with this issue.
Its basically white-listing for javascripts.
You only run the ones from site you trust.

steveo_mcg · 2nd Oct 2006, 11:52

Quote:

Originally Posted by BioSniper

Worst part though spec is if you read the whole article on Zdnet they apparently know of 30 unpatched issues but they aren't willing to disclose them to the Mozilla team and instead wish to use them to their own advantage when they could be earning $500 per exploit under the bounty system the team has..
Kinda sad really.

Am i mistaken or did Mozilla.com not report profits in the millions of dollars last year? $500 per exploit seems fair, we would all do the same to MS if the situation were different.

Salazaar · 2nd Oct 2006, 11:54

Quote:

Originally Posted by airchie

NoScript is a great extension for FF

NoScript is a fantastic extension, every Firefox user should have it.

Laitainion · 2nd Oct 2006, 11:58

Given that the problem is a stack overflow, wouldn't turning on DEP (in Windows) or the appropriate feature for every other program prevent this from actually working? Assuming that a stack overflow is similar to a buffer overflow, which is what Data Execution Prevention is meant to prevent.

Emon · 2nd Oct 2006, 12:41

At first glance I would have to call BS, since it's not possible for something to be "impossible to patch." It just doesn't make sense. Yes, difficult, perhaps not feasible in the face of a complete rewrite, but impossible? What?

Without knowing the details of this exploit, which I'm too lazy to look into, I can't say anything assuredly. However I'd like to point out that just because an exploit exists, doesn't mean it's ever been used or that your previous browsing experiences haven't been more secure for using Firefox. Afterall, if the exploit was just recently discovered, and is quickly patched, what's the harm?

I'm sure pro-MS zealots will use this as ammo against Mozilla, which I think is just a mistake. As is so often pointed out, it's not just the issue of exploits, but how well known they are and how quickly they are patched. OSS has a much better history of that than Microsoft.

Oh, and for the record, I'm not some anti-MS or Linux zealot. MS makes some great products. .NET is completely amazing. I use Ubuntu Server on my personal web server and XP for all my workstations. Just trying to put myself in the clear to avoid possible derailination of this thread.

ajack · 2nd Oct 2006, 12:52

Window Snyder is the best name ever.

DougEdey · 2nd Oct 2006, 13:06

There's a difference between patching and rewriting the javascript implementation, since this appears to be a fundamental flaw, its like having a problem with research, you have to restart from the beginning.

trailblazer · 2nd Oct 2006, 15:47

There is an interesting article at http://arstechnica.com/news.ars/post/20060925-7818.html. Looks like opera is the clear winner, although not perfect.

Cthippo · 2nd Oct 2006, 16:28

Sounds to me like growing pains in the open source community. They have gone from being a nieche product to mainstream and are having trouble adjusting to all the attention, both from users and from attackers. I think in the end Open source is the best model for software develpment, especially from a security standpoint, but because of it's more diffuse organization it will take longer for the development base to change and adapt.

trailblazer · 2nd Oct 2006, 16:58

The general perception was that while Firefox had a small user base it would be left alone by hackers, but, if/when it started to become popular they would look for vulnerabilitys in the software. Looks like they are tearing it to bits, worse still, saying that the code is a mess and may be a challenge to fix. Until then,I will use Opera, if it works and is reasonably secure, that's fine by me. I am no fan of any particular web browser.

sadffffff · 2nd Oct 2006, 17:26

as much as i would love to point at this and be all like "hahahah, take that firefox fanboys, browser's not so secure now is it!" i really cant. i mean, my attitude has always been, "youre too paranoid" these exploits will never get you unless youre visiting some very questionable sites... IE hasnt failed me yet. never get any adware/spyware/viruses etc etc.. just be carefull and about any browser will work, despite SECURITY ISSUES OMG NO!!! so basically, meh...

i assume that by "unpatchable" they mean that patching it would actually have to be a total rewrite.. like the way they implemented java is wrong in the way they wrote it, so to fix it they have to write it differently.

Cobalt · 2nd Oct 2006, 17:41

I have never faced any of these kind of attacks with any browser. I really don't see where the attacks come from because I don't know of anyone who has been attacked. Even if hackers write the attacks, who is going to use them? Any sites that wish to cause harm will still be attacking IE becuase it is used by more people. Added to that, the type of people who use FF are more careful in their browsing habits anyway. Technology isn't the only factor to consider when looking at security. The human side of things is much more important.

Lazarus Dark · 2nd Oct 2006, 19:22

if i turn off javascript, how will that affect my browsing?

2nd Oct 2006, 10:33	#1
Tim S Pewlius Caesar bit-tech Staff Join Date: Nov 2001 Location: Ascot, Berks Posts: 18,021	Firefox is critically flawed http://www.bit-tech.net/news/2006/10...ically_flawed/ __________________ Tim on Twitter \| Tim's Blog \| Tim's Flickr The bit-tech Blog \| bit-tech on Twitter \| Join the bit-tech & Custom PC folding team (#35947)

2nd Oct 2006, 10:36	#2
DougEdey I pwn all your storage Join Date: Jul 2005 Location: Southampton Posts: 13,933	No biggie in my view, I reckon "some time" to Mozilla is two weeks. It'd take that long for some annoying **** to devise a virus to attack this section. And I don't go on nefarious websites. __________________ Burnout: Paradise Stats!XBL: DougEdey Bindi PSN ID: DougEdey Twitter

2nd Oct 2006, 10:36	#3
BioSniper I Mod, Therefore I Own Join Date: Feb 2002 Location: Somewhere in the south Posts: 3,460	Ooooohhh dear. Thats really not good Shame that a good chunk of people using firefox possibly won't know how to turn Javascript off. Guess I best do that.. __________________ My Flickr :: Bit-tech Flickr Wii: 1792 1527 2926 7945 :: Xbox Live: BioSnipr :: PSN: Biosnipr

2nd Oct 2006, 10:43	#6
BioSniper I Mod, Therefore I Own Join Date: Feb 2002 Location: Somewhere in the south Posts: 3,460	Worst part though spec is if you read the whole article on Zdnet they apparently know of 30 unpatched issues but they aren't willing to disclose them to the Mozilla team and instead wish to use them to their own advantage when they could be earning $500 per exploit under the bounty system the team has.. Kinda sad really. __________________ My Flickr :: Bit-tech Flickr Wii: 1792 1527 2926 7945 :: Xbox Live: BioSnipr :: PSN: Biosnipr

2nd Oct 2006, 12:52	#13
ajack rox Join Date: Apr 2003 Location: /home Posts: 2,696	Window Snyder is the best name ever. __________________ ajack.org DA \| Flickr select from pants;*

2nd Oct 2006, 11:58	#11
Laitainion Minimodder Join Date: Jan 2006 Location: Loughborough, UK Posts: 44	Given that the problem is a stack overflow, wouldn't turning on DEP (in Windows) or the appropriate feature for every other program prevent this from actually working? Assuming that a stack overflow is similar to a buffer overflow, which is what Data Execution Prevention is meant to prevent.

2nd Oct 2006, 12:41	#12
Emon Hypermodder Join Date: Jun 2004 Location: Cleveland, OH Posts: 672	At first glance I would have to call BS, since it's not possible for something to be "impossible to patch." It just doesn't make sense. Yes, difficult, perhaps not feasible in the face of a complete rewrite, but impossible? What? Without knowing the details of this exploit, which I'm too lazy to look into, I can't say anything assuredly. However I'd like to point out that just because an exploit exists, doesn't mean it's ever been used or that your previous browsing experiences haven't been more secure for using Firefox. Afterall, if the exploit was just recently discovered, and is quickly patched, what's the harm? I'm sure pro-MS zealots will use this as ammo against Mozilla, which I think is just a mistake. As is so often pointed out, it's not just the issue of exploits, but how well known they are and how quickly they are patched. OSS has a much better history of that than Microsoft. Oh, and for the record, I'm not some anti-MS or Linux zealot. MS makes some great products. .NET is completely amazing. I use Ubuntu Server on my personal web server and XP for all my workstations. Just trying to put myself in the clear to avoid possible derailination of this thread.

2nd Oct 2006, 13:06	#14
DougEdey I pwn all your storage Join Date: Jul 2005 Location: Southampton Posts: 13,933	There's a difference between patching and rewriting the javascript implementation, since this appears to be a fundamental flaw, its like having a problem with research, you have to restart from the beginning. __________________ Burnout: Paradise Stats!XBL: DougEdey Bindi PSN ID: DougEdey Twitter

2nd Oct 2006, 15:47	#15
trailblazer Multimodder Join Date: Nov 2004 Location: uk Posts: 131	Interesting article.. There is an interesting article at http://arstechnica.com/news.ars/post/20060925-7818.html. Looks like opera is the clear winner, although not perfect.

2nd Oct 2006, 16:28	#16
Cthippo Can't mod my way out of a paper bag Join Date: Aug 2005 Location: Bellingham, WA Posts: 4,473	Sounds to me like growing pains in the open source community. They have gone from being a nieche product to mainstream and are having trouble adjusting to all the attention, both from users and from attackers. I think in the end Open source is the best model for software develpment, especially from a security standpoint, but because of it's more diffuse organization it will take longer for the development base to change and adapt. __________________ Notice: If we see you flaming we will assume you are on fire and take appropriate measures - The Bit-Tech Fire Brigade.

2nd Oct 2006, 16:58	#17
trailblazer Multimodder Join Date: Nov 2004 Location: uk Posts: 131	Firefox... The general perception was that while Firefox had a small user base it would be left alone by hackers, but, if/when it started to become popular they would look for vulnerabilitys in the software. Looks like they are tearing it to bits, worse still, saying that the code is a mess and may be a challenge to fix. Until then,I will use Opera, if it works and is reasonably secure, that's fine by me. I am no fan of any particular web browser.

2nd Oct 2006, 17:26	#18
sadffffff Hypermodder Join Date: Oct 2003 Location: sadffffff Posts: 676	as much as i would love to point at this and be all like "hahahah, take that firefox fanboys, browser's not so secure now is it!" i really cant. i mean, my attitude has always been, "youre too paranoid" these exploits will never get you unless youre visiting some very questionable sites... IE hasnt failed me yet. never get any adware/spyware/viruses etc etc.. just be carefull and about any browser will work, despite SECURITY ISSUES OMG NO!!! so basically, meh... i assume that by "unpatchable" they mean that patching it would actually have to be a total rewrite.. like the way they implemented java is wrong in the way they wrote it, so to fix it they have to write it differently.

2nd Oct 2006, 17:41	#19
Cobalt Multimodder Join Date: Feb 2006 Location: Surrey, UK Posts: 248	I have never faced any of these kind of attacks with any browser. I really don't see where the attacks come from because I don't know of anyone who has been attacked. Even if hackers write the attacks, who is going to use them? Any sites that wish to cause harm will still be attacking IE becuase it is used by more people. Added to that, the type of people who use FF are more careful in their browsing habits anyway. Technology isn't the only factor to consider when looking at security. The human side of things is much more important.

2nd Oct 2006, 19:22	#20
Lazarus Dark Supermodder Join Date: Apr 2006 Location: US Memphis, TN Posts: 292	if i turn off javascript, how will that affect my browsing? __________________ My gun kata is greater than your kung fu.