News for hackers. Stuff that matters.

A comment on Mozilla fixes Firefox zero-day actively exploited in attacks. Parent comment

Re:Mozilla fixes Firefox zero-day actively exploited in attacks by btdmaster on Thursday October 10, 2024 @05:10AM (#41797037)
Ticket in Tor Browser: https://gitlab.torproject.org/tpo/applications/tor-browser/-...

It seems to be JavaScript-free from the description, which makes it even scarier. Imagine the libwebp decoder bug except embedded media blocking doesn't really work (who blocks CSS?).

[ Parent | on HN ]
Re:Mozilla fixes Firefox zero-day actively exploited in attacks by mrob on Thursday October 10, 2024 @05:43AM (#41797189)
I block CSS animations:

https://news.ycombinator.com/item?id=33223080

I'd be interested to know if it's sufficient to avoid this recent vulnerability. Either way, it confirms my opinion that UI animations are an anti-feature.

[ Parent | on HN ]
Re:Mozilla fixes Firefox zero-day actively exploited in attacks by schiffern on Thursday October 10, 2024 @07:00AM (#41797588)
As a uBlock Origin filter (paste in Settings > My Filters):

  ! No CSS animations
  ##*,::before,::after:style(transition:none !important;animation-delay:0ms !important;animation-duration:0ms !important)
  
  ! No CSS animations (different method)
  ##*,::before,::after:style(animation-timing-function:step-start !important;transition-timing-function:step-start !important)
There's other (often perf heavy) CSS clutter that's nice to get rid of:

  ! No image filters
  ##*,::before,::after:style(filter:none !important)
  
  ! No text-shadow
  ##*,::before,::after:style(text-shadow:none !important)
  
  ! No box-shadow
  ##*,::before,::after:style(box-shadow:none !important)

  ! No rounded corners
  ##*,::before,::after:style(border-radius:0px !important)
No rounded corners is fun. You realize many loading spinners are actually CSS rounded corners! Youtube becomes almost unrecognizable — mercifully — especially if you also revert the new TikTok-inspired font:

  ! Un-bold Youtube
  youtube.com##*:style(font-weight:400 !important)
[ Parent | on HN ]
Re:Mozilla fixes Firefox zero-day actively exploited in attacks by krackers on Thursday October 10, 2024 @01:45PM (#41801310)
Firefox doesn't seem to support css animation-timeline, I think this refers to the JS AnimationTimeline API? In that case "dom.animations-api.timelines.enabled" flag should control it.
[ Parent | on HN ]
Re:Mozilla fixes Firefox zero-day actively exploited in attacks by tomrittervg on Friday October 11, 2024 @08:21AM (#41808849)
The vulnerability did require JavaScript to trigger.

I think it would be a labor of love and craftsmanship to exploit a content process today without using JavaScript.

[ Parent | on HN ]
Re:Mozilla fixes Firefox zero-day actively exploited in attacks by jjuran on Friday October 11, 2024 @10:28AM (#41809773)
> The vulnerability did require JavaScript to trigger.

Can you back this up with a citation?

[ Parent | on HN ]
Re:Mozilla fixes Firefox zero-day actively exploited in attacks by a_vanderbilt on Tuesday October 15, 2024 @08:53PM (#41854617)
He works (or recently worked) for Mozilla on security-related projects. The code commit fixing the issue was isolated to the /dom/ directory in the source tree, and Firefox does not support CSS Animation Timelines. The Animation Timelines code is not directly accessed by web devs, and it appears the only way to execute that code is via the JS API for Animation Timelines. I'm not a web security expert, but the signs seem to point to him being correct.

Once again, JS proves to be a security risk.

[ Parent | on HN ]