News for hackers. Stuff that matters.

A comment on Mozilla patches Firefox zero-day abused in the wild.

Re:Mozilla patches Firefox zero-day abused in the wild by CryptoBard on Wednesday June 19, 2019 @02:37AM (#20221279)
Someone I know was hit by this in a very targeted attack on June 6th. They managed to capture the binary it dropped on their mac with some other gatekeeper bypass vulnerability (perhaps https://www.bleepingcomputer.com/news/security/new-unpatched...). It is a mac port of the binary discussed in this research paper by Exatel: https://exatel.pl/advisory/paranoicy-raport-socexatel.pdf
[ Parent | on HN ]
Re:Mozilla patches Firefox zero-day abused in the wild by sterlind on Wednesday June 19, 2019 @03:36AM (#20221505)
Sounds extremely targeted, if an attacker is porting the attack to Macs (presumably a lot of work), and combining it with other loaders... I wonder how long this 0-day was in the wild.

Your friend should probably be browsing as a non-admin in a continuously-reimaged VM, separate from an air-gapped machine, if you have those kinds of attackers after you. Spooky..

[ Parent | on HN ]
Re:Mozilla patches Firefox zero-day abused in the wild by saidajigumi on Wednesday June 19, 2019 @12:08PM (#20224561)
if an attacker is porting the attack to Macs (presumably a lot of work)

It's worth noting that a professional security and pentest company I know of had a Python-based exploit authoring DSL that automatically generated exploit code across a very wide range of processor architectures and OSes. This was about fifteen years ago.

[ Parent | on HN ]
Re:Mozilla patches Firefox zero-day abused in the wild by stcredzero on Wednesday June 19, 2019 @12:41PM (#20224859)
It's worth noting that a professional security and pentest company I know of had a Python-based exploit authoring DSL that automatically generated exploit code across a very wide range of processor architectures and OSes.

Makes sense. If entire OSes can be written in an intermediate representation, then exploits can be as well.

[ Parent | on HN ]
Re:Mozilla patches Firefox zero-day abused in the wild by kseifried on Thursday June 20, 2019 @12:07AM (#20229777)
You mean Core Impact? =).
[ Parent | on HN ]
Re:Mozilla patches Firefox zero-day abused in the wild by saidajigumi on Thursday June 20, 2019 @06:42PM (#20238125)
dingdingdingdingding!
[ Parent | on HN ]
Re:Mozilla patches Firefox zero-day abused in the wild by kchr on Wednesday June 19, 2019 @10:20AM (#20223586)
Just speculation, but "targeting" in this case may be as trivial as checking the user agent header, or other "device recognition" tricks common in web development nowadays. I am sure there are hundreds of libraries that do this for you...
[ Parent | on HN ]
Re:Mozilla patches Firefox zero-day abused in the wild by admax88q on Wednesday June 19, 2019 @06:51AM (#20222232)
What about that makes it sound targeted? Seems like standard vulnerabilities chained together, nothing specific to the "target"
[ Parent | on HN ]
Re:Mozilla patches Firefox zero-day abused in the wild by fabianhjr on Wednesday June 19, 2019 @09:50AM (#20223310)
Just jail outside facing processes like firefox. (BSD Jails, Firejail in Linux and probably another solution on Mac)
[ Parent | on HN ]
Re:Mozilla patches Firefox zero-day abused in the wild by FDSGSG on Wednesday June 19, 2019 @08:28AM (#20222652)
> presumably a lot of work

How come?

[ Parent | on HN ]
[dead]
Re:Mozilla patches Firefox zero-day abused in the wild by CryptoBard on Wednesday June 19, 2019 @05:47AM (#20222032)
I don't know why you are addressing me, I can't even downvote. Your "conspiracy theory" comment is certainly valid, unfortunately I'm not willing to provide more information so I suppose it will remain a "conspiracy theory" albeit one I believe is true.
[ Parent | on HN ]
Re:Mozilla patches Firefox zero-day abused in the wild by campuscodi on Wednesday June 19, 2019 @05:39AM (#20221999)
Additional details about the Firefox zero-day:

https://twitter.com/campuscodi/status/1141279052893999104

[ Parent | on HN ]
Re:Mozilla patches Firefox zero-day abused in the wild by ga-vu on Wednesday June 19, 2019 @03:28AM (#20221475)
It's just hearsay, buddy.

You can't be sure the same bug was exploited.

[ Parent | on HN ]