See your link here
Firefox and irresponsible disclosure
10 commentsI'm surprised this hasn't gotten more press: a pair of hackers have found 30 stack overflow errors in Firefox's implementation of JavaScript. Stack overflows are harder to exploit than buffer overflow issues, which means the script kiddies will have a harder time exploiting these vulnerabilities. But once the skilled hackers come out with the exploitation code that difficulty won't mean much. This vulnerability means that Firefox is a little less secure than it was before, but I don't believe it has much relevance in the 'Firefox vs. IE' security arguments. I know I'll continue using Firefox.
What disturbs me about this incident is the attitude of the two crackers who discovered the vulnerability. If the CNet article is unbiased, it seems that the crackers took a fair amount of glee in not only showing of the vulnerability in a way that gave other black hats enough information to exploit the vulnerability, they are also making a show out of not working with Firefox to fix the vulnerabilities. I'm not quite willing to take the article at face value, since it makes the crackers sound like two kids giggling over a toy only they have.
I'm disappointed that the pair who discovered the Firefox vulnerability aren't playing well with the Mozilla Foundation. The folks at Firefox have usually shown themselves to be worth cooperating with, and these actions seemed to be aimed only at getting the crackers status in the black hat network. I don't see any way their claim of this being 'really for the greater good of the Internet' can hold water, even in their own internal logic. It seems to be for their own personal aggrandizement, pure and simple.
One thing I know for certain: Spiegelmock and Wbeelsoi have given up any chance of ever calling themselves researchers or security experts. Their actions make them black hats, pure and simple. But maybe that's what they want.
Update: An astute reader, Kenneth, pointed out that a the bloginfosec.com site has an article stating that the claim of thirty vulnerabilities was false and that the Mozilla Developer Center has a letter from one of the presenters saying that he didn't have thirty vulnerabiliities and no way of using the stack overflow for remote control of a vulnerable system. If this was their idea of being funny, they need some work on their delivery.
Print
Email this
Digg this
