Spread Firefox Site Hacked, Data Leaked
By Nate Mook | Published July 15, 2005, 1:28 PM
The Mozilla Foundation marketing site SpreadFirefox.com, which is designed to promote adoption of Firefox, was hacked over the weekend, officials said in an e-mail sent to users on Friday. Attackers exploited a security vulnerability and potentially accessed personal information of the site's registered users.
The breach was not discovered until July 12, and the Web site was subsequently taken offline. Mozilla Foundation officials believe the compromised server was only used to send spam, but opted to err on the side of caution and contact users.
"It doesn't look like the attacker accessed any personal data on the site, but to be safe, we're encouraging all of our users to log in and change their passwords," read a notice posted by Mozilla engineer Asa Dotzler. "If you have an account with Spread Firefox, you probably received an email about this with instructions for updating your password."
Information provided by Spread Firefox users and stored on the server include a real name, a URL, an email address, IM names, a street address, a birthday, and private messages to other users.
News of the hack is a black eye for Mozilla, which prides itself on security when compared to Microsoft's Internet Explorer browser.
"The Mozilla Foundation deeply regrets this incident and is taking steps to prevent it from happening again. We have applied the necessary security fixes to the software running the site, have reviewed our security plan to determine why we didn't previously apply those fixes in this case, and have modified that plan to ensure we do so in the future."
The Foundation said in its e-mail that only SpreadFirefox.com was affected and not any other Mozilla owned site, including the mozilla.org server that serves Firefox downloads.
hxxp://www.stopie.com/
My preccccioussssss. :p
Score: 0
|Ya, you aren't childish Mr.1337....
Score: 0
|SpreadFirefox.com runs off the drupal.org CMS system, therefore technically it's not mozilla or firefox or spreadfirefox.com's fault.
Score: 0
|@ c4p0ne
I just read through the hostile, childish as well as racist (yes that's what it is : beware about that) statements in this forum.
That is why I will never visit this site again.
Some like FireFox : let them
Some like MS-IE : let them
Some like other internet explorers : let them
Please don't tell me that everybody on this globe became "holy" extremists.
What car do you own ? Do you despise everybody who drive another brand as well.
My goodness, what a buch of self-sucking people in here : just desgusting !
Score: 0
|Hostile == Microsoft, not me
Childish == Kids in 3rd grade. not me.
Racist == Uninformed, uneducated statement/opinion. No comment.
"I'll never visit this forum again" : Thanks. Don't let the door hit you in the bleep on the way out.
Score: 0
|Baby Steps...
The Mozilla Foundation has a long way to go to reach Microsofts "claim to fame". This little incident might reflect on Firefox but perhaps I'm being too pessimistic. On the other hand, if as much effort was spent securing the webserver as was developing Firefox then we have every right to be even more concerned. Aside from having to remove a trojan dialer from Firefox lately, I find its bloated usage of RAM quite appealing. But there's always room for other browsers on my hard drive.
Score: 0
|Acronym time!
ROFLMFAO! Bloated is a synonym for Microsoft, what the heck are you talking about "bloated memory usage of FF" ha!
=) =)
Score: 0
|I don't see any really amazing here. Sure a site with users names and information was hacked. Also the site is in testing phases. I'm much more concerned about losing my credit card number honestly.
The article states "News of the hack is a black eye for Mozilla, which prides itself on security when compared to Microsoft's Internet Explorer browser.", yet how many end users even care anymore? People hear about computer hackings daily. Many major companies have already been hacked, no one cares. What people care about is Viruses, spam, and popups.
Honestly how does the security of one web server effect Firefox's security?
In a week or two who is really going to care?
Score: 0
|This is crystal clearly the devious disgusting illegal underhanded bush-like immoral kniving act of M$'s hired h4x0r goons. Clearly no server that hosts any kind of page is ever 100% safe from a successful penetration.
M$ used this fact to it's advantage by simply spening a BUTTLOAD of $$ (which is basically like 3 cents to them) to hire "the right goon for the right job". Well, they got someone that could successfully defact the page.... Whoopty mother fin' doo..
Why? OMG please, they don't like the fact that their going to LOSE this battle (M$ will NOT tollerate losing even if it means screwing the end-user) and so they stoop to the lowest slimebuckety level of having someone(s) deface the site to strike a ghhheeii a$$ blow to the FF community (because they fear IE's death).
Well guess what. F IE. FF will continue to spread despite this TASTELESS attempt at an indirect smearing.
Score: 0
|wow, if you actually believe the bs you are spewing forth, you arent very smart
Score: 0
|genious, pure genious...
an amazingly objective and un-biased point.
*applauds*
(sarcasm)
Score: 0
|The proof is in the pudding. Why the hell would anyone want to deface a damn site promoting a g** d*** BROWSER??? Well, there IS one more alternative reason but it just doesn't stand up to the M$ hired-goons explanation. And that is that FF being undeniably superior to IE in every way imaginable, is generating a crapload of "uneasiness" among the tag-team spammer/hax0r industry because of its' resistance to ad-crap. THUS, in an effort to curb the adoption of FF, they did this to inject "question" into the minds of naive end-users. "Well shiznit, spreadfirefox got hacked so hmmm, what does that say about the browser?? maybe I'd be better off with IE".
The fact is, that no, you're NOT better off with IE. Dump it and by doing so you'll be giving a big F U to both M$ AND philthy lowlife spammers who wan't to turn your box into a spam-zombie.
FF > IE. Period
Score: 0
|People deface sites that have 3 visitors a month. FF got owned.
Score: 0
|You can make your post more short but still as more informative:
"Microsoft is guilty in everything because it is Microsoft" :D
It's microsoft, microsoft is everywhere, but i will resist, i will delete IE, Windows, I will run my hard drive through magnetic field 9000 guassians total for it to become pure of microsoft corrupted software... :D
Sorry, can't help to write it here :)
Score: 0
|dude... settle down.... it was probably some punk college kid in his grandmother's basement...
There are geeks all over the place that do this sort of stuff just for fun.
Score: 0
|Exactly, this isnt some sort of master plan by microsoft, its some kid who decided it would be fun to hack a page. They dont pick the page because its a browser site, but simply because it was fun for them and they knew it would get them attention for their hack. People hack many many lesser known sites all the time, would you think its big bad microsoft if they hacked, oh say, apple.com or linux-mandrake.com? Probably not. You just hate MS so much you think that any sort of defacement or negativity towards firefox is done by them. Get over yourself.
Score: 0
|could be....... could beee. :-0
Score: 0
|OK first off, what proof do you have this was MS? I don't want theories or conjecture, I want proof. You can't provide any, so shut up.
Second. None of you people actually program, if you did, you would actually be able to consider the sheer daunting task it would take to bring down another's product. Maybe, just maybe there is another browser out there, like Opera, that maybe they have a motive. MS makes ZERO money from IE. None. Its not even on their top 10 products they support. Its not even a promoted product. It happens to come with the OS, which by the way, if everone would back up to '95 BEFORE Win95 came out in Beta, people b****ed, yes b****ed about *NOT* having a built in browser. IT was spawned from PEOPLE complaining that they wanted a *REAL* OS to include a browser, so MS at the last minute included it.
Ever since thing people have been bashing MS for this, that and the other. If you don't like their products quit using them. ITs that simple. If you think you can better, be my guest. When you finally come to the realization that building an OS is way more involved than just making it work for Doom, Quake, and Browsers, you will see how involved it is.
Its very, very, very difficult to get programmer who make drivers, services, and programs work, and follow the guidelines set forth in the OS list. Things like a unified way to install/uninstall.
Everyone forgets, MS builds an OPEN architecture based OS. Yes, its OPEN. That means, EVERYONE is free to contribute and build for it, as you please, and MS asks NO royalties. Yes, MS supports it, disseminates it, and builds it. But they do accept input. Its just like voting for a president. If you *DON'T* vote, you don't have a say, and shut the **** up.
If you did vote, and you didn't get who you wanted, Tough! That's free enterprise, democratic society, you don't like that, move to Iraq.
Its the same thing with the OS. You have a choice. You don't like it, since you didn't come up with a better solution, then you are stuck with it, until you can do better. If you do like, and its not what you expected, tough! The 90% of people that use, love it. Otherwise it would not survive this long.
The OS is here to stay. Whether you like it or not. There is Unix, Linux, Apple, Sun, BeOS and a bevy of other variants, feel free to use one of those, and quit bashing MS products.
I know MS isn't perfect, what in this world is? Nothing, that's what. But I happen to like it, and I deal with the problems. If you can't deal with the problems, then maybe an etch-a-sketch is more your speed.
Attacking and crippling another product is just stupid. And insanely difficult to do. This bulls*** about MS crippling Netscape and having something to with hacking a website is total bulls***, and I am sick of hearing about it. The amount of reprogramming it would take to figure out how to disable another product, is 10 times more than just simply fixing the problems in your own product, and making it that much better.
MS does not profit from IE. In fact, IE is one of their loss leading products, to get you to use their email and its just included with the OS, because that's what the people wanted. Now the people have a choice, and *OTHER* people are pissed that their grandmother voted to have IE included, so she wouldn't have to download a browser. Download the Netscape, Firefox, Mozilla, and Opera. No one is stopping you. They all work fine. And this conspiracy theory bulls*** needs to stop. Quit smoking crack, and hanging out at the local bar getting high with your buddies, because you are talking out of your ass.
Score: 0
|They DO NOT complain about the browser being packed into the OS, they actually agree it, it's a good thing,
They actually complain about the problem with integration with the OS and the activeX that results in severe security problems.
Score: 0
|Did you write the script for Hackers?
Score: 0
|Luckily I just had an account... For some reason I didn't even have my Name on the account, which is required! My account profile was 100% empty other than an email address and password.
Score: 0
|to: imtoomuch
opera does not belive in such tactics
Score: 0
|Yes, it doesn't guarantee FF elemination, carpet bombing of Mozilla server is far more effective.
"It's opera guy to tactics center..."
Joking :P
Score: 0
|I bet it was the Opera owner. He's still pissed about the one Firefox guy that proved that CNet never named Opera the Browser of the Year...
I'm joking. If you're offended, get over yourself.
Score: 0
|Tip of the day,
"Information provided by Spread Firefox users and stored on the server include a real name, a URL, an email address, IM names, a street address, a birthday, ..."
never give you personal info on any web site.
Score: 0
|...there is that.
Personally, I think the best way to ensure a secure computer, is to format the hard-drive and leave it. Never install anything - not even the OS - and I guarantee you'll never get hacked.
Score: 0
|Great point wincement!
In todays age these things happen. The only way to cope with it is to accept the age we are in. Living in total paranoia all the time is just plain stupid. Never do that and never do that will get you nowhere!...
Yes! I admit that it is not very plesant knowing that some completely moron is sitting in his chair and getting a stiffy by hacking this and that. Probably he feels like god right now that sick bas****.
But spreading fear will only create more chaos... As soon as some fancy smanchy security system is created, simultaniously another way to hack it is on it's way. That's the way it is. It's a no-win race towards what?
Score: 0
|well i can't simply imagine why someone will leave it's home address, birthday and real name on any site, any...
Maybe for receiving presents at home on the birthday with they name on it, lol
Score: 0
|NO site??
well I don't know how you could receive anything you buy online without giving them your home address... they sorta have to have somewhere to ship it to.
Other sites collect address/birthday/other information purely for demographic reasons so that they know who their audience is. I see no problem with that. It's not like they're going to come blow up my house on my birthday.
Just make sure you know the people you're giving your info to are trustworthy (not a **FREE IPODZ** site).
Score: 0
|Ok m8, that is your opinion,
and i hope you never need to change it.
p.s i was already like you once, on my internet beginings
Score: 0
|For demographics, all you really need is a zip code :P You don't need names and addresses. Hi I'm John Doe and I live on 123 Main Street.
Score: 0
|Someone had to proove them wrong. That and if you want a real answer they boasted about that 10% market share...people are using the browser and that is true. What does it mean? You are now in the same boat with everyone else because when someone writes something they are going to make sure it works in IE and Firefox. Congrats! Firefox is now a real browser!
Score: 0
|I rather listen to Led zeppelin and stare at a strope light than offend anyone.Please accept my apology.
Score: 0
|IE is just wrapping application for Explorer :)
Explorer is part of Windows :P
Score: 0
|First, how is installing a program "scotch taping"? Operating systems are made to have programs installed to improve the functionality. Have you ever installed an instant messaging program? Why? That is just scotch taping; you should have just used Windows Messenger. Install an office program? Why didn't you just use Notepad and Wordpad which are perfectly good for word processing?
Firefox definitely adds functionality to Windows/IE, whether you use it or not, such as tabbed browsing, some rss support, and an extension system.
Score: 0
|A "scotch tape" remark like that depresses me that some one could be so close minded. Just because a program comes by default or closely integrated into the OS doesn't make it any better - in some cases it is worse.
If you don't like the browser that is fine, but have you at least tried it out before making your opinion? If not you should it runs great. For me it performs 10x (times) better than IE on my machine (P4 2.8GHz, 512MB RAM, 120GB SATA, and 128MB Nvidia Video).
Score: 0
|Yeah,your right.
Score: 0
|Ironic
Score: 0
|It wasn't me, promise! (joking)
Score: 0
|Oh my... terrible. Again comments like "IE still buggy", "IE has less security", "Windows s*cks, Linux rulz". I don't get the point how BROWSER security is related to SERVER security.
And please, don't start IE vs FF vs Opera discussion once again, it pains already, really. This article is about something different, don't you think?
Score: 0
|I agree with you there i wasn't sayin anything about windows or linux i was just stating the fact that right away people started making assumptions about servers, and OS's when that really has nothing to do with it. its all web security that cuased this whole thing.
Score: 0
|Don't take it personal, I wasn't addressing someone in particular :)
Score: 0
|yeah... the browser wars get old really fast. I just try to ignore them now. They will NEVER end.
Score: 0
|I think this says a lot about their stand concerning security, it's not important!
May I also note that more security related bugs are found in Firefox this year than in Internet Explorer and that Opera still has the best security record of all graphical browsers!
Score: 0
|But IE has more unresolved bugs. :/
Check out places like Secunia.
Score: 0
|The way I see it, computer security consists of the following:
90% - User knowledge
9.95% - The security programs the user has installed (AV, anti-spyware, firewall) and system configuration (is the user always logged on as admin?)
0.05% - The browser being used
My two cents =/
Score: 0
|I would've said:
60% - User Knowledge
33% - Security Programs
6% - Browser being used
Although security programs can be improperly used, or ignored, many can be setup so a novice computer user can't disable them.
Score: 0
|yeah. The improper use is why I say 90% user knowledge. I know people that have Zone Alarm and just click "Allow" on everything that pops up. The firewall is completely useless to them.
And if you don't know what programs to use in the first place (one anti-spyware program is not enough), you're screwed from the start.
Score: 0
|What server are they running Windows? NOPE Linux Apache. And they have the nerve to say that IE is not secure. Maybe they should clean their house out first before they complain about others.
Score: 0
|Windows PC are most likely to get hacked than Linux Server's. By the way everything will get hacked no matter what Operating System you are running, that's a fact. In addtion, Firefox not only has less security problems than Windows IE it runs faster and better and it does not too many spyware problems
Score: 0
|running a linux server with apache or running a windoze server with IIS has nothing to do with hacking. when someone hacks a website its due to the lack or security that that site has. one thing i notice when i signed up for this site its not SSL secure. another thing is that its a beta site still its not fully done. so that site is open to many attacks and has made it easy for hackers to get in like they did this weekend. i have been using firefox since its development alpha and beta stages and yes firefox is MORE secure than IE will ever be. so please before you post your comments people should know what they are talking about and not start pointing fingers right away and making assumptions.
Score: 0
|very nice and vaild point that you make there.
Score: 0
|I know all system are unsecure, but I know for a fact that firefox is not more secure then IE. It is about the same. Just you don't hear about all the security problems. The fact that most linux user(open source) think they are more secure is why I am compaining. Since we are finding out more and more that they are NOT
Score: 0
|You both are just as biased as the others. Its the person(s) who set up the web server that are at fault. They should know better. It's no different that it is the users fault for getting spyware (or have their system compromised in any other way) installed on their pc. Don't blame the browser, blame the idiot using it. I use IE and Firefox and have never had a problem with either.
Score: 0
|How untrue that really is. I do alot of security tests on programs including firefix 1.0.5 and I find you still (after 5 new releases) can get viruses & spyware onto your computer without any userinteration. All by going to a website.
Score: 0
|I agree. 95% of all virus and spyware that get onto the user's machine is due to the user agreeing to it.
I just don't like the fact that alot of people in alot of newsgroups say IE(MSFT) is so insecure, when Firefox and the opensource community are having the same problems.
I too use Firefox and IE.
Score: 0
|You're not far off the mark, really
Firefox is more secure than IE in the sense that user intervention is required in Firefox to install problem components, however, without users learning not to just agree to every installation, or download anything that sounds useful, better security is basically meaningless.
Score: 0
|Put up or shut up, where are your facts?
Score: 0
|HAHAHAHAHA
Score: 0
|Yea, but its strength — extensions — is the source of its biggest weakness, and also causes FF to crash out of nowhere. Why Mozilla doesn't have a team of folks "certifying" extensions doesn't make sense. Just incorporate the most popular ones into the browser and be done. There's always something wrong with FF and constantly tending to its problems gets old fast.
Score: 0
|Studies have shown that Linux Operating systems are less secure that Windows.
Score: 0
|Studies have shown food kills people.
Score: 0
|>> Just incorporate the most popular ones into the browser and be done.
You mean like Opera, except without the ads?
Score: 0
|You seem to be confused. IE minus ActiveX(and not integrated with windows) is as secure as FF.
IE(integrated with windows) is less secure than FF. IE with ActiveX support is far less secure, unless a knowledgable user manually changes all the security settings.
Score: 0
|No it isn't
http://www.safecenter.ne...RELLAWEBV4/ie_unpatched/
Score: 0
|Meh, ActiveX and integration with windows are still its biggest holes.
Score: 0
|That's probably because of all the people that switch from Windows to Linux just to save money and have no freaking clue what they're doing.
I'll admit it, I'm one of them. I'm still learning...
Score: 0
|yup
Score: 0
|ummm, if ActiveX isn't a security problem why do you think the MS morons finally added a feature that blocks them from being installed, then asking your permission to install the ActiveX controller. The factures are sitting right on every Windows users computer.
Score: 0
|Re-read what I commented on. I didn't say that ActiveX isn't insecure. My comment implied that IE is not as secure as FireFox.
Score: 0
|Still, these extensions only have effect on the browser (which has a safe mode -w/o extensions), not on the operating system, unlike the ActiveX-controls, it can mess up everything. Unfortunately IE doesn't have a "safe mode", luckily the OS has ;)
But I agree about certifying, but I think that will cost too much money.
Score: 0
|were you born yesterday? sure... linux is very unsecure... have you tried managing or even using linux? try using windows with firewall, anti-spywares, and anti-virus intalled and for 5 straight days surf the internet. let's see what happens even with "protection". now do the same with any distribution of linux without firewall, anti-virus, or even anti-spywares installed. on the sixth day, i'll be shoving my foot up your a$$ where it belongs.
Score: 0
|of course that will happen. no matter how good the developers are, firefox is one of the most unsecure browser on this planet. viruses, trojans, spywares, & worms would still be installed on your computer even without user interaction. it is, after all, running on windows.
Score: 0
|aaa, my mistake
Score: 0
|