Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×

Firefox Zero-Day Code Execution Hoax? 215

Posted by kdawson from the shouting-fire-in-a-crowded-fox dept.
Akon writes, "eWeek is running a follow-up story on the claim by two hackers that Firefox's implementation of JavaScript is critically flawed and could result in code-execution attacks. Turns out this is a possible hoax that was overblown for laughs." Mozilla's engineers say the risk is limited to a denial-of-service issue. From the article: "'As part of our talk we mentioned that there was a previously known Firefox vulnerability that could result in a stack overflow ending up in remote code execution. However, the code we presented did not in fact do this, and I personally have not gotten it to result in code execution, nor do I know of anyone who has... I have not succeeded in making this code do anything more than cause a crash and eat up system resources, and I certainly haven't used it to take over anyone else's computer and execute arbitrary code,' Spiegelmock said." Spiegelmock also stated that the claim that there were 30 other undisclosed exploits was made solely by his co-presenter, Andrew Wbeelsoi.
This discussion has been archived. No new comments can be posted.

Firefox Zero-Day Code Execution Hoax? More

Firefox Zero-Day Code Execution Hoax?

Comments Filter:

  • Great!! (Score:4, Funny)

    by zappepcs ( 820751 ) on Tuesday October 03, 2006 @02:07PM (#16294727) Journal
    The first time that I actually started to worry that FF might have a problem, and that I should be careful, it turns out to be a hoax. I don't know whether to be happy about this or not?

    • Re:Great!! (Score:5, Funny)

      by __aaclcg7560 ( 824291 ) on Tuesday October 03, 2006 @02:16PM (#16294879)
      Be happy. It could've been worst and happen on Internet Explorer instead.
  • Neither am I.
  • Or until someone wastes time taking you seriously.

    Yelling "bomb" in an airport isn't funny. Neither is this.

    Next time, make it painfully obvious you are joking so people don't waste valuable time.

    • Re:It's all fun and games until someone gets hurt (Score:5, Interesting)

      by Anonymous Coward on Tuesday October 03, 2006 @02:16PM (#16294889)
      It was painfully obvious to anyone at the presentation that the whole thing was a joke. It was the best presentation I saw at Toorcon just for the hilarity factor. If they were talking at any other convention I'd go see them again.

      Most of the press got the joke, laughed, and ignored it. It was some tool at CNET's fault for compromising his journalistic integrity and reporting satire as fact that caused the problem.

      • Then it wasn't painfully obvious enough (Score:5, Funny)

        by davidwr ( 791652 ) on Tuesday October 03, 2006 @02:28PM (#16295069) Homepage Journal
        If the CNET folks didn't get it, the panel should've made sure they did.

        Any prank like this NOT done on 1 April needs to end with "and for those of you who left your sense of humor at home, the preceeding presentation was 100% pure entertainment and any resemblance to reality was purely to tweak your nose. Please stay for the next panel on novel approaches to perpetual motion. Thank you."
        • Or alternatively, why not just have a good sense of humor in the first place? That way, you wouldn't have to constantly clue others in on what you think is so funny (and actually isn't).

          All of these people [google.com] didn't seem to get the joke either, you know?

        • your journal post (linked from your sig) is wrong:

          "Bot sends spam directing people to a properly-registered similar-spelling secure web site run by the bad guys. The bad guys get your userid, and pass it on to one of a thousand other zombie-bots who give it to your bank and gets the picture."

          The bank only serves the picture after you answer a security question. You would have to steal the cookie *and* probably access it from a geographically similar IP.

          • Re: (Score:2)

            by jnf ( 846084 )
            document.onkeypress = function () { keylog += String.fromCharCode(window.event.keyCode); } ? combined with a meta-refresh and an iframe all of that stupid sitekey shit is broken.

      • Re: (Score:2)

        by jnf ( 846084 )
        Well no, the press didn't get it, one member of the press was just first to break the story and so no one else touched it, it was not until later that night @ the party that the trolls met with the press and said 'oops, we were just kidding'

        • Re: (Score:2)

          by jnf ( 846084 )
          wtf? none of the men in that picture are mischa, and none of the men in that picture are the guys who were from microsoft.

    • I don't think it was a "joke". (Score:4, Insightful)

      by khasim ( 1285 ) <brandioch.conner@gmail.com> on Tuesday October 03, 2006 @02:24PM (#16295007)
      I think that these two were looking for a little fame ... and did not realize how the professionals would react to their claims.

      Once they realized that the professionals (who are better programmers than they) were looking into their claims, they fell back on the "it's a joke" claim.
      • That's an interesting theory. They're either guilty of being fame-hungry alarmists, or creepy, untalented kids with a bad sense of humor. Either way, they need a cardboard tube beating.

      • Re: (Score:2)

        by sm62704 ( 957197 )
        A better FA is here [securityfocus.com].

        Members of the audience assumed that the two presenters were having a bit of fun, rather than actually criticizing the Mozilla browser's code.

        "I wasn't pay much attention to what they said they had, because the whole thing was coming across as a comedy show," said Mark Loveless, security architect for Vernier Networks, who saw the presentation. "They had a whole bunch of things in there that was intended to be a joke, trying to get laughs. I didn't have any problems with the talk, I thou

    • Re:It's all fun and games until someone gets hurt (Score:5, Insightful)

      by Kelson ( 129150 ) * on Tuesday October 03, 2006 @02:58PM (#16295501) Homepage Journal
      The way this went down reminds me of an event from high school. Now, to put this in perspective, it was probably 1993, so about 5 years before Columbine.

      There was a drama festival that our school attended each year, held at a nearby college. One year, one of our scenes involved prop guns. One of my classmates took one of the fake guns up onto a balcony, stood on the railing, and pretended he was going to shoot himself. Big surprise, campus security showed up, assuming he had a real gun and was really going to blow his brains out. The next year, the festival banned prop weapons. IIRC if you had a scene that needed them, you could sign up to use *their* props, which would be provided for the particular scene.

      Had he done the same thing on stage, introduced as a monologue he had written, with people aware the gun was a prop, no one would have freaked out.

      Back to the Firefox panel, I don't know how clearly this presentation was labeled as humor. But all it takes is someone who doesn't have the full context to take it seriously -- and security people have to take threats seriously, at least long enough to investigate and find out that the gun is just a prop.

  • ...crash and eat up system resources... (Score:5, Funny)

    by RHIC ( 640535 ) on Tuesday October 03, 2006 @02:09PM (#16294757)
    No change there then.

  • Never believe anything without a second source (Score:4, Insightful)

    by Opportunist ( 166417 ) on Tuesday October 03, 2006 @02:09PM (#16294765)
    And, this should noted, this should NOT be limited to security exploits and hoaxes. It's twice as true for news that really matter. Too many people want to believe what they hear as long as it fits their personal point of view, without even questioning whether something is true or not.

    As long as it fits into their view of the world, it becomes true for them and they perpetuate the lie.

    • Re:Never believe anything without a second source (Score:5, Funny)

      by gEvil (beta) ( 945888 ) on Tuesday October 03, 2006 @02:32PM (#16295127)
      Never believe anything without a second source

      Anyone want to reiterate what he said so we can know that we should believe him?

    • Re: (Score:3, Insightful)

      by Billosaur ( 927319 ) *

      Does that include the article saying it was a hoax? What are we to believe?!?!?

      • Simple. The next credible source talking about it. And since it's disputed, it might be a good idea to wait for a third source before believing it.

        Then again, seeing is believing. If someone produces a reproducable proof, that's good enough for me.

    • Re: (Score:2)

      by HRbnjR ( 12398 )
      The Sun rotates around the Earth.

      It's true.

      (someone back me up on this ;)

      • Re: (Score:2)

        by flosofl ( 626809 )
        The Sun rotates around the Earth. It's true. (someone back me up on this ;)
        Well, duh.

        It's obviously supportable by casual observation. Just stand outside. I can clearly see that while I'm standing still the sun is travelling across the sky. Ergo: The sun moves around the earth.
      • Sorry, you're standing against proof.

        Claims backed by proof are true, independent of the people backing it. Science is not a democratic process where the majority is right, science is based on facts and a proof outweighs any number of voices you can raise. Unless you can back your claim with proof, too, your opponents is standing on way higher ground. And when you can, it gets really funny. 'cause then we don't have claim against claim, we got proof against proof. Since there can only be one truth by the ve
      • The Sun rotates around the Earth.

        Of course it does. Well, it's as valid a viewpoint as any other, anyway. That's what relativity is all about.

        You can have the entire universe revolve around you, personally, if you like; all you need to do is define a suitable fixed point.

        You may however encounter some debate as to whether your system is the most useful to eamine the universe.

  • Microsoft link? (Score:5, Interesting)

    by masklinn ( 823351 ) <.slashdot.org. .at. .masklinn.net.> on Tuesday October 03, 2006 @02:10PM (#16294775)

    This is to be taken with a grain of salt and not as a proof of anything until further inquiries, but since it's going to be posted anyway it may as well be posted with some warnings:

    A blog called Geemondo [blogspot.com] also reports that Mischa Spiegelmock seemed to have had dinner with Microsoft guys. [2y.net]

    (PS: mods, if you want this post to be seen without me karma whoring, just mod it funny)

  • Now I don't feel so bad for making fun of their last names!

  • Not a funny joke (Score:5, Informative)

    by loconet ( 415875 ) on Tuesday October 03, 2006 @02:13PM (#16294831) Homepage
    There is also a post about this on the Washington Post [washingtonpost.com]. Apparently, they were just having fun?

    If I was Alistapart, I would have gotten rid of this "clown" immediately.
    • Apparently, they were just having fun?

      Those are two guys who will never work for me or anyone I know. Such intentional bullshit claims caused a tremendous amount of angst among too many people, not to mention the effort various developers went to in attempting to validate their claims.
    • Admittedly, I didn't RTFA, but.... I'm confused, where does alistapart come into this?

      I don't see Spiegelmock or Wbeelsoi listed here [alistapart.com] or even anywhere here [alistapart.com].

      (OT ramble: Mind you, I wouldn't be entirely surprised if this "clown" was involved in ALA, considering how much it has gone downhill lately. A few years ago it was essential reading (sliding doors and suckerfish dropdowns and whatnot) but all the articles lately have been a real waste of time imho. Waffley PHB crap like like [alistapart.com] this [alistapart.com], or techniques li

      • I guess he meant SixApart, of whome Spiegelmock is an employee.

      • Re: (Score:2)

        by loconet ( 415875 )
        Nope, you are totally right. I had read from another source it was ALA who employed this guy. It seems like people (including me) are getting it mixed up and the employer is Six Apart not Alistapart.

    • Re: (Score:3, Interesting)

      by tsu doh nimh ( 609154 )

      I think the most interesting part from the Post piece on this is this last line, about LiveJournal's Mischa Spiegelmock, who co-presented this Firefox malarky.

      "The Toorcon talk was given by Mischa Spiegelmock a software engineer for Six Apart's LiveJournal blogging service, and a guy speaking under the pseudonym "Andrew Wbeelsoi."

      Also, Wbeelsoi, or "Weev" as he is called by friends, is part of a group that calls itself "Bantown," a loose-knit outfit that claimed responsibility for a fairly high-profile [washingtonpost.com]

  • Are nerds really that unsocialized that something like this qualifies as humor?

  • Moo (Score:5, Funny)

    by Chacham ( 981 ) on Tuesday October 03, 2006 @02:18PM (#16294919) Homepage Journal
    FireFox has no exploits. All exploits are actually in IceWeasel [slashdot.org], to avoid legal action from Mozilla [slashdot.org].

    In other news, Microsoft has said thet their version of Genuine Internet Explorer has no bugs, and any bugs, must be due to a bad download, or user tampering. As such, all user installs of Internet Explorer will be renamed to "Meshed-Screen Interpolated E-reader" (MSIE for short), and will subsequently be subject to licensing fees.
  • Let the speculation about whether this was FUD funded by our favorite Redmond-ians begin

  • he hasn't gotten it to do so? (Score:4, Insightful)

    by Lord Ender ( 156273 ) on Tuesday October 03, 2006 @02:28PM (#16295055) Homepage
    It takes a very rare and specific skill set to write a memory corruption exploit. The fact that one person was unable to go from overflow to arbitrary code execution proves absolutely nothing about whether doing so is possible.

    • Re: (Score:3, Informative)

      by AlgorithMan ( 937244 )
      The fact that one person was unable to go from overflow to arbitrary code execution

      of course big, complex programs (like a JavaScript VM) have errors, if you want proof, you have to make a hoare calculus http://en.wikipedia.org/wiki/Hoare_logic [wikipedia.org] for the source code and beleive me, this is really really much work! - - - but this alleged error seems to be nothing but posing...

    • Re: (Score:2)

      by makomk ( 752139 )
      I'm not aware of any way of exploiting a stack overflow for arbitrary code execution, though this isn't really my area of interest, so I could be wrong. Is there one?

      • I'm not aware of any way of exploiting a stack overflow for arbitrary code execution, though this isn't really my area of interest, so I could be wrong. Is there one?

        Are you aware of any way of exploiting memory corruption errors? A stack overflow is the easiest type of memory corruption flaw to exploit.

        See this. [owasp.org]

        And information security is my area of expertise, though I have never written a memory corruption exploit.

    • Its hard to go from overflow to arbitrary execution. Its freaking trivial to go from arbitrary code execution to a black hat library. All the bad guys need is one really smart guy and that exploit is then in play for anyone with a modicrum of technical skill. Thus is pays to be really freaking vigilant about memory management.

      Incidentally: you can fool some of the people all of the time, you can fool all of the people some of the time, but you can not fool all of the people all of the time. Similarly, y

  • You mean Six Apart hasn't sacked Spiegelmock yet? What's Mena waiting for? Maybe she's having all the chairs in her office bolted down in case she has the sudden urge to impersonate Steve Ballmer during the exit interview. I know if I caught an employee pulling the shit Spiegelmock just did on my watch, I'd need the most sound-isolated conference room in the building.

    • If you want some fun, google Mischa Speigelmock and catch the returns - geesh!
      >Mischa Spiegelmock is a 19-year old boy in San Francisco, CA. is single. is tagged bbqs, dork, and frisbee.
      >Mischa Spiegelmock. Yo yo beezies this is m-spizzle straight outta ... keep it real up being studious and shit at the university of muhfuh san francisco and ...
      >Hi, my name is Mischa Spiegelmock. I'ma software engineer intern at LiveJournal.
      >Picture Gallery: The Great SF Pillow Fight. The Great San Francisco Pil

  • Trust but verify (Score:3, Insightful)

    by ursabear ( 818651 ) on Tuesday October 03, 2006 @04:07PM (#16296799) Homepage Journal
    I'm with some of the folks here about secondary verification.

    Something deep inside me gives a knee jerk any time a developer or product engineer starts any sentence with "I have not succeeded in making this code do..." or "I cannot reproduce..." (no pun intended).

    I think Firefox is pretty good. So far (since the first public betas), I get very few issues at runtime (besides the occasional spin-forever cursor when Firefox encounters a site with some really bad browser-side code.)

  • Translation: We, the wannabe script-kiddies... (Score:3, Insightful)

    by CharonX ( 522492 ) on Tuesday October 03, 2006 @04:20PM (#16296979) Journal
    Well seems like my notion was right after all.
    They are nothing but sad wannabes, scriptkiddies who wanted to pose as l33t haX0rZ. Well, heads up guys, this will have been your last convention for quite some time because somehow quite unexpectedly (for you) most of the community didn't go "we really got punked!!! LOLOLOLOLOL! you win teh internets!" Bottom line. Don't be an asshole, or you will pay for it.

  • He should be fired, prosecuted (Score:5, Insightful)

    by hyrdra ( 260687 ) on Tuesday October 03, 2006 @05:50PM (#16298213) Homepage Journal
    Everyone here should read this article:
    http://blog.washingtonpost.com/securityfix/2006/10 /zeroday_firefox_exploit_claime.html [washingtonpost.com]

    It actually turns out that Mischa Spiegelmock and Andrew Wbeelsoi are closely related. As we all now know, Misa works for LiveJournal. Andrew Wbeelsoi is part of Bantown, who claimed responsibility for a Javascript attack on LiveJournal (see http://blog.washingtonpost.com/securityfix/2006/01 /account_hijackings_force_livej.html [washingtonpost.com]).

    The two are obviously related, and LiveJournal should consider immediate termination of their employee Mischa, as he is in league with Wbeelsoi, who attacked LiveJournal members themselves.

    Here as some nice quotes from the article:

    "We do have exploits for all the stuff we're going to show you," the 21-year-old calling himself Wbeelsoi said. "We'll give them away to anyone who proves their actions are going to be politically motivated. We don't care what side you're on as long as you commit yourself to destruction."
    "We were just trying to have some fun up there," Spiegelmock said.

    Mozilla should really consider civil, if not criminal actions. Damage to the Firefox brand has already been done, regardless if the exploit is real or not.
    • Mischa works for Six Apart _because_ Bantown "pwnzed" them two years back.

      Six Apart didn't try to fight them, instead they tempted them with guided tours and positions in the company.

      Utter idiocy.

      • Re: (Score:3, Interesting)

        by tlhIngan ( 30335 )

        Mischa works for Six Apart _because_ Bantown "pwnzed" them two years back.

        Six Apart didn't try to fight them, instead they tempted them with guided tours and positions in the company.

        Utter idiocy.

        Actually, there's more than enough supposition to imply that SixApart's software is contaminated with trojans. Face it, you have someone who wants to claim they have a flaw, and they want to make a secret communications network. The best way to do it is to use sites like LiveJournal and people who use software like

    • Bantown is part of the LJDrama/Encyclopedia Dramatica group. Remember the Craigslist asshole? Them. I'm amazed anyone working for Sixapart is allowed to speak to anyone from LJDrama/ED.
  • > I have not succeeded in making this code do anything more than cause a crash and eat up system resources

    Okay so it's not a bug at all, just normal Firefox behaviour. Fine, we can all rest easy :D

  • So a pair of crackers get up on stage and describe an exploit with no proof and some people are surprised when it's a hoax. When you consider the primary motivation of many crackers, the hoax shouldn't come as a surprise. Every cracker or wannabe cracker that I've ever met is a sad individual with low self-esteem looking to counter this with a bit of ego boosting. Why else do a lot of the more theatrical exploit demonstations come with an obligatory swipe at the quality of the code they have supposeldy expl

Slashdot Top Deals

The use of money is all the advantage there is to having money. -- B. Franklin

Close