Firefox Exploit in the Wild: Mozilla Patches With V39.0.3

Mozilla urges you update Firefox to V 39.0.3 immediately.

[engine]

Mozilla has moved swiftly to patch an exploit to Firefox which was discovered in-the-wild. The exploit, running from an advert on a news site, would search for sensitive files on a desktop machine and upload them to a server, which Mozilla says, appeared to be in Ukraine.

Mozilla urges you update Firefox to V 39.0.3 immediately.

The files it was looking for were surprisingly developer focused for an exploit launched on a general audience news site, though of course we don’t know where else the malicious ad might have been deployed. On Windows the exploit looked for subversion, s3browser, and Filezilla configurations files, .purple and Psi+ account information, and site configuration files from eight different popular FTP clients. On Linux the exploit goes after the usual global configuration files like /etc/passwd, and then in all the user directories it can access it looks for .bash_history, .mysql_history, .pgsql_history, .ssh configuration files and keys, configuration files for remina, Filezilla, and Psi+, text files with “pass” and “access” in the names, and any shell scripts. Mac users are not targeted by this particular exploit but would not be immune should someone create a different payload.
The exploit leaves no trace it has been run on the local machine. If you use Firefox on Windows or Linux it would be prudent to change any passwords and keys found in the above-mentioned files if you use the associated programs. People who use ad-blocking software may have been protected from this exploit depending on the software and specific filters being used. Firefox Exploit in the Wild: Mozilla Patches With V39.0.3 [blog.mozilla.org]

[Kendo]

Hmmm, Firefox 5 was a good vintage.

[Robert Charlton]

Thanks. FF generally makes it pretty easy to apply patches, and I updated this one immediately.

[graeme_p]

This is too much. From now on everything network facing runs with an apparmor profile enforced to partially sandbox this - and I may tighten the profiles a bit as well.

[IanCP]

I wonder how other Firefox users who aren't fans of WebmasterWorld will be alerted - I haven't seen any comment in Australian newspapers or other media.

[graeme_p]

Most people should get updates through whatever mechanism Firefox supports on their OS.

[IanCP]

I haven't seen a thing except for WebmasterWorld

[engine]

It's odd it hasn't got wider coverage, I agree. Try tweeting it and sending the WebmasterWorld Link :)

[Robert Charlton]

Just a guess that Mozilla may assume that most users have got FF set to update automatically. I forget what the default is; Mozilla probably knows. Depending upon your machine and the kind of work you do on it, though, this option can be disruptive.

There also was a time, I believe, when asking FF manually to check for updates would result in an automatic install if an update were present. The current version, at any rate, has the good manners to ask for permission before installing the patch.


PS: There is a Mozilla Security account on Twitter.... @mozsec ...Not much chance, though, that you're likely to catch a tweeted announcement.

You'd think that Mozilla would have figured out a non-intrusive way by now to flag users about security matters... but that's true of a lot of service providers and sites on the web... and, depending on the problem, it's not always simple for users to comply. In this particular case it is.

[IanCP]

Hooray, the story just made it to a Sydney newspaper 45 minutes ago.

[smh.com.au ]

[encyclo]

I got the update notification from Firefox well before I saw any news about the exploit. I don't think that newspaper reports are going to do anything to get the average user to update. The auto-update mechanisms in modern browsers (and in windows 10 for that matter) are huge steps forward for online security.

The exploit, running from an advert on a news site

Which is why you should always block all third-party ads on all websites and in all circumstances. :)

[graeme_p]

I got the update notification from Firefox well before I saw any news about the exploit.

Works as expected. That is how it is supposed to work - users should not be relying on the media to tell them to update.

The auto-update mechanisms in modern browsers (and in windows 10 for that matter) are huge steps forward for online security.

A rather late step: some of us have taken it for granted that the OS and all apps auto-update for a decade.

[engine]

I got the update notification from Firefox well before I saw any news about the exploit.

Interestingly, I left one of my machines on to see when it was going to update, starting FF every so often, and it took two days before the automatic FF update took place. That's too long, imho.

[IanCP]

My Windows 10 Laptop just updated to Firefox 40.0 plus showing a "commercial" page about Firefox and Windows 10 working together seamlessly yadda, yadda.

[RedBar]

Yeah, all my machines had notifications pop-up yesterday, it was a very small update whatever it was.

[engine]

Blink and you'll miss it, FF is now on V40.0

[IanCP]

Blink and you'll miss it, FF is now on V40.0

Was that Windows 10 or not? I ask because when I quickly updated as a result of this thread on Win 8.1 it only went to FF 39.3 [I think]. Having now gone to Win 10 yesterday, it updated to FF 40.0 The update was about 18 Mb from memory - hence the blink.

[engine]

Not Win 10, IanCP, Win 8.1 machine now has FF 40.0 on it.