Stories
Slash Boxes
Comments

SoylentNews is people

posted by janrinok on Tuesday August 11 2015, @02:06AM   Printer-friendly
from the they-never-stop-trying dept.

http://www.smh.com.au/digital-life/consumer-security/major-firefox-vulnerability-lets-hackers-steal-your-files-using-dodgy-web-ads-20150809-givb77.html

If you needed another reason to install an ad-blocker on your web browser, read on.

Mozilla Firefox users are this week being urged to update to the latest version after an exploit was found being used in the wild which allowed the scooping up of files from users' computers via an ad without leaving a trace behind of the hack.

In a blog post, Mozilla said the ad, found on a Russian news website, was "serving up a Firefox exploit" which allowed code to be run on a user's computer to search files, which were then uploaded to a server in Ukraine. The exploit affects Windows and Linux users; Mac users weren't specifically targeted this time around, but the company warned Mac users "would not be immune" should a hacker decide to target them using the same vulnerability.

And the worst part is, if you're targeted you'll have no way of knowing, because the exploit leaves no trace it has been run on your computer.

If you're like the one million Australians who use ad-blocking software, however, you "may have been protected" from the malicious exploit depending on the type of software you use and the level of filtering, Mozilla has advised. The vulnerability relates to Firefox's PDF viewer, so products without a PDF viewer, such as Firefox for Android mobile devices, were not at risk, it said.

Mozilla is urging anyone using Firefox on Windows or Linux to install the latest Firefox — versions 39.0.3 for personal users and Firefox ESR 38.1.1 for enterprise — which include a patch for the vulnerability.


Original Submission

-- submitted from IRC

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 2, Interesting) by drgibbon on Tuesday August 11 2015, @01:31PM

    by drgibbon (74) on Tuesday August 11 2015, @01:31PM (#221246) Journal

    Applications that connect out to the Internet should really be sandboxed: Firejail [wordpress.com] does the trick relatively pain-free. Check out the Firejail Firefox tutorials part 1 [wordpress.com] and part 2 [wordpress.com].

    I don't think Firefox needs to see anything from ~ except for ~/downloads and ~/.mozilla (and maybe some add-on specific stuff like ~/.zotero or whatever).

    --
    Certified Soylent Fresh!
    Starting Score:    1  point
    Moderation   +1  
       Interesting=1, Total=1
    Extra 'Interesting' Modifier   0  

    Total Score:   2  
  • (Score: 0) by Anonymous Coward on Tuesday August 11 2015, @05:10PM

    by Anonymous Coward on Tuesday August 11 2015, @05:10PM (#221329)

    It would be nice if firejail also did network firewalling. That would make it a one-stop shop for per-app isolation.