Firefox Zero-Day Code Execution Hoax?

Akon writes, "eWeek is running a follow-up story on the claim by two hackers that Firefox's implementation of JavaScript is critically flawed and could result in code-execution attacks. Turns out this is a possible hoax that was overblown for laughs." Mozilla's engineers say the risk is limited to a denial-of-service issue. From the article: "'As part of our talk we mentioned that there was a previously known Firefox vulnerability that could result in a stack overflow ending up in remote code execution. However, the code we presented did not in fact do this, and I personally have not gotten it to result in code execution, nor do I know of anyone who has... I have not succeeded in making this code do anything more than cause a crash and eat up system resources, and I certainly haven't used it to take over anyone else's computer and execute arbitrary code,' Spiegelmock said." Spiegelmock also stated that the claim that there were 30 other undisclosed exploits was made solely by his co-presenter, Andrew Wbeelsoi.

Comments

...crash and eat up system resources...

[RHIC]

No change there then.

Microsoft link?

[masklinn]

This is to be taken with a grain of salt and not as a proof of anything until further inquiries, but since it's going to be posted anyway it may as well be posted with some warnings:

A blog called Geemondo also reports that Mischa Spiegelmock seemed to have had dinner with Microsoft guys.

(PS: mods, if you want this post to be seen without me karma whoring, just mod it funny)

Not a funny joke

[loconet]

There is also a post about this on the Washington Post. Apparently, they were just having fun?

If I was Alistapart, I would have gotten rid of this "clown" immediately.

Re:Moo

[masklinn]

Anyone who releases it on their own is sued for copyright violations.

Actually not, it's trademark violation, and it's only if you release it under the name of "firefox". Call me the day when I can fork Internet Explorer and release my patched version as "Intarweb Implorer" without getting sued though.

Re:Great!!

[__aaclcg7560]

Be happy. It could've been worst and happen on Internet Explorer instead.

Re:It's all fun and games until someone gets hurt

[Anonymous Coward]

It was painfully obvious to anyone at the presentation that the whole thing was a joke. It was the best presentation I saw at Toorcon just for the hilarity factor. If they were talking at any other convention I'd go see them again.

Most of the press got the joke, laughed, and ignored it. It was some tool at CNET's fault for compromising his journalistic integrity and reporting satire as fact that caused the problem.

Moo

[Chacham]

FireFox has no exploits. All exploits are actually in IceWeasel, to avoid legal action from Mozilla.

In other news, Microsoft has said thet their version of Genuine Internet Explorer has no bugs, and any bugs, must be due to a bad download, or user tampering. As such, all user installs of Internet Explorer will be renamed to "Meshed-Screen Interpolated E-reader" (MSIE for short), and will subsequently be subject to licensing fees.

Then it wasn't painfully obvious enough

[davidwr]

If the CNET folks didn't get it, the panel should've made sure they did.

Any prank like this NOT done on 1 April needs to end with "and for those of you who left your sense of humor at home, the preceeding presentation was 100% pure entertainment and any resemblance to reality was purely to tweak your nose. Please stay for the next panel on novel approaches to perpetual motion. Thank you."

Re:NoScript

[TheRaven64]

But...

But...

Web 2.0!

*splutter*

Re:Never believe anything without a second source

[gEvil (beta)]

Never believe anything without a second source

Anyone want to reiterate what he said so we can know that we should believe him?

Re:Never believe anything without a second source

[chroot_james]

I'll back him up. Kind of. I propose requiring a third source. Anyone want to reiterate?

Re:It's all fun and games until someone gets hurt

[Kelson]

The way this went down reminds me of an event from high school. Now, to put this in perspective, it was probably 1993, so about 5 years before Columbine.

There was a drama festival that our school attended each year, held at a nearby college. One year, one of our scenes involved prop guns. One of my classmates took one of the fake guns up onto a balcony, stood on the railing, and pretended he was going to shoot himself. Big surprise, campus security showed up, assuming he had a real gun and was really going to blow his brains out. The next year, the festival banned prop weapons. IIRC if you had a scene that needed them, you could sign up to use *their* props, which would be provided for the particular scene.

Had he done the same thing on stage, introduced as a monologue he had written, with people aware the gun was a prop, no one would have freaked out.

Back to the Firefox panel, I don't know how clearly this presentation was labeled as humor. But all it takes is someone who doesn't have the full context to take it seriously -- and security people have to take threats seriously, at least long enough to investigate and find out that the gun is just a prop.

He should be fired, prosecuted

[hyrdra]

Everyone here should read this article:
http://blog.washingtonpost.com/securityfix/2006/10 /zeroday_firefox_exploit_claime.html

It actually turns out that Mischa Spiegelmock and Andrew Wbeelsoi are closely related. As we all now know, Misa works for LiveJournal. Andrew Wbeelsoi is part of Bantown, who claimed responsibility for a Javascript attack on LiveJournal (see http://blog.washingtonpost.com/securityfix/2006/01 /account_hijackings_force_livej.html).

The two are obviously related, and LiveJournal should consider immediate termination of their employee Mischa, as he is in league with Wbeelsoi, who attacked LiveJournal members themselves.

Here as some nice quotes from the article:

"We do have exploits for all the stuff we're going to show you," the 21-year-old calling himself Wbeelsoi said. "We'll give them away to anyone who proves their actions are going to be politically motivated. We don't care what side you're on as long as you commit yourself to destruction."
"We were just trying to have some fun up there," Spiegelmock said.

Mozilla should really consider civil, if not criminal actions. Damage to the Firefox brand has already been done, regardless if the exploit is real or not.