5 ms·

Article poses a good question. How did a privately reported zero-day leak from Bugzilla into an attacker's arsenal? Also, why did it take 2 months to fix an RC

by ga-vu 7y ago

Article poses a good question. How did a privately reported zero-day leak from Bugzilla into an attacker's arsenal? Also, why did it take 2 months to fix an RCE? It's an RCE, not some XSS. I'd imagine this would be a high-priority. No?

jessaustin 7y ago
TFA's first answer is the most likely. If one researcher discovers a vulnerability, another researcher can also discover it. No "leak" required. I agree that RCE should be a priority!
- Scaevolus 7y ago
  I'm betting on insider access. Microsoft had to lock down internal access to their security bugs when some employees were selling the bugs on the black market.
  - garren 7y ago
    Do you have a source for that? Google's not giving me anything. I'd definitely like to know more - I can't help but wonder how widespread that kind of behavior is.
    - inetknght 7y ago
      No source, but I'd be willing to bet it's very widespread.
    - dboreham 7y ago
      Locking security bugs from wide internal read access has been SOP everywhere I've worked for decades.
      - laughinghan 7y ago
        I think they're asking for a source on the specific claim about Microsoft employees selling bugs on the black market, which is what I would also like to see. I don't need to be convinced that security bugs should be on a need-to-know basis during the responsible disclosure period, that seems obviously prudent. Anyone not working specifically on security can learn about the details at the same time as the wider public.
    - Thorrez 7y ago
      I don't know anything about that event, but it reminds of me when 20 Apple contractors had a scheme selling Apple user data for $7M. https://www.nytimes.com/2017/06/09/business/china-apple-personal-data-sold.html https://www.nytimes.com/2017/06/09/business/china-apple-pers...
  - thrw374747 7y ago
    If it is insider access they will be caught.
  - pcwalton 7y ago
    For what it's worth, Mozilla locks down internal access to security bugs too. I can't see those bugs, which is exactly how it should be, as I have no need to know.
    - forgotmypw 7y ago
      How many people can read these?
      - pcwalton 7y ago
        I don't know.
      - dao- 7y ago
        As a Mozilla employee I can say that I was in the security group but lost access at some point since I wasn't very active.
        tru3_power 7y ago
        How’d you get access in the first place?
        dao- 7y ago
        I helped out with UI related security bugs (e.g. address bar spoofing) which we had a bunch of at the time.
AnaniasAnanas 7y ago
I mentioned the possibility of an untrustworthy person gaining access to bugzilla yesterday but it seems that most people disagreed with it: https://news.ycombinator.com/item?id=20221397 https://news.ycombinator.com/item?id=20221397
Felz 7y ago
Really, that Mozilla would let a reported RCE vulnerability simmer for two months until it bit someone would seem to reflect very poorly on their priorities and competence. Can anyone postmortem why it took so long now that it's fixed?
- tedunangst 7y ago
  Firefox likes to bundle security fixes into .0 releases. 67.0 was released May 21 (and went to nightly/beta whatever May 13) and 68.0 won't be released for a few more weeks.
  - ErikAugust 7y ago
    Do you know why? Isn’t a security fix a bug fix?
    - tedunangst 7y ago
      Nope. Security vulns are not regressions!
      - tru3_power 7y ago
        I’m confused what do you mean? Fixing security vulns can often times lead to regressions since overtime users become dependent on a behavior that relies on a insecure behavior.
        staticassertion 7y ago
        Secure behaviors should generally trump API guarantees.
        bscphil 7y ago
        Your parent comment didn't say security fixes couldn't lead to regressions, they said security vulns themselves aren't regressions.
      - 7y ago
lossolo 7y ago
Maybe hacked again(1). 1. https://www.esecurityplanet.com/browser-security/bugzilla-hacked-for-over-a-year.html https://www.esecurityplanet.com/browser-security/bugzilla-ha...
ajross 7y ago
> How did a privately reported zero-day leak from Bugzilla into an attacker's arsenal? This was a VERY valuable bug. I mean, it's sad to think about but the most likely scenario is that someone with access to the report at Mozilla or Google (or maybe elsewhere if it was shared more widely) called a friend of a friend of a friend and... sold it.
- luch 7y ago
  Moreover, people are bad at keeping secrets. Social engineering is clearly a thing, even among infosec circles. Sometimes all it takes is being in the right bar and having a good ear.
ComodoHacker 7y ago
>from Bugzilla into an attacker's arsenal Typically, they leak the opposite way.

by ga-vu 7y ago

jessaustin 7y ago

TFA's first answer is the most likely. If one researcher discovers a vulnerability, another researcher can also discover it. No "leak" required. I agree that RCE should be a priority!

Scaevolus 7y ago
I'm betting on insider access. Microsoft had to lock down internal access to their security bugs when some employees were selling the bugs on the black market.
- garren 7y ago
  Do you have a source for that? Google's not giving me anything. I'd definitely like to know more - I can't help but wonder how widespread that kind of behavior is.
  - inetknght 7y ago
    No source, but I'd be willing to bet it's very widespread.
  - dboreham 7y ago
    Locking security bugs from wide internal read access has been SOP everywhere I've worked for decades.
    - laughinghan 7y ago
      I think they're asking for a source on the specific claim about Microsoft employees selling bugs on the black market, which is what I would also like to see. I don't need to be convinced that security bugs should be on a need-to-know basis during the responsible disclosure period, that seems obviously prudent. Anyone not working specifically on security can learn about the details at the same time as the wider public.
  - Thorrez 7y ago
    I don't know anything about that event, but it reminds of me when 20 Apple contractors had a scheme selling Apple user data for $7M. https://www.nytimes.com/2017/06/09/business/china-apple-personal-data-sold.html https://www.nytimes.com/2017/06/09/business/china-apple-pers...
- thrw374747 7y ago
  If it is insider access they will be caught.
- pcwalton 7y ago
  For what it's worth, Mozilla locks down internal access to security bugs too. I can't see those bugs, which is exactly how it should be, as I have no need to know.
  - forgotmypw 7y ago
    How many people can read these?
    - pcwalton 7y ago
      I don't know.
    - dao- 7y ago
      As a Mozilla employee I can say that I was in the security group but lost access at some point since I wasn't very active.
      - tru3_power 7y ago
        How’d you get access in the first place?
        dao- 7y ago
        I helped out with UI related security bugs (e.g. address bar spoofing) which we had a bunch of at the time.

AnaniasAnanas 7y ago

I mentioned the possibility of an untrustworthy person gaining access to bugzilla yesterday but it seems that most people disagreed with it: https://news.ycombinator.com/item?id=20221397 https://news.ycombinator.com/item?id=20221397

Felz 7y ago

Really, that Mozilla would let a reported RCE vulnerability simmer for two months until it bit someone would seem to reflect very poorly on their priorities and competence. Can anyone postmortem why it took so long now that it's fixed?

tedunangst 7y ago
Firefox likes to bundle security fixes into .0 releases. 67.0 was released May 21 (and went to nightly/beta whatever May 13) and 68.0 won't be released for a few more weeks.
- ErikAugust 7y ago
  Do you know why? Isn’t a security fix a bug fix?
  - tedunangst 7y ago
    Nope. Security vulns are not regressions!
    - tru3_power 7y ago
      I’m confused what do you mean? Fixing security vulns can often times lead to regressions since overtime users become dependent on a behavior that relies on a insecure behavior.
      - staticassertion 7y ago
        Secure behaviors should generally trump API guarantees.
      - bscphil 7y ago
        Your parent comment didn't say security fixes couldn't lead to regressions, they said security vulns themselves aren't regressions.
    - 7y ago

lossolo 7y ago

Maybe hacked again(1). 1. https://www.esecurityplanet.com/browser-security/bugzilla-hacked-for-over-a-year.html https://www.esecurityplanet.com/browser-security/bugzilla-ha...

ajross 7y ago

> How did a privately reported zero-day leak from Bugzilla into an attacker's arsenal? This was a VERY valuable bug. I mean, it's sad to think about but the most likely scenario is that someone with access to the report at Mozilla or Google (or maybe elsewhere if it was shared more widely) called a friend of a friend of a friend and... sold it.

luch 7y ago
Moreover, people are bad at keeping secrets. Social engineering is clearly a thing, even among infosec circles. Sometimes all it takes is being in the right bar and having a good ear.

ComodoHacker 7y ago

>from Bugzilla into an attacker's arsenal Typically, they leak the opposite way.