Slashdot Mirror
Multiple Vulnerabilities Exposed In Pocket
vivaoporto writes: Clint Ruoho reports on gnu.gl blog the process of discovery, exploitation and reporting of multiple vulnerabilities in Pocket, the third party web-based service chosen by Mozilla (with some backslash) as the default way to save articles for future reading in Firefox. The vulnerabilities, exploitable by an attacker with only a browser, the Pocket mobile app and access to a server in Amazon EC2 costing 2 cents an hour, would give an attacker unrestricted root access to the server hosting the application.
The entry point was exploiting the service's main functionality itself — adding a server internal address in the "read it later" user list — to retrieve sensitive server information like the /etc/passwd file, its internal IP and the ssh private key needed to connect to it without a password. With this information it would be possible to SSH into the machine from another instance purchased in the same cloud service giving the security researcher unrestricted access. All the vulnerabilities were reported by the researcher to Pocket, and the disclosure was voluntarily delayed for 21 days from the initial report to allow Pocket time to remediate the issues identified. Pocket does not provide monetary compensation for any identified or possible vulnerability.
The entry point was exploiting the service's main functionality itself — adding a server internal address in the "read it later" user list — to retrieve sensitive server information like the /etc/passwd file, its internal IP and the ssh private key needed to connect to it without a password. With this information it would be possible to SSH into the machine from another instance purchased in the same cloud service giving the security researcher unrestricted access. All the vulnerabilities were reported by the researcher to Pocket, and the disclosure was voluntarily delayed for 21 days from the initial report to allow Pocket time to remediate the issues identified. Pocket does not provide monetary compensation for any identified or possible vulnerability.
There's a vulnerability in my jacket pocket too, it's called a 'hole'.
These seem like pretty basic things to get wrong.
Your hair look like poop, Bob! - Wanker.
Stop with the stupid integrated cloud services. It's a fucking web browser, if I want to use a web service I will GO THERE MYSELF.
I'm really old-style. I bookmark the sites I regularly visit and that's it. I don't need this level of "continuity" (also referencing the Apple feature).
Maybe I don't miss what I don't know or maybe I don't care about what I miss. Besides, these days web sites are mostly story aggregators so there's probably not a whole lot of original content to miss.
Quite simply: It's not Google.
Like all the other crap that's been added to our "browser", there should not be any default.
If you want to save a web page for later perusal on the same device, you can use Scrapbook Plus. It works. (If you want to install it on a recent browser and not an extended support release, scroll down and install from the development channel.)
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Am I missing something, or is there absolutely no point in this "Pocket" service? To save articles to read later? Isn't that what bookmarks are for? To save these across multiple computers? Chrome does that for me already... And I'm still not sure what they mean by making it readable offline later? Is it saving an entire copy of the article on the server? Wouldn't you still require ONLINE access to actually get these files or are they shadowed to your local device to?
If that's the case, there's this amazing "save as" option in most browsers, even "offline mode". None of these give anyone root access to anything. The thing is full of holes and apparently fills a niche for what, 1 guy too lazy to bookmark stuff? WTH
I don't get the point of this software at all. And I find it pretty insane that a system to merely let you save articles to read later would somehow gain root priv. What the heck is going on in the backend to allow that?
I'm getting to the point of just assuming that anything in the Cloud is insecure. That assumption makes security so much easier. There is no security.
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
Why is anyone still running Firefox?
I haven't met a privacy concern I can't address yet with Firefox, whereas with Chrome I can only cover about 50% of the issues. I don't agree with the Set of Recent Distraction Additions, but with Firefox I can at least get robust control over every bit of my browsing experience. [NoScript, Cookie Whitelist, uMatrix, +hosts blacklist, in case you were curious. No Adblocker required.]
Populus vult decipi, ergo decipiatur...
"Force shits upon Reason's back." - Poor Richard's Almanac
The backlash has caused Mozilla to take a step back and re-evaluate things. But is it too little too late?
To me it looks as if Mozilla is in circle the wagons mode, being super defensive across the board. Constructively critical reviews about add-ons are being removed, apparently to keep the ratings in the 4 to 5 range for add-ons. Messages documenting problems are being removed in the support forums. (I saw one message that described a problem similar to the one I was having. When I went back to re-read it a day later, it had been removed.)
It looks like Mozilla has made its transition to a bloated corporation complete. They now appear to be in the "control the message" mode of operation.
1) Plugin choice, 2) It's not (quite) corporate-ware like Chrome etc.
Table-ized A.I.
Alternatives? Chrome is even worse regarding it's update schedules. Anything from Microsoft is just right out and is unportable. Safari just feels wrong to me. The question is rhetorical though, I don't need to hear from the opera fans and advocates of something goofy. Firefox does the job, allows plugins to increase security and decrease malware, and is open source (but using idiot management, but that's true for all other browsers on the planet).
The word you're looking for is B-A-C-K-L-A-S-H. I think backslash is an alternate universe of Slashdot...
To Copy from One is Plagiarism; To Copy from Many is Research.