@attackanddefens[email protected] - Mozilla's Security Internals for Security Engineers, Security Researchers, and Bug Bounty Hunters.
Joined February 2020
- Tweets158
- Following8
- Followers1.5K
- Likes25
Attack and Defense retweeted
There is a post making rounds about how a fingerprinting script from Alibaba’s AliExpress interrupted someone’s bluetooth headphone connection. AliExpress was trying trying to discretely track users, but was thwarted by Firefox’s anti-fingerprinting technology.
Attack and Defense retweeted
After a long pause, a new video coming today!
Part 1 of small documentary about Pwn2Own…
Attack and Defense retweeted
bugzilla.mozilla.org/show_bu…
This is a big change for DOM Clobberers. Firefox Nightly no longer allows native document properties to be overwritten by elements with a name attr, e.g.:
<img src=a name=currentScript>
<script>
alert(document.currentScript)// HTMLScriptElement
</script>
Attack and Defense retweeted
Good find. This is now fixed @FirefoxNightly. Sorry, no fun allowed.
Attack and Defense retweeted
We're turning the big 2-0 this year! Help us celebrate by sharing your best Firefox fan art 🔥 tag us or use #FirefoxArt by 11/01 so we don't miss it.
(you just might score some fun surprises too...)
Attack and Defense retweeted
In partnership with @cure53berlin we have uncovered a serious security risk during an in-depth review of #RingDoorbell.
Our concerns and calls to @amazon have gone unaddressed.
Learn how your #RingDoorbell could be putting you at risk: mzl.la/3MSk9pg
Attack and Defense retweeted
Last Christmas I popped a shellÂą on hg.mozilla.org
Here's the fix:
hg.mozilla.org/hgcustom/vers…
Can you explain the bug?
FAQ:
* This is an authenticated vuln
* I'll post a writeup in the next days
* Yes, RTFM helps ... as usual
Âą) actually it was two shells
Attack and Defense retweeted
Haven’t reported anything to Mozilla for a few years, but this is something pleasant to wake up to in the morning.
I spent quite a long time finding/crafting the minimal PoC for this report.Thanks the Mozilla team for being flexible on the reward for this. @TomRittervg @dveditz – at New Zealand
Attack and Defense retweeted
Attention Firefox bug bounty hunters: WebGPU is now enabled by default in Firefox Nightly and eligible for bounty rewards. It's a large chunk of new code with plenty of attack surface for everyone to share.
bugzilla.mozilla.org/show_bu…
Attack and Defense retweeted
I recently found and reported some issues in Thunderbird. There is now a new release of Thunderbird available.
"Thunderbird 102.2.1 contains high-impact security fixes; users are encouraged to update as soon as possible."
thunderbird.net/en-US/thunde…
Attack and Defense retweeted
Just got done with #blackhat2022 today. Super fun! Sharing slides from our blackhat talk "Don't Get Owned by Your Dependencies: How Firefox Uses In-process Sandboxing To Protect Itself From Exploitable Libraries (And You Can Too!)"
shravanrn.com/blackhat-rlbox…
Attack and Defense retweeted
Getting packed for my first #blackhat2022 and #DEFCON30 (just friday though) in a while. Hit me up if you want to talk Firefox Security / Bug Bounty.
Attack and Defense retweeted
We just released Firefox Desktop 100.0.2, Firefox Mobile 100.3.0 and Firefox ESR 91.9.1 in response to the exploits demonstrated at #Pwn2Own.
Attack and Defense retweeted
Firefox 100 incorporates a big improvement in process isolation: removing access to the Win32k APIs. @gcpascutto covers the details:
hacks.mozilla.org/2022/05/im…
Attack and Defense retweeted
Here are the slides from the "Security Analysis of MTE Through Examples" talk I presented at @BlueHatIL :) I hope you will like it and find it interesting! github.com/saaramar/security…
Attack and Defense retweeted
From Bug Bounty Hunter to Edge Security teammate: microsoftedge.github.io/edge…
Attack and Defense retweeted
Here are the slides from the "Attacking JavaScript Engines in 2022" talk by @itszn13 and myself @offensive_con. It's a high-level talk about JS, JIT, various bug classes, and typical exploitation flows but with lots of references for further digging! saelo.github.io/presentation…
Attack and Defense retweeted
Except from the @MozillaSecurity Firefox Security Newsletter/FSN-2021-Q3 (wiki.mozilla.org/Firefox_Sec…): "Now, we have received and successfully evaluated a research prototype for fuzzing the IPC Layer. " - Congratulations @ms_s3c and @is_eqv!
Attack and Defense retweeted
Really great to see this grant to improve Javascript JIT security go to @deiandelmars and @hovav.
cse.ucsd.edu/about/news/comp…
