Potent Firefox 0-day used to install undetected backdoors on Macs

[LASER_oneXM]

Content source

https://arstechnica.com/information-technology/2019/06/potent-firefox-0day-used-to-install-undetected-backdoors-on-macs/

So far, attacks are known only to target Mac users involved in cryptocurrency.

Hackers exploited a pair of potent zero-day vulnerabilities in Firefox to infect Mac users with a largely undetected backdoor, according to accounts pieced together from multiple people.

Mozilla released an update on Tuesday that fixed a code-execution vulnerability in a JavaScript programming method known as Array.pop. On Thursday, Mozilla issued a second patch fixing a privilege-escalation flaw that allowed code to break out of a security sandbox that Firefox uses to prevent untrusted content from interacting with sensitive parts of a computer operating system. Interestingly, a researcher at Google's Project Zero had privately reported the code-execution flaw to Mozilla in mid April.

 

[Windows_Security]

Reported in April, so should not be disclosed yet (90 days), so the hackers did find the vulnabilities themselves and choose to attack Mac's. Intresting.

 

[shmu26]

It was a spear-phishing attack on the staff of a certain crypto-currency org. This was not the kind of thing that could infect home users by random surfing.