fukusa

10 ms·

61.
by fukusa 11y ago
The list of affected sites is in the article, the only site that's not mentioned is: http://www.themoscowtimes.com/
62.
by fukusa 11y ago
It was disguised as an ad, not served through ad networks. In other cases it was disguised as a file from a CDN.
63.
by fukusa 11y ago
Now that this has been disclosed, one of the affected websites that has not been listed is: http://www.themoscowtimes.com/ . I was a victim of the exploit myself, so if you have visited that website before August 8, you migh
64.
by fukusa 11y ago
Please have a look at the following comments: https://bugzilla.mozilla.org/show_bug.cgi?id=965003#c5 and https://bugzilla.mozilla.org/show_bug.cgi?id=965003#c7 As far as I understand PDF.js used the 'P
65.
by fukusa 11y ago
Update: I played around with the exploit some more to find out what exactly triggered the file dialog. Turns out my OS (Ubuntu 15.04) actually saved me. When you try to open a file with Firefox it will first try to map the file to a mimety
66.
by fukusa 11y ago
I'm not a security expert. If you have a bug report you'd better report it to Mozilla here: https://bugzilla.mozilla.org/
67.
by fukusa 11y ago
As far as I understand with this exploit it was only possible to read files, not write to them or compromise the targets in some other way. With that in mind, it makes sense to target keys. Because the keys are an indirect way to compromise
68.
by fukusa 11y ago
Done.
69.
by fukusa 11y ago
It would have stopped it. Js has to be active for the exploit script to run.
70.
by fukusa 11y ago
You're welcome. Yeah, that's exactly how I feel.
71.
by fukusa 11y ago
Cool, done!
72.
by fukusa 11y ago
About 16 hours.
73.
by fukusa 11y ago
It's me. I discovered the exploit in the wild when I became a victim of it. Skill-set limited. I was able to identify it and understand what it basically does, but not much more.
74.
by fukusa 11y ago
The exploit basically uploaded the contents of a bunch of sensitive files to some server. Besides uploading the full list of files in the User directory (not the contents of the files) it uploaded the contents of the following files: Linux:
75.
by fukusa 11y ago
The script triggered a file dialog showing it was trying to access a local file. I opened the Developer Tools and saw all kinds of other files being accessed, including my private and public keys. I nearly got a heart attack. I quickly revo
76.
by fukusa 11y ago
Yes it was so it would have prevented the exploit from loading.
77.
by fukusa 11y ago
No it was not. I'm not sure if I should mention which website it was (yet). The exploit is still active. I am trying to get in touch with them to get it removed.
78.
by fukusa 11y ago
In this case, it was disguised as an advertisement but it was not running on an advertisement server. My adblocker did not catch it. It was injected into the page as an iframe twice. Once disguised as an ad ([IP-address]/ad.php), anoth
79.
by fukusa 11y ago
Hi, I reported this 0-day. It used a PDF.JS same origin policy violation to access local files. You should be safe because you have javascript disabled and pdfjs.disabled set to true. There's no way for the script to run. It was on a i