Slashdot Mirror

← Back to Stories (view on slashdot.org)

Korean Mozilla Binaries Infected

Posted by CmdrTaco on from the caught-with-their-pants-down dept.

Magnus writes "Korean distributions of Mozilla and Thunderbird for Linux were infected with Virus.Linux.RST.b. This virus searches for executable ELF files in the current and /bin directories and infects them. It also contains a backdoor, which downloads scripts from another site, and executes them, using a standard shell."

50 of 592 comments (clear)

  1. Virus data by NoInfo · · Score: 5, Informative

    This virus has been in the wild since at least early 2002.

    Here's Symantec's take on the virus:

    http://securityresponse.symantec.com/avcenter/venc /data/linux.rst.b.html

    --
    bug.gd: error search engine. Humanity working together to solve all errors.
    1. Re:Virus data by _bug_ · · Score: 5, Insightful

      That's odd... I learned here that Mozilla is clearly more responsive to security bugs than Microsoft. What gives?

      You mean besides the fact that the binaries were removed as soon as they found out?

    2. Re:Virus data by DigitumDei · · Score: 3, Insightful

      I believe the point is if MS did this, it wouldn't matter how fast they removed the infected binaries, there would be a string of posts pontificating on how this clearly demonstrates linux/firefox as superior. And they'd all be modded +5.

      Of course saying the reverse here will quickly get you troll/flamebait/overated down to -1.

      --
      East Coast Brewers
    3. Re:Virus data by boaworm · · Score: 5, Insightful

      If you've read TFA, you'd know that this has virtually nothing to do with mozilla or OSS.

      A third party, a mozilla fan site in korea, distributed infected binaries.

      If you find an infected version of Winzip on an internet site, would you blame Winzip.com ?

      --
      Probable impossibilities are to be preferred to improbable possibilities.
      Aristotele
    4. Re:Virus data by GreyPoopon · · Score: 5, Insightful
      I believe the point is if MS did this, it wouldn't matter how fast they removed the infected binaries, there would be a string of posts pontificating on how this clearly demonstrates linux/firefox as superior.

      Let's compare apples to apples here. If MS was offering infected binaries form one of THEIR sites, yes, we'd be jumping down their throat. On the other hand, if MS decided to let Download.com distribute versions of a "freeware" application (like Messenger), and the binaries on Download.com were infected, most of us would just be avoiding Download.com like the plague. Sure, some people would still blame Microsoft, just as some people are going to blame Mozilla here.

      Now, having said all of that, I'll bring up the question of accountability. Since Mozilla is being distributed by public mirrors, it's probably a REALLY good idea to have some sort of guidelines that need to be met by the administrators to make sure this doesn't happen on a "Mozilla-certified" mirror. Maybe this is already in place.

      --

      GreyPoopon
      --
      Why is it I can write insightful comments but can't come up with a clever signature?

    5. Re:Virus data by SimGuy · · Score: 5, Insightful

      And sadly, Linux administrators have been unable to suitably protect their systems in all this time, so it continues to be a pain in the ass, never really going away. I work for a hosting company, and I've dug Linux.RST.b out of too many servers.

      I think too many Linux admins don't believe there's such a thing as a Linux virus. Usually the easiest way to recognize the infection is if a large number of common programs in /bin like "grep" start crashing. Tends to make boot up and shutdown clumsily fail.

      --
      I don't care, but don't let that stop you from trying to tell me anyway.
  2. So let me get this straight... by SpocksLoveChild · · Score: 5, Funny

    it's a virus?... for linux? I'm sorry but just don't understand the situation?

    1. Re:So let me get this straight... by Anonymous Coward · · Score: 5, Funny

      No worries. That is common for most slashdot readers.

    2. Re:So let me get this straight... by Crusader7 · · Score: 4, Interesting

      That's because viruses on Linux are so rarely reported due to their limited scope of effectiveness. Since Windows is more popular in the combined server and desktop markets, outbreaks cause significantly more damage (though I'm willing to bet the damage caused per exploited system is a far lower average than the lower volume, but higher cost server attacks that UNIXes more often suffer). In addition, Windows users tend toward not being so, how to put it nicely, interested in learning the proper maintenance of their systems (hey, I'm not complaining, doing it for them pays my bills), so they tend to frequently get infected by things that don't exploit security holes in the systems but rather excess holes in the heads of the users.

      Compare to Linux in which most exploits are a result of actual security problems in either the kernel or the supporting applications, and you have less widespread attacks that affect fewer systems.

      Difference in market shares, my friend. If you want to exploit a Linux system you're probably an attacker targetting a specific network and installation for a very specific purpose (making this attack something of an oddball). If you're looking to exploit a Windows system, however, you're more likely just a general Internet thug trying to install spam bots and backdoors on home machines. The latter causes more problem since the target is a much, much larger pool of users, so the latter gets more heavily reported even though the targetted attacks usually cause more on-average damage.

    3. Re:So let me get this straight... by glesga_kiss · · Score: 4, Insightful
      That's because viruses on Linux are so rarely reported due to their limited scope of effectiveness.

      That's a falacy. Linux is just as vunerable to trojaned installers as any other OS. You install mozilla as root, right? Debian apt runs as root, so you'd better be trusting those apt repositories, and all of the contributers.

      OS security does help against worms and other methods of infection, but dealling with trojans is a 90% user function. This improved security, along with market share (as you point out) is what makes Linux "safer". To get a virus on Linux, you essentially have to do something wrong yourself. Which is no consolation to the gran and grandpa users, "Download Weather Bar (linux version) popups" are only a few years away...

    4. Re:So let me get this straight... by ivan256 · · Score: 3, Informative

      Debian apt runs as root, so you'd better be trusting those apt repositories, and all of the contributers.

      Since official debian packages are signed, it's easy to trust the repository and the contributers due to the magic of the PGP web of trust and the Debian developer vetting process. It's not like you're installing software from some random people you don't know, and it's certainly not like the mirror you use could be compromised as long as the signature is valid.

      You install mozilla as root, right?

      Is somebody forcing you? I never install as root if the package didn't come from a trusted location. If I want to test a nightly, even the binary tarballs from mozilla.org go in my user directory, and aren't installed system wide.

      It's the dumb user that's vulnerable, not the OS. That's equally as true for Windows as it is for Linux.

  3. Everything is vulnerable. by bugbeak · · Score: 3, Informative

    Guess anything that can be programmed is also vulnerable, regardless of how impenetrable it is.

  4. Ha. by Anonymous Coward · · Score: 5, Funny
    So much for OSS security. Show me one instance of this happening to Microsoft...

    Oh, wait.

  5. Korean Mozilla Binaries Infected by Anonymous Coward · · Score: 5, Funny

    Birdflu ?

  6. And so it begins... by eno2001 · · Score: 4, Insightful

    ...expect to see more of this as the popularity of OSS continues. Of course, unlike Windows it won't get far since MOST users are smart enough to not be running as root.

    --
    -"...bad old ideas look confusingly fresh when they are packaged as technology" - Jaron Lanier (Digital Maoism on Edge.o
    1. Re:And so it begins... by arkanes · · Score: 4, Insightful

      User-friendly distros (like Ubuntu), borrow a page from OSX and don't even expose the root account. You create a user account in setup, you're prompted for your admin password when you need to install stuff, and when you use the CLI you use sudo. Therefore, without taking proactive steps, it's not even possible run programs at root, and you have to go well out of your way to log in as root.

  7. Black day for Unix Firefox users by teslatug · · Score: 5, Informative

    A new flaw affecting Firefox users under Unix allows webmasters to craft a URL that when run from an application like Evolution can execute any command. The flaw stems from the use of backticks in the shell script used to launch Firefox. Read more about it here on the Secunia advisory. Version 1.0.7 fixing the flaw is already out.

  8. source? by mmkkbb · · Score: 3, Informative
    Where does this information come from? I can't find any corroborating story from another source. However, I did find this bit of trivia here:
    Those hackers could just as well have served people distributions of Firefox infected with a virus.

    They could have easily replaced the app signatures to match the infected binaries.
    --
    -mkb
  9. Let the thrashing begin! by smooth+wombat · · Score: 3, Insightful

    I can hear it now; "See, FF isn't as secure as its supporters claim it is."

    Whatever.

    Considering this only affects one operating system (Linux) and occured in only one area of the world (Korea), despite this flaw it's still a whole bunch better than getting an update for IE our Outlook and having everyone who uses Windows, regardless of where they are in the world, being infected.

    --
    We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
  10. Poor Koreans... Again... by dtfinch · · Score: 3, Funny

    First the unofficial Korean Mozilla site in July, and now long obsolete versions of the Korean Mozilla (not Firefox) and Korean Thunderbird builds. I doubt anyone was infected, nor was that likely the intent, especially given the old, neither stable nor current, version numbers, but one thing is clear. Someone out there really doesn't like Koreans.

  11. Re:Secure.. by Anonymous Coward · · Score: 5, Informative

    Actually Linux is more secure. If you run mozilla as a normal user, then mozilla and the virus can't write to the files in /bin, and therefor can't do any really servere damage.

  12. Permissions? by InternationalCow · · Score: 3, Insightful

    Well, the symantec description wasn't very useful to me. But if I read it right, the virus tries to infect /bin. But iirc it will have to be run with root privileges in order to be able to infect /bin. Dunno about you guys, but I never ever unpacked firefox builds into my home directory when running as root. Basic security. So, if I understand this correctly, it only infects /bin when you've been sloppy. Not much of a threat, is it?

    --
    ----- One learns to itch where one can scratch.
  13. Um... by Noksagt · · Score: 4, Insightful
    Of course, unlike Windows it won't get far since MOST users are smart enough to not be running as root.
    Most users still install software as root & even if they don't, the user usually has access to /bin & would be able to run scripts.
    1. Re:Um... by Lussarn · · Score: 4, Insightful

      Most of all programs in Linux, about 99.99% is distribution supplied and isn't likely to have virus/trojan/spyware in them.

  14. Re:6 stories down on the front page by dtfinch · · Score: 3, Informative

    If you're talking about mozilla.or.kr, the Mozilla Foundation does not own or control that site.

  15. Infecting /bin? by Danathar · · Score: 5, Insightful

    I'm assuming this can only occur if you installed the virus infected material as root?

    Nothing new here....if you install software as root from a compromised source and don't check the md5sums along with other precautions you put yourself at risk

    1. Re:Infecting /bin? by Zathrus · · Score: 3, Insightful

      I'm assuming this can only occur if you installed the virus infected material as root?

      Last I checked all the major repository systems (rpm, apt, etc) require you to do so. Yup.

      if you install software as root from a compromised source and don't check the md5sums

      Checking the md5sums will do you absolutely no good unless you get the md5sum from a completely independant source -- which isn't true in most cases. In this case there was no independant source -- the Korean site compiles it and distributes it themselves and is not affiliated with the Mozilla foundation.

      along with other precautions you put yourself at risk

      My, that's nebulous. What precautions?

      You could compile from source... and then you're safe as long as someone didn't trojan the CVS server (either intentionally or maliciously). Or are you going to evaluate every line of code prior to compiling it as well? Make sure to double check your compiler and libraries -- if they have a trojan injector then you'll have one hell of a time figuring that out.

      No, it's not anything new. But it should be a wakeup call to a lot of people who think they're "safe" for running non-mainstream software. We're not -- we're just a smaller target. It's just a twist on "security through obscurity", and that's been proven to be inadequate countless times.

  16. OK, if you know *anything* about Linux by Shaman · · Score: 3, Interesting

    Then you'll know this virus was distributed on purpose or the core distribution was hacked and the hackers distributed it on purpose.

    You'll also know that the virus isn't infecting *anything* unless you're running as root or you're using a version of kernel and glibc that have specific flaws to allow the virus to do something as a regular user. Are they using a kernel and software from 2001? Maybe, for all I know, but that's pretty irresponsable if they are.

    This is such a non-issue for anyone except the stunned distributor that sent around the CDs. Not the first time it happened to the Windows world, either.

    --
    ...Steve
  17. Re:Secure.. by Wierd+Willy · · Score: 3, Insightful
    And they said Linux is more secure than Windows..


    It is. The fact that the only way for it to be effective is to pre-infect the original distribution. Which means someone miscopulated the canine. Still cant get around human fallibility in that regard.

    Linux is still much more secure in its raw state than almost any closed-source product even after post-install configuration. Anyone with a modicum of experience with a fresh *nix installation will likely spot this before it does any real damage.

    Suppose it was only a matter of time before someone figured this out though. Goes to show you, it is not a good idea to hook any system up to a network or the web before you finish the basic post-install configurations.
    --
    Stupid Humans.....
  18. Re:First time real-world linux virus spread? by imr · · Score: 3, Insightful

    Where does it says it spread?
    It is a 3 years old thing and it never spread, why should it now?
    It has been found somewhere on some server in some package.
    OK, then?

    Distros build their version of softwares from source, they check the sources, their users get their software from their distro.
    End of the story.

    Moral of the story:
    -don't download binaries from other sources than your distro.
    -don't install binaries from other sources than your distro as root.

  19. No, no, no... Windows is as secure. by MyTwoCentsWorth · · Score: 3, Informative

    Since if you run it as a normal user on Windows it cannot damage the system files either :)

    1. Re:No, no, no... Windows is as secure. by arkanes · · Score: 5, Funny

      No, Windows is more secure because you can't write to a binary thats being executed or has been loaded by another process. Viruses can only infect your system files if you reboot!

  20. Re:6 stories down on the front page by tpgp · · Score: 5, Informative
    "Mozilla hits back at browser security claim"

    Funny? Yes. True? No - you see its not exactly a mozilla problem.

    Whilst searching for more information about this, I stumbled across this pagelast time these servers were hacked in June).

    Choice quote:

    Unlike Mozilla Europe, Mozilla Japan and Mozilla China, the Korean Mozilla site is not officially affiliated with the Mozilla Foundation.


    So, its not mozilla.org (the article states "on public servers. Mozilla.org is the latest example")

    Its someone who's taken the mozilla source and made their own binaries. A problem yes, a serious problem even, but not to the scale that Kaspersky Labs would have us believe.

    Who would have thought it? A security company overhyping an issue!

    I'm not sure why they bother. Do they really think stories like this are going to make linux users go and buy their security 'solution'?
    --
    My pics.
  21. Normal installation runs binaries as root by Bogtha · · Score: 4, Informative

    Before everybody starts pointing out that they don't browse the web with their root account, and so can't write to any of the binaries on their system, you should be aware that one of the infected files is the installer - which most people do run as root.

    Also, even if you don't run the installer binary, but simply unpack the tarball manually, the release notes tell you to run included binaries as root as part of the normal multi-user installation process.

    --
    Bogtha Bogtha Bogtha
  22. Re:Virus data - It's old! RTFM by Anonymous Coward · · Score: 4, Informative

    If the poster would have read and UNDERSTOOD the original article, he would have realised that it was only a general hint about dangers that can happen when you dowload binaries. He refers to an OLD mozilla security breach (check out the version numbers).

    "Infected binary or source code files aren't anything new. And sometimes they are found on public servers. Mozilla.org is the latest example.

    Korean distributives for mozilla and thunderbird for linux turned out to be infected - mozilla-installer-bin from mozilla-1.7.6.ko-KR.linux-i686.installer.tar.gz and mozilla-xremote-client from thunderbird-1.0.2.tar.gz were infected with Virus.Linux.RST.b"

  23. Linux.RST.B was not effective virus in 2002 by Anonymous Coward · · Score: 3, Informative

    This Linux virus was not effective virus in 2002. It is even less effective now. The firefox was about 2 version old, so the infection rate is extremely low.

  24. Tinfoil shoes? by bitslinger_42 · · Score: 5, Insightful

    OK, really paranoid, conspiracy-theory thought here... Yesterday, Symantec, a vendor with an AV product, releases a report claiming that Mozilla is not as secure as IE. Today, a news story comes out that a download of Mozilla from some website in Korea has been trojaned. Anyone else wondering if Symantec placed the infected files in Korea to boost sales of either their Linux AV product (haven't checked to see if there is one yet) or their security consluting services?

    My late-night googling skills are failing to find a reference, but I remember some stories from a couple years back about AV companies writing and releasing new viruses to pad their list of known viruses. If that was true, then I wouldn't put a stunt like this past them.

  25. Alan Cox was right by Saunalainen · · Score: 5, Insightful
    Yet another example of the lamentable state of modern computer security. This wouldn't be a problem if operating systems required a trusted signature for software to be installed.

    I use a lot of OS software (e.g. Firefox, NeoOffice/J, LyX, R), but the standard installation process on my platform (OS X) does not allow checking for an authentic signature. Why is this not built in? It doesn't have to be this way: for instance, Red Hat signs its own RPMs (though Debian's APT didn't support this last time I looked).

    We already have to trust the developers. We shouldn't have to trust every FTP server too.

    1. Re:Alan Cox was right by seifried · · Score: 4, Informative

      Uhh every major RPM based distro (Red Hat, SuSE, Mandriva, Trustix, etc, etc.) does this. Third party guys like Dag who distribute literally hundreds pf RPM's also sign their packages (thus if I have Dag's key I can verify his RPM's regardless of where I actually get them. In RPM based systems adding a key consists of:

      Download the key (RPM-GPG-KEY-fedora for example)
      rpm --import RPM-GPG-KEY-fedora

      And voila. This works for third party developer's keys.

      As for your other comments they are just misinformed, you should read the article maybe. Or not and justmake stuff up, that works too.

  26. Re:6 stories down on the front page by ifwm · · Score: 3, Insightful

    One of the reasons that people supported Linus trademarking Linux was to prevent other people from releasing buggy code.

    How is this different?

  27. If Microsoft did it, it would be Microsoft. by khasim · · Score: 5, Insightful
    I believe the point is if MS did this, it wouldn't matter how fast they removed the infected binaries, there would be a string of posts pontificating on how this clearly demonstrates linux/firefox as superior. And they'd all be modded +5.
    If Microsoft distributed infected binaries, then it would be Microsoft distributing infected binaries.
    Of course saying the reverse here will quickly get you troll/flamebait/overated down to -1.
    You do realize that you're completely wrong.

    This is not about Mozilla distributing infected binaries. Mozilla did not. If they had, your analogy would be correct.

    This is about a 3rd party site distributing binaries of compiled Mozilla code that were infected.

    The only Microsoft comparision that can be made would be if HP (or some OEM) shipped WinXP computers with a virus.

    The real question is how did that virus get there in the first place. It's been around for a while but it doesn't spread.
  28. You don't understand "vulnerable". by khasim · · Score: 4, Insightful

    Writing a virus for Linux is easy.

    Getting that virus onto someone else's box is very difficult.

    Getting that virus to spread from that box is even more difficult.

    Linux viruses have an infection rate that is lower than their removal rate so they die in the wild.

    The real question is how did that virus get into that code? Linux viruses tend to have total infection numbers of less than 100 machines.

  29. no surprise by burnin1965 · · Score: 5, Informative
    The web site was hacked 3 months ago and back then they admitted the site was not an official Mozilla site.

    http://www.mozillazine.org/talkback.html?article=6 771


    Sorry for hack.
    by channy

    Thursday June 9th, 2005 6:39 PM

    Reply to this message

    This is Channy Yun, leader of Mozilla Korean Community. This site is not official web sites of Mozilla Foundation. And this hack is orginated by no patch for PHP vulnerability of my hosting company for mozilla.or.kr. I will change it with backup and fix it with my ISP. Sorry for your worry.


    I'm thinking they should give up their domain which likely causes the confusion and give the false impression that what you are downloading from the site is an official Mozilla binary.

    burnin
  30. Re:Virus data - It's old! RTFM by NickFortune · · Score: 4, Interesting
    "Infected binary or source code files aren't anything new. And sometimes they are found on public servers. Mozilla.org is the latest example.

    mmm... So do you not think the phrase "Mozilla.org is the latest example" is a just the teeniest bit misleading in this context? You know, what with most people taking "latest" to mean "happened very recently" as opposed to "even so, there hasn't been one for simply ages so I wouldn't get too worried".

    Not that anyone would do such a thing deliberately, of course... Except I can't help wondering how many people pondering a change away from Windows/IE will read that and form a false impression of Mozilla and Linux.

    Now who could that benefit, I wonder...

    --
    Don't let THEM immanentize the Eschaton!
  31. Mozilla.co.kr by frankie · · Score: 4, Interesting

    The Mozilla foundation needs to pursue strong, immediate public action against NKing.com, holders of the mozilla.co.kr domain. Using the Mozilla name connotes official status, and they are trashing it badly. I would say stop releasing Korean builds until the domain is handed over to more responsible people.

  32. See, Windows is more secure by doublem · · Score: 4, Funny

    See! Windows and IE ARE more secure!!!

    MWHAHAHAHAHA!!!!!!!!!

    The larger number of exploits in Firefox is just the tip of the ice berg!

    Open Source, you are going DOWN!

    And I for one, welcome our new DRM laden overlords.

    Oh, wait, they're not NEW overlords, they've been the overlords for a few decades now.

    Well, I welcome them anyway.

    --
    "Live Free or Die." Don't like it? Then keep out of the USA
  33. Apples to Apples? by Greyfox · · Score: 4, Insightful
    Ok, to get infected on Linux you have to download and install binaries from untrusted third parties and run as root all the time.

    To get infected on Windows you... have to turn the system on. As far as I can tell.

    Sure a lot of Windows infections are because the user downloaded and installed binaries from untrusted third parties, but equally as many just turned their computers on.

    If you ran untrusted binaries on your Apple you'd be exposing yourself to similar risk. Hell, we used to have the same problem on IBM mainframes back in the '80's -- every year around chistmas time all the freshmen would run those greeting card programs in their in-boxes and bring the network down as the trojan spread itself to everyone in their address book. Windows just eliminates a lot of the work for you.

    As the Linux userbase expands into increasingly less clueful segments of the population compromised systems are going to be more of a problem, but I predict that even if the installed Linux base ever grows to the size that Windowss is, the problem won't be as severe as it is on Windows. Unless everyone's running Lindows...

    --

    I'm trying to teach myself to set people on fire with my mind... Is it hot in here?

  34. It's about freaking time... by ndogg · · Score: 4, Funny

    It's about freaking time virus writers started supporting Linux and Mozilla...

    Err, wait...

    --
    // file: mice.h
    #include "frickin_lasers.h"
  35. Because you cannot ... by khasim · · Score: 4, Informative
    Care to support that assertion with some solid facts and numbers?
    http://securityresponse.symantec.com/avcenter/ve nc/data/linux.cheese.worm.html

    http://securityresponse.symantec.com/avcenter/venc /data/tfn2k.html

    http://securityresponse.symantec.com/avcenter/venc /data/linux.adore.worm.html

    http://securityresponse.symantec.com/avcenter/venc /data/linux.hijacker.worm.html

    http://securityresponse.symantec.com/avcenter/venc /data/linux.jac.8759.html

    You see? All but one had "number of sites" between 0 and 2.

    They
    Do
    Not
    Spread

    Linux's security model is far more effective than Microsoft's one for Windows.

    Anyone can write a virus/worm/trojan for Linux, but they cannot get them to spread beyond any machine that they themselves do no have access to.
  36. Re:6 stories down on the front page by rpdillon · · Score: 3, Interesting
    First, you can read Mozilla's policy on using the name "Mozilla" in domain names:

    If you want to include all or part of a Mozilla trademark in a domain name, you have to receive written permission from Mozilla. People naturally associate domain names with organizations whose names sound similar. Almost any use of a Mozilla trademark in a domain name is likely to confuse consumers, thus running afoul of the overarching requirement that any use of a Mozilla trademark be non-confusing. If you would like to build a Mozilla, Firefox Internet browser or Thunderbird e-mail client promotional site for your region, we encourage you to join an existing official localization project.
    source

    So Mozilla does state a policy regarding exactly what has occurred here. The problem is, U.S. trademark laws don't have any teeth in Korea. In fact, there is a U.S. government-run site that goes into great detail about how companies that have registered trademarks in the U.S. should not try to do business in Korea (or enforce their trademarks, of course) until they have registered their trademark in Korea, as well:

    Basic intellectual property laws exist in Korea. However, protection of intellectual property and the laws governing enforcement of these protections are not necessarily extra-territorial. What is understood and practiced in the United States is not always practiced in Korea. U.S. companies wishing to sell their products or services in Korea should first and foremost find out if they have to register their intellectual property rights (copyright, trademark or patents) in Korea...One of the most frequent IPR problems facing U.S. businesses in Korea is trademark protection.
    source

    Now, the last piece relates to trademark use by localization teams. The site distributing the binaries was in fact run by a Korean Firefox localization team, however, Mozilla has yet to refuse their right to use the trademarks, as per Mozilla Foundation policy, which allows use by localization teams in general, and rejects only in specific instances:

    It is very important that Community Releases of Firefox and Thunderbird maintain (or even exceed!) the quality level people have come to associate with Mozilla Firefox and Mozilla Thunderbird. We need to ensure this, but we don't want to get in people's way. So, we are taking an optimistic approach. Official L10n teams can start using the "Firefox Community Edition" and "Thunderbird Community Edition" trademarks from day one, but the Mozilla Foundation may require teams to stop doing so in the future if they are redistributing software with low quality and efforts to remedy the situation have not succeeded. Doing things this way allows us to give as much freedom to people as possible, while maintaining our trademarks as a mark of quality (which we are required to do in order to keep them).
    source

    I'll readily admit that I have no idea whether Mozilla has attempted to reject their right to use the Mozilla trademark, but given the warning found on U.S. government sites regarding trademark enforcement, I'd say it would be prodigal use of the foundation's limited resources. Further, there is nothing to indicate that there is in fact any "affiliation" whatsoever, as nowhere does Mozilla Foundation acknowledge the presence of the Korean site (although its URL does appear on a Mozilla-run wiki - who knows who put it there).

    In any case, this reflects poorly only on the part of the Korean Localization Team, as Mozilla Foundation likely lacks the resources to succesfully pursue a trademark infringement case abroad in Korea, and we have already established that the site is not an official Mozilla site (unlike, for example, http://www.mozilla-europe.org/ or