Saturday, July 16, 2005

Spread Firefox Security Warning

Spread Firefox marketing site has been hacked.

Change your password.

This just in, discovered in my, yes, my Yahoo email inbox, which I miraculously gained access to.

Guess what?

The other sign in screens that I couldn't penetrate: may have been phishing screens, trying to steal my username and password to Yahoo. The screen that let me access looks rather different, in subtle ways, from the non-admission screen that kept rejecting my username and password.

Who has time to muck around with such stuff? But it's part and parcel of being a net inhabitant. Any suggestions or comments would be appreciated from other Yahoo email users.

Now, back to Firefox.


On Tuesday, July 12, the Mozilla Foundation discovered that the server hosting Spread Firefox, our community marketing site, had been accessed on Sunday, July 10 by unknown remote attackers who exploited a security vulnerability in the software running the site. This exploit was limited to and did not affect other web sites or Mozilla software.

We don't have any evidence that the attackers obtained personal information about site users, and we believe they accessed the machine to use it to send spam. However, it is possible that the attackers acquired information site users provided to the site.

As a Spread Firefox user, you have provided us with a username and password. You may also have provided us with other information, including a real name, a URL, an email address, IM names, a street address, a birthday, and private messages to other users.

We recommend that you change your Spread Firefox password and the password of any accounts where you use the same password as your Spread Firefox account. To change your Spread Firefox password, go to, log in with your current password, select "My Account" from the sidebar, select "Edit Account" from the sidebar, then enter your new password into the Password fields and press the "Save user information" button at the bottom of the page.

The Mozilla Foundation deeply regrets this incident and is taking steps to prevent it from happening again. We have applied the necessary security fixes to the software running the site, have reviewed our security plan to determine why we didn't previously apply those fixes in this case, and have modified that plan to ensure we do so in the future.

The Mozilla Foundation


[signed] Steven Streight aka Vaspers the Grate

No comments: