Slashdot Mirror
Bugzilla Breached, Private Vulnerability Data Stolen
darthcamaro writes: Mozilla today publicly announced that secured areas of bugzilla, where non-public zero days are stored, were accessed by an attacker. The attacker got access to as many as 185 security bugs before they were made public. They say, "We believe they used that information to attack Firefox users." The whole hack raises the issue of Mozilla's own security, since it was a user password that was stolen and the bugzilla accounts weren't using two-factor authentication. According to Mozilla's FAQ about the breach (PDF), "The earliest confirmed instance of unauthorized access dates to September 2014. There
are some indications that the attacker may have had access since September 2013."
You just can't make this stuff up.
I've come to the conclusion that human nature just does not allow good security. If you make something completely secure, you've spent way too much time on it and your competitors have beat you to market. People don't care.
The most interesting aspect of this, in my opinion, is that once the vulnerabilities were known to not be private anymore, the vendor (Mozilla in this case) immediately fixed all of them. Some bugs had been open for over 300 days. What this says to me is that by keeping vulnerabilities private, it makes vendors lazy about fixing them, and is another data point in favor of the "full disclosure" model of computer security.
Protect your browser with the Force Safe Search add-on
Just one more reason to use Chrome. Firefox hasn't offered anything in years that Chrome doesn't do and does better, and since it's free and open source there's really no reason at all to stick with a legacy browsers.
Chromium is open source. Chrome is not.
Please update the article title, JFC.
da w00t. mtfnpy?
They hate us. You should never vote for someone that hates you.
People still use Firefox? ....No really, seriously.
Perhaps Mozilla discovered this long ago, but have spent all this time trying to ascertain the political opinions held by the attacker?
#DeleteChrome
My God! You idiot moderators! Can't you enjoy a little sarcasm every now and then? Stop being such politically correct morons!
I'm beginning to hate computers with a passion.
Nomen est Omen.
Gee Mozilla. Better get to work fixing those 185 vulnerabilities now, instead of sitting on them while you work on copying Chrome's look and feel or think of new unrelated tech ventures to get involved in.
Firefox isn't open source any more. If you were to build Firefox from source, you would be missing DRM modules and wouldn't be allowed to call it Firefox due to Mozilla's asinine take on trademark laws. Iceweasel is open source, Firefox is not.
greenwow is a troll that regularly forgets to check Post Anonymously. It is the way of their kind. The trolls.
got some bugs.
The most interesting aspect of this, in my opinion, is that once the vulnerabilities were known to not be private anymore, the vendor (Mozilla in this case) immediately fixed all of them
A better way of saying what really happened:
... is that once the vulnerabilities were known to not be private anymore, the vendor ... was forced to pull resources from more severe but still-believed-to-be-undisclosed bugs to get these patched, resulting in delays in getting those more-severe bugs fixed.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Given the nature of this breach, I think that Mozilla's only option is to perform a full security review of their entire infrastructure and all of their products.
I'm talking about every physical and virtual server that interacts with their network, including all servers, desktops, laptops and mobile devices. I'm talking about every software system, from Bugzilla to source repos to web servers to FTP servers to database servers to every other kind of software system they may be using.
I think that all of their products, including Firefox, Thunderbird and Rust, should also undergo a line-by-line security review to ensure that they weren't tampered with in any way.
The results should be presented to the public in a way that lets us know that they've done a thorough job of such a review, so that we can be confident that there are no more issues to be found.
Will it be costly? Probably. Will it take a lot of time and effort? Probably.
But if there was one breach, then I think we need some assurance that there weren't others. Given the nature of their products, and how critical security is to pretty much all of them, I think such a review is the only reasonable option.
Hi. I build firefox from source and call it Firefox all the time. So does the browser, because I enabled the --enable-official-branding flag in my build script.
Mozilla has a nasty habit of warehousing bugs that can't get fixed with the wave of a hand. that's why I quit the thing for Chrome a long time ago.
if this is supposed to be a new economy, how come they still want my old fashioned money?
... is crying.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
since it was a user password that was stolen and the bugzilla accounts weren't using two-factor authentication.
we're idiots.
So how DID you manage to build the closed source DRM modules that are required if you want to officially call your final product "Firefox"? Or did you just download them and use them that way? Firefox these days is exactly as open as Chrome is: you can build something that's almost the real thing from source, but you'll be missing "essential" components.
Is the hacker gay ? That should be only question they are asking now.
If it was a womyn, she should be given an award.
...this kind of thing will happen. Hopefully they're competent enough to fix it.
Twitter supports and protects racists - by smearing their critics with the "Hate Speech" label.
No open source project ever has let people use the exact same name for their fork due to trademark, and just outright the confusion it would cause..
Except for Linux.
The one bug that is known to have been exploited is a pdf.js vulnerability where a script can search and upload local files. Are they trying to check if it's really fixed?
Other then the die hard extension lovers who have always loved Firefox. I am not sure who else really thinks Firefox is worth even having on a device? Bugzilla
is a joke anyway and I see plenty of bugs get ignored which is why Firefox is so not loved by many anymore. How can you do so many updates and not really fix much?
The Fedora build of Firefox is certainly built from source. It is still called Firefox.
Fedora is discussing whether it is feasible to continue with Firefox-branded Firefox due to the new signed-addon policy. But for now, you can certainly get your open source Firefox fix that way.
Finally! A year of moderation! Ready for 2019?
And without Firefox lots of things Chrome/Chromium/Opera doesn't get to be standards.
Because it's Firefox (gecko) and Chrome/Chromium/Opera (blink) are ahead of the pack. You need at least 2 browser (engine) implementations to make a standard.
I would prefer multiple open source implementations and standards and not just a single open source implementation.
Standards is the only way how we can get rid of things like Flash.
New things are always on the horizon
In completely unrelated news their bank account was also breached when a literal ton of money was deposited by Five Eyes.
Why isn't this marked funny?
The code for the DRM module Firefox uses is not part of the Firefox build system, but is downloaded at runtime. This can be done whether it's a Firefox built by Mozilla or not. So the DRM question has no bearing on whether you can call your version Firefox or not.
This series of blog posts: http://blog.gerv.net/2010/01/p... explains why Mozilla doesn't let just anyone call their modified version "Firefox".
Gerv