Attack and Defense

@[email protected] - Mozilla's Security Internals for Security Engineers, Security Researchers, and Bug Bounty Hunters.

[Attack and Defense @attackndefense]

Please report bugs. If you - or someone else - improves exploitability after initial report, the bounty will be increased. If you're second reporter, you will be pro-rated.

I guess I can only speak for our bounty program but come on industry, you can do better.

#bugbountytips

[Mustafa Can İPEKÇİ @mcipekci]

Do not report open redirects without fully analyzing and seeing potentials of it. Thanks to random guy who reported open redirect, our report for full SSRF leaking client secret of integration claimed dupe.

Again: do not report open redirects #bugbountytips

[Firefox @firefox]

There is a post making rounds about how a fingerprinting script from Alibaba’s AliExpress interrupted someone’s bluetooth headphone connection. AliExpress was trying trying to discretely track users, but was thwarted by Firefox’s anti-fingerprinting technology.

[Attack and Defense @attackndefense]

@parityzero @0xcharlie We talked to various participants . We did not scramble some offsets. We actually found the same bugs they had….

[Attack and Defense @attackndefense]

@nullspec7or lots of duplicates.

[Attack and Defense @attackndefense]

6 Firefox entries at pwn2own.
5 withdrawals due to our 150.0.3 security release.
1 failed attempt.
0 Exploits.

No incidents.
Time to party :)

[Attack and Defense @attackndefense]

Reminder that our bug bounty program accepts PoCs (e.g. , verifiable in an address sanitizer builds that you can find here https://t.co/ovY7HAM43k).

No need to write a full exploit.

More here https://t.co/lTEoqzuQ4U :)

[Attack and Defense @attackndefense]

@pwning_me Sorry to hear it did not work out. Let's meet at the conference, we're happy to accept a non-working exploit in the bug bounty program even if it's just a poc. :)

[Attack and Defense @attackndefense]

Sorry this broke your chain @qriousec, @trichimtrich, @lanleft_, and @wiz1340. Would love to compare notes if you still make it to Berlin.

[Attack and Defense @attackndefense]

Great bug, thank you for the detailed report.
We just released 150.0.3 to fix this.

https://t.co/lPxe7ZBKP8

[ggwhyp @ggwhyp]

I was hoping to compete in Pwn2Own with a Firefox full-chain entry, but unfortunately it was rejected. I’ve reported the vulnerability to the Mozilla team.

[Attack and Defense @attackndefense]

@pwning_me This year has been pretty fast moving, even for us. We will have people on site and would be happy to meet you.

[Attack and Defense @attackndefense]

@S1r1u5_ We'll be on-site and are happy to take bug reports in person :)

[Attack and Defense @attackndefense]

@ggwhyp Should be fixed soon, thank you :)

[Attack and Defense @attackndefense]

@SinSinology 👀

[Attack and Defense @attackndefense]

@qriousec There was a Firefox 150.0.1 update last week and a Firefox 150.0.2 update just today. Make sure that it still works and we're looking forward to meeting you next week :)

[Attack and Defense @attackndefense]

When we said that we found and fixed hundreds of bugs in Firefox using AI, people were skeptical and said: Where are the bugs?

Well, here they are. We are unhiding 12 security bugs that are representative of the issues we have found.

https://t.co/aIZ8p1Wxso

[Attack and Defense @attackndefense]

https://t.co/AVP3o8D4tR

[Attack and Defense @attackndefense]

@S1r1u5_ @rs_loves_bugs @pwning_me @S1r1u5_ @rs_loves_bugs
If you are coming to Berlin in two weeks and found your bugs squashed in a Firefox update, tell us your story. We will bring Firefox swag :)

[Attack and Defense @attackndefense]

We just published our recent Firefox Security and Privacy highlights in the Q1 newsletter. Take a look —> https://t.co/FbmNCmwCWJ

[Attack and Defense @attackndefense]

@LiveOverflow The bug info is public, including test case and patches. If you want to follow along, look at bug https://t.co/dNi1tgydQQ (Day 1 exploit) and https://t.co/C7KUB09xcb (Day 2)

[Attack and Defense @attackndefense]

See @LiveOverflow's documentary on Firefox and pwn2own and learn what it was like to fix not just one but TWO Firefox security bugs at rapid time. https://t.co/ipH9EMBTSf

[LiveOverflow 🔴 hextree.io @LiveOverflow]

After a long pause, a new video coming today!

Part 1 of small documentary about Pwn2Own…