Slashdot Mirror
Firefox Zero-Day Code Execution Hoax?
Akon writes, "eWeek is running a follow-up story on the claim by two hackers that Firefox's implementation of JavaScript is critically flawed and could result in code-execution attacks. Turns out this is a possible hoax that was overblown for laughs." Mozilla's engineers say the risk is limited to a denial-of-service issue. From the article: "'As part of our talk we mentioned that there was a previously known Firefox vulnerability that could result in a stack overflow ending up in remote code execution. However, the code we presented did not in fact do this, and I personally have not gotten it to result in code execution, nor do I know of anyone who has... I have not succeeded in making this code do anything more than cause a crash and eat up system resources, and I certainly haven't used it to take over anyone else's computer and execute arbitrary code,' Spiegelmock said." Spiegelmock also stated that the claim that there were 30 other undisclosed exploits was made solely by his co-presenter, Andrew Wbeelsoi.
The first time that I actually started to worry that FF might have a problem, and that I should be careful, it turns out to be a hoax. I don't know whether to be happy about this or not?
Support NYCountryLawyer RIAA vs People
Or until someone wastes time taking you seriously.
Yelling "bomb" in an airport isn't funny. Neither is this.
Next time, make it painfully obvious you are joking so people don't waste valuable time.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
No change there then.
And, this should noted, this should NOT be limited to security exploits and hoaxes. It's twice as true for news that really matter. Too many people want to believe what they hear as long as it fits their personal point of view, without even questioning whether something is true or not.
As long as it fits into their view of the world, it becomes true for them and they perpetuate the lie.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
This is to be taken with a grain of salt and not as a proof of anything until further inquiries, but since it's going to be posted anyway it may as well be posted with some warnings:
A blog called Geemondo also reports that Mischa Spiegelmock seemed to have had dinner with Microsoft guys.
(PS: mods, if you want this post to be seen without me karma whoring, just mod it funny)
"The way we can tell it's C# instead of Haskell is because it's nine lines instead of two." -- wadler
There is also a post about this on the Washington Post. Apparently, they were just having fun?
If I was Alistapart, I would have gotten rid of this "clown" immediately.
[alk]
Actually not, it's trademark violation, and it's only if you release it under the name of "firefox". Call me the day when I can fork Internet Explorer and release my patched version as "Intarweb Implorer" without getting sued though.
"The way we can tell it's C# instead of Haskell is because it's nine lines instead of two." -- wadler
FireFox has no exploits. All exploits are actually in IceWeasel, to avoid legal action from Mozilla.
In other news, Microsoft has said thet their version of Genuine Internet Explorer has no bugs, and any bugs, must be due to a bad download, or user tampering. As such, all user installs of Internet Explorer will be renamed to "Meshed-Screen Interpolated E-reader" (MSIE for short), and will subsequently be subject to licensing fees.
Have you read my journal today?
I think that these two were looking for a little fame ... and did not realize how the professionals would react to their claims.
Once they realized that the professionals (who are better programmers than they) were looking into their claims, they fell back on the "it's a joke" claim.
You obviously don't use GMail,
You can use GMail just fine without JavaScript. It complains and writes you a message at the bottom of every page saying something like 'To take full advantage of Gmail, use a supported browser...'
It does however still work just fine without it.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
It takes a very rare and specific skill set to write a memory corruption exploit. The fact that one person was unable to go from overflow to arbitrary code execution proves absolutely nothing about whether doing so is possible.
A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.
If the CNET folks didn't get it, the panel should've made sure they did.
Any prank like this NOT done on 1 April needs to end with "and for those of you who left your sense of humor at home, the preceeding presentation was 100% pure entertainment and any resemblance to reality was purely to tweak your nose. Please stay for the next panel on novel approaches to perpetual motion. Thank you."
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
"Madness is something rare in individuals - but in groups, parties, peoples, ages it is the rule." -- Nietzsche
But...
Web 2.0!
*splutter*
I am TheRaven on Soylent News
http://www.mozilla.org/projects/seamonkey/Seamonke y is currently using 351 MB of memory, according to Windows Taskmanager. That's after 5 days of uptime, and no exception. I know, it's not Firefox, but I suppose there is a large code base shared.
I bet you have few friends. :-(
Beware: In C++, your friends can see your privates!
These days, "0day exploit" seems to have changed to mean "an exploit for which there is currently no fix". Not quite the same...
[Slashdot requires you to wait between each successful posting of a comment to allow everyone a fair chance at posting a comment.
It's been 4 minutes since you last successfully posted a comment.]
It's official. Most of you are morons.
I'm with some of the folks here about secondary verification.
Something deep inside me gives a knee jerk any time a developer or product engineer starts any sentence with "I have not succeeded in making this code do..." or "I cannot reproduce..." (no pun intended).
I think Firefox is pretty good. So far (since the first public betas), I get very few issues at runtime (besides the occasional spin-forever cursor when Firefox encounters a site with some really bad browser-side code.)
A Passionate Independent Musician
Well seems like my notion was right after all.
They are nothing but sad wannabes, scriptkiddies who wanted to pose as l33t haX0rZ. Well, heads up guys, this will have been your last convention for quite some time because somehow quite unexpectedly (for you) most of the community didn't go "we really got punked!!! LOLOLOLOLOL! you win teh internets!" Bottom line. Don't be an asshole, or you will pay for it.
+++ MELON MELON MELON +++ Out of Cheese Error +++ redo from start +++
there's no apostrophe in A. Wbeelsoi.
It leads to a piece of JavaScript - either an attempted proof of concept, or just an annoying fork bomb - I didn't bother to work out which, but either way, I recommend sticking with "Save As" or wget or what have you.
Everyone here should read this article:0 /zeroday_firefox_exploit_claime.html
1 /account_hijackings_force_livej.html).
http://blog.washingtonpost.com/securityfix/2006/1
It actually turns out that Mischa Spiegelmock and Andrew Wbeelsoi are closely related. As we all now know, Misa works for LiveJournal. Andrew Wbeelsoi is part of Bantown, who claimed responsibility for a Javascript attack on LiveJournal (see http://blog.washingtonpost.com/securityfix/2006/0
The two are obviously related, and LiveJournal should consider immediate termination of their employee Mischa, as he is in league with Wbeelsoi, who attacked LiveJournal members themselves.
Here as some nice quotes from the article:
"We do have exploits for all the stuff we're going to show you," the 21-year-old calling himself Wbeelsoi said. "We'll give them away to anyone who proves their actions are going to be politically motivated. We don't care what side you're on as long as you commit yourself to destruction."
"We were just trying to have some fun up there," Spiegelmock said.
Mozilla should really consider civil, if not criminal actions. Damage to the Firefox brand has already been done, regardless if the exploit is real or not.
"I'll just chip in a bit for RedHat: I actually have that installed on my university machine." - Linus, '95
Actually, there's more than enough supposition to imply that SixApart's software is contaminated with trojans. Face it, you have someone who wants to claim they have a flaw, and they want to make a secret communications network. The best way to do it is to use sites like LiveJournal and people who use software like MovableType (both SixApart products) to distribute your exploit. What better way than to infect LiveJournal users and readers, and readers of sites using MovableType (and several other popular blogging software) to get them to be part of your network?
Heck, because of this we can probably issue a statement saying that all of SixApart's products and services may be contaminated with trojan horses. Which may infect all browsers, due to claim by a representative of SixApart. (He may not be the official spokesperson, but since he was introduced as coming from SixApart, he is a representative of the company). And until proven otherwise, all their products and services should be considered suspect, maybe even blacklisted. It is a credible claim, and if this is a hoax, well, who's to say it is or it isn't? Maybe if they claim it's a hoax, their backdoor will stay open.