Mozilla’s Bugzilla Hacked | Stolen Data Used For Targeting Firefox users

Mozilla yesterday detailed a security attack on its bug tracker and testing tool Bugzilla, as well as the steps it is taking to mitigate a repeat incident. In short, a hacker compromised the service, stole security-sensitive information, and used it to attack Firefox users.

Bugzilla is open-source software that has been adopted by a variety of organizations in addition to Mozilla: WebKit, the Linux kernel, FreeBSD, Gnome, KDE, Apache, Red Hat, Eclipse, and LibreOffice. While Bugzilla is mostly public, access to security-sensitive information is restricted so that only certain privileged users can access it. Following the attack, Mozilla has now beefed up security on those accounts.

mozillas-bugzilla-hacked-stolen-data-used-for-targeting-firefox-users

After conducting an investigation of the unauthorized access, Mozilla believes the attacker used information from Bugzilla to exploit a Firefox vulnerability. The company plugged that Firefox security hole on August 6, just a day after it was reported to the company.

The flaw was being exploited in the wild: Attackers were injecting a malicious script that searched for key files on a user’s machine and then uploaded them to a remote server, thought to be located in the Ukraine. Firefox users merely had to load a webpage with the exploit on it, and the attack left no trace.

Mozilla said the latest update to Firefox 40 (version 40.0.3, released on August 27) addressed all the vulnerabilities that the attacker learned about and could have used to harm Firefox users. With that out of the way, the company is now focusing on the Bugzilla side of the attack.

Although Mozilla shut down the account that the attacker broke into “shortly after” the company discovered that it had been compromised, there is still more work to be done:

We are updating Bugzilla’s security practices to reduce the risk of future attacks of this type. As an immediate first step, all users with access to security-sensitive information have been required to change their passwords and use two-factor authentication. We are reducing the number of users with privileged access and limiting what each privileged user can do. In other words, we are making it harder for an attacker to break in, providing fewer opportunities to break in, and reducing the amount of information an attacker can get by breaking in.

Additionally, Mozilla said it has notified relevant law enforcement authorities about the incident. The company may also take “additional steps based on the results of any further investigations.”

 

Credit: 

 

 

 

PlayStation 4 – Firmware 1.76 has been Hacked

Hackers “Break” PS4 Firmware 1.76 – Webkit Exploit Now Available for the Console

While Sony is getting a kick out of the immense success of its latest PlayStation 4 console, hackers are busy trying to break the code and find a tractable way into the system, and it looks like they have already done the trick. Following the PlayStation Vita webkit exploit that was released almost a week ago, two hackers have now successfully released PlayStation 4 webkit exploit by working on, and extending the hack that was used on Sony’s handheld console. The latest webkit exploit breaks the current firmware 1.76 of the PlayStation 4 through a vulnerability found in the web browser of the console.

 

It looks like the first step towards the hacking point of Sony’s latest video game console has been taken. Almost a week ago, an ex-PSP hacker, called Davee, managed to break into the PlayStation Vita console and develop a first native hack, known as webkit exploit, for the handheld. Now, after working on the same hack, developers nas and proxima have managed to develop a similar webkit exploit and make it compatible with the latest PlayStation 4 console by breaking into the firmware 1.76 that is currently running on the system.

Although PlayStation 4 webkit exploit is developed parallel to the PlayStation Vita exploit, it actually works in a very similar way. Wololo has published the proof of concept of the exploit, which provides several samples and allows users to check if their console is vulnerable. The tools it comprises of include downloadable dump modules and script to create advanced ROP code that could pay off in the right hands. The code itself looks perfectly legit, as the developers who are responsible for this webkit exploit have a notable track of record in console hacking. It looks like it won’t be long before users start to confirm the exploit’s validity.

The PlayStation 4 webkit exploit is actually a vulnerability found in the web browser of the console running on the latest firmware 1.76, and just like the PlayStation Vita’s exploit, it will not be very useful to end users. However, it does provide some basic tools that developers can use to explore its functionality and come up with something new. This exploit is the first step towards the PlayStation 4 hacking point ever, so it comes as a massive breakthrough.

The publication of the new exploit coincides with the announcement of the official release date for the PlayStation 4 firmware 2.0 update that is currently known as “Masamune”. The exploit has been rumored to be patched in the upcoming update so it is needless to say that if you plan on checking the hack for yourself, it might be wise not to update your console.

ps4-webkit-exploit-confirmed-to-run-on-playstation-4-firmware-1-76-41761-2

If you already willing to check out the hack, you can download all the PlayStation 4 webkit exploit files, sources etc. provided by nas and proxima form here.

Credit:  Fahad Arif, wccftech

Apple IPhone5 iOS6 – new features same vulnerabilities…

Well, Here is something that Samsung “didn’t steal” and “left” on Apple side, a very bad security design…

The iPhone 4S, and the iPhone 5 as well, are vulnerable to same attacks from malicious Web pages that can steal the user’s pictures, contact information and browsing history and send it all to a remote server.

Wednesday, at the Mobile Pwn2Own contest at the EUSecWest conference in Amsterdam, a pair of Dutch security researchers successfully exploited a completely patched iPhone 4S.

The duo, Daan Keuper and Joost Pol from The Hague-based computer security company Certified Secure, said their proof-of-concept hack works on both iOS 5.1.1 and the version of iOS 6 that was given to developers several months ago, and made available to users Wednesday.

Keuper and Pol said iPads are also vulnerable to this attack. While the two haven’t had a chance to test an iPhone 5 running the final build of iOS 6, it is likely also at risk, they told Computerworld.

The malicious code — technically, a drive-by download — took only a few weeks to create and can be embedded anywhere on a website to work, Pol said.

When placed in a graphic or advertisement on a blog visited by Mobile Safari, the code figures out a workaround for Safari’s sandboxing and signing mechanisms.

Users don’t need to do anything but visit the booby-trapped page for the malware to work. While the attack is able to steal a lot of sensitive data, email and SMS messages are separately encrypted and are not vulnerable to this particular attack.

Keuper and Pol wouldn’t reveal exactly how their attack works, but told that it involved a zero-day exploit, one that’s not yet known to most security specialists.

They also told that they wouldn’t do it again.

“We shredded it from our machine,” Pol said. “The story ends here. … It’s time to look for a new challenge.”

Despite this chink in the iPhone’s armor, Pol said he still thinks the iPhone is more secure than any other mobile device.

He said that BlackBerry and Android devices, which that run the same WebKit rendering in their browsers as iOS’s Safari, could also be open to this exploit, but haven’t been tested. Pol hopes Apple fixes the exploit soon and that users download the patch as soon as possible.

Last year, security researcher Charlie Miller snuck a malicious proof-of-concept app into Apple’s iTunes App Store that could also steal data from iPhones.

For their successful hack of Mobile Safari, Pol and Keuper together took home $30,000.