News for hackers. Stuff that matters.

A comment on Firefox zero-day was used in attack against Coinbase employees, not its users. Parent comment

Re:Firefox zero-day was used in attack against Coinbase empl... by Scaevolus on Thursday June 20, 2019 @02:09PM (#20235558)
I'm betting on insider access. Microsoft had to lock down internal access to their security bugs when some employees were selling the bugs on the black market.
[ Parent | on HN ]
Re:Firefox zero-day was used in attack against Coinbase empl... by pcwalton on Thursday June 20, 2019 @04:20PM (#20236915)
For what it's worth, Mozilla locks down internal access to security bugs too. I can't see those bugs, which is exactly how it should be, as I have no need to know.
[ Parent | on HN ]
Re:Firefox zero-day was used in attack against Coinbase empl... by forgotmypw on Thursday June 20, 2019 @04:58PM (#20237301)
How many people can read these?
[ Parent | on HN ]
Re:Firefox zero-day was used in attack against Coinbase empl... by dao- on Thursday June 20, 2019 @05:25PM (#20237545)
As a Mozilla employee I can say that I was in the security group but lost access at some point since I wasn't very active.
[ Parent | on HN ]
Re:Firefox zero-day was used in attack against Coinbase empl... by tru3_power on Thursday June 20, 2019 @11:52PM (#20239740)
How’d you get access in the first place?
[ Parent | on HN ]
Re:Firefox zero-day was used in attack against Coinbase empl... by dao- on Friday June 21, 2019 @12:32AM (#20239898)
I helped out with UI related security bugs (e.g. address bar spoofing) which we had a bunch of at the time.
[ Parent | on HN ]
Re:Firefox zero-day was used in attack against Coinbase empl... by pcwalton on Thursday June 20, 2019 @05:13PM (#20237445)
I don't know.
[ Parent | on HN ]
Re:Firefox zero-day was used in attack against Coinbase empl... by garren on Thursday June 20, 2019 @02:47PM (#20235966)
Do you have a source for that? Google's not giving me anything. I'd definitely like to know more - I can't help but wonder how widespread that kind of behavior is.
[ Parent | on HN ]
Re:Firefox zero-day was used in attack against Coinbase empl... by dboreham on Thursday June 20, 2019 @04:11PM (#20236848)
Locking security bugs from wide internal read access has been SOP everywhere I've worked for decades.
[ Parent | on HN ]
Re:Firefox zero-day was used in attack against Coinbase empl... by laughinghan on Thursday June 20, 2019 @06:24PM (#20238009)
I think they're asking for a source on the specific claim about Microsoft employees selling bugs on the black market, which is what I would also like to see.

I don't need to be convinced that security bugs should be on a need-to-know basis during the responsible disclosure period, that seems obviously prudent. Anyone not working specifically on security can learn about the details at the same time as the wider public.

[ Parent | on HN ]
Re:Firefox zero-day was used in attack against Coinbase empl... by Thorrez on Thursday June 20, 2019 @10:48PM (#20239458)
I don't know anything about that event, but it reminds of me when 20 Apple contractors had a scheme selling Apple user data for $7M.

https://www.nytimes.com/2017/06/09/business/china-apple-pers...

[ Parent | on HN ]
Re:Firefox zero-day was used in attack against Coinbase empl... by inetknght on Thursday June 20, 2019 @03:22PM (#20236346)
No source, but I'd be willing to bet it's very widespread.
[ Parent | on HN ]
Re:Firefox zero-day was used in attack against Coinbase empl... by thrw374747 on Thursday June 20, 2019 @04:11PM (#20236842)
If it is insider access they will be caught.
[ Parent | on HN ]