5 ms·

Firefox is not even looked at pwn2own competition because it's too easy to hack and not using good OS or sandbox protection https://it.slashdot.org/story/16/02

Firefox is not even looked at pwn2own competition because it's too easy to hack and not using good OS or sandbox protection https://it.slashdot.org/story/16/02/12/034206/pwn2own-2016-wont-attack-firefox-because-its-too-easy https://it.slashdot.org/story/16/02/12/034206/pwn2own-2016-w...

noja 10y ago
But the Safari browser is? And Tor Browser uses Firefox?
Santosh83 10y ago
How do you know with such certainty that it is because it is too easy to hack and not because Chrome is the current "big fish" among browsers and Google gives monetary rewards to white hats, both of which could reasonably fuel disproportionate interest in breaking Chrome?
- AdmiralAsshat 10y ago
  Reasons aside, the fact remains that when a group of white-hat hackers says they "won't bother" with a given target, it doesn't speak well to that target's security. There are no-doubt tons of exploits in Firefox still waiting to be found, as there are in Chrome, Opera, Edge, etc. Given that the Tor Browser is built on top of Firefox, it's a huge loss for everyone that Firefox is not being included in the attacks; the vulnerabilities that the white-hats find would be reported and promptly plugged, rather than left open for nefarious three-letter agencies to exploit.
  - noja 10y ago
    > Reasons aside No. Reasons not aside. Reasons are very important.
    - AdmiralAsshat 10y ago
      If we don't know what the reason was, and they won't elaborate on it, what importance does it have? Pwn2Own 2016 already happened. Firefox wasn't included, for whatever reason. The damage is already done at this point, as its exclusion created the impression that it was "not worth attacking". If the guys had said, "We didn't bother with Firefox because they weren't willing to pay us as much as Google or Microsoft", okay. But they didn't. What they said was: 'We wanted to focus on the browsers that have made serious security improvements in the last year,' Brian Gorenc, manager of Vulnerability Research at HPE said." And now Firefox looks weak by comparison.
      - bzbarsky 10y ago
        > If the guys had said Why would they have said that, even if it were true? What's the upside for them? I agree the net result is the same whether they were honest or not, of course, which is again why there was no upside for them to say that if it were true.
- mccr8 10y ago
  For what it is worth, Firefox also has a security bounty program, one that is older than Chrome itself. :) Of course, the payouts are smaller than those from Pwn2Own, but on the other hand, reporters don't have to demonstrate a full exploit that can actually execute arbitrary code.
- deleted 10y ago
  [deleted]
mintplant 10y ago
After an absolutely massive engineering effort to make the browser multi-process, Firefox is starting to roll out OS-level sandboxing with Firefox 50. https://blog.mozilla.org/futurereleases/2016/12/21/update-on-multi-process-firefox/ https://blog.mozilla.org/futurereleases/2016/12/21/update-on... The statement quoted in Slashdot is really unfair.
- Karunamon 10y ago
  Not at the time it was made. This blog post is from December, the slashdot post from February. The feature wasn't even being rolled out until August. We'll see what happens at the next Pwn2Own...
  - mintplant 10y ago
    The underlying engineering effort (e10s) was well underway by that point in February.
    - krakensden 10y ago
      E10s has been underway for years though.
- therealmarv 10y ago
  So does Firefox have security sandboxing on my Mac nowadays? No...
  - mintplant 10y ago
    OS-level sandboxing for the content process is enabled for macOS as of Firefox 52, which is the current release on the Developer Edition (Aurora) channel and will be rolling out to stable come March. It's currently in stable on Windows and Nightly on Linux. Sandboxing for media plugins is already stable on macOS, Windows, and Linux.
    - therealmarv 10y ago
bzbarsky 10y ago
Or maybe it's because Mozilla refused to pay money to the pwn2own organizers (unlike the other browsers)? Hard to say which one is more likely.
Sylos 10y ago
It wasn't looked at, because no one paid a bounty for it. And they stated as reason for that, that Firefox simply didn't have any major architectural changes since the last pwn2own, i.e. they probably wouldn't find anything new. If they had expected to find many vulnerabilities, then it would make more sense to target it, as the whole point of these events is to find vulnerabilities, so that they can be fixed.
- eugeneionesco 10y ago
  >It wasn't looked at, because no one paid a bounty for it. I don't think you understand how PWN2OWN works. And the poster you replied to was right, at the time of PWN2OWN 2016 Firefox was the only browser without a working sandbox. It would have been very easy to compromise it.

noja 10y ago

But the Safari browser is? And Tor Browser uses Firefox?

Santosh83 10y ago

How do you know with such certainty that it is because it is too easy to hack and not because Chrome is the current "big fish" among browsers and Google gives monetary rewards to white hats, both of which could reasonably fuel disproportionate interest in breaking Chrome?

AdmiralAsshat 10y ago
Reasons aside, the fact remains that when a group of white-hat hackers says they "won't bother" with a given target, it doesn't speak well to that target's security. There are no-doubt tons of exploits in Firefox still waiting to be found, as there are in Chrome, Opera, Edge, etc. Given that the Tor Browser is built on top of Firefox, it's a huge loss for everyone that Firefox is not being included in the attacks; the vulnerabilities that the white-hats find would be reported and promptly plugged, rather than left open for nefarious three-letter agencies to exploit.
- noja 10y ago
  > Reasons aside No. Reasons not aside. Reasons are very important.
  - AdmiralAsshat 10y ago
    If we don't know what the reason was, and they won't elaborate on it, what importance does it have? Pwn2Own 2016 already happened. Firefox wasn't included, for whatever reason. The damage is already done at this point, as its exclusion created the impression that it was "not worth attacking". If the guys had said, "We didn't bother with Firefox because they weren't willing to pay us as much as Google or Microsoft", okay. But they didn't. What they said was: 'We wanted to focus on the browsers that have made serious security improvements in the last year,' Brian Gorenc, manager of Vulnerability Research at HPE said." And now Firefox looks weak by comparison.
    - bzbarsky 10y ago
      > If the guys had said Why would they have said that, even if it were true? What's the upside for them? I agree the net result is the same whether they were honest or not, of course, which is again why there was no upside for them to say that if it were true.
mccr8 10y ago
For what it is worth, Firefox also has a security bounty program, one that is older than Chrome itself. :) Of course, the payouts are smaller than those from Pwn2Own, but on the other hand, reporters don't have to demonstrate a full exploit that can actually execute arbitrary code.
deleted 10y ago
[deleted]

mintplant 10y ago

After an absolutely massive engineering effort to make the browser multi-process, Firefox is starting to roll out OS-level sandboxing with Firefox 50. https://blog.mozilla.org/futurereleases/2016/12/21/update-on-multi-process-firefox/ https://blog.mozilla.org/futurereleases/2016/12/21/update-on... The statement quoted in Slashdot is really unfair.

Karunamon 10y ago
Not at the time it was made. This blog post is from December, the slashdot post from February. The feature wasn't even being rolled out until August. We'll see what happens at the next Pwn2Own...
- mintplant 10y ago
  The underlying engineering effort (e10s) was well underway by that point in February.
  - krakensden 10y ago
    E10s has been underway for years though.
therealmarv 10y ago
So does Firefox have security sandboxing on my Mac nowadays? No...
- mintplant 10y ago
  OS-level sandboxing for the content process is enabled for macOS as of Firefox 52, which is the current release on the Developer Edition (Aurora) channel and will be rolling out to stable come March. It's currently in stable on Windows and Nightly on Linux. Sandboxing for media plugins is already stable on macOS, Windows, and Linux.
  - therealmarv 10y ago

bzbarsky 10y ago

Or maybe it's because Mozilla refused to pay money to the pwn2own organizers (unlike the other browsers)? Hard to say which one is more likely.

Sylos 10y ago

It wasn't looked at, because no one paid a bounty for it. And they stated as reason for that, that Firefox simply didn't have any major architectural changes since the last pwn2own, i.e. they probably wouldn't find anything new. If they had expected to find many vulnerabilities, then it would make more sense to target it, as the whole point of these events is to find vulnerabilities, so that they can be fixed.

eugeneionesco 10y ago
>It wasn't looked at, because no one paid a bounty for it. I don't think you understand how PWN2OWN works. And the poster you replied to was right, at the time of PWN2OWN 2016 Firefox was the only browser without a working sandbox. It would have been very easy to compromise it.