[Swordmaker]

The key to avoiding the worst of this is regularly quitting your browsers and starting them up from scratch. Don’t allow them to continue running in the background while you do other things or your computer or device sleeps or hibernates. Do you browsing and QUIT the browser. On restarting, don’t let your browser reload previous tabs on restarting.

[ImJustAnotherOkie]

All it takes is a little Windex.

[Swordmaker]

Multi platform, multi browser vulnerability survives leaving webpage and can produce huge cross platform bot nets. Affects Windows, Macs, Android. iOS, and Linux machines using the majority of modern browsers using an extremely hard to detect new modality of attack on the Internet websites. —PING!

Pinging dayglored, ShadowAce, and ThunderSleeps for your lists.

Cross platform and browser vulnerability Ping!

If you want on or off the Mac Ping List, Freepmail me.

[Windflier]

"Academics from Greece have devised a new browser-based attack"

Academics? I have to believe that something's been lost in translation there.

[SgtHooper]

Will caching be a path to exposure, and perhaps launching the browser in the background without user noticing?

[grey_whiskers]

Merde.

[Revel]

“Neither the original MarioNet attack or the subsequent botnet operations require attackers to exploit browser vulnerabilities, but merely abuse existing JavaScript execution capabilities and new HTML5 APIs.”

So much for HTML5 being safer than Flash.

As for Java Script it is better to block it on any site that you don’t trust. If can’t read the site without it then just leave the site. Nothing is more dangerous than JavaScript.

[Texas Fossil]

I’ve had this type of exploit happen since I upgraded my Debian 8 Linux machine to a more recent Firefox version. The upgrade made my No Script plugin not work and changed my Java Script package. Another issue is how Firefox manages the security package, I’ve helped it some with changes that I made to TLS methods. There are not graphic adjustments for it, they must be done via about:config

It takes a little time to understand and I’m still having browser crashes.

Also noticed something called [Web content] and it’s -child ‘s that make something like a denial of service attack.

I have no doubt some people are planning to monitor our content and block it actively. It is probably not just Firefox that is on the block.

Firefox has been the best common browsers as far as security is concerned. But they did take Soros money a couple of years ago. Need I say more?

[Texas Fossil]

This may be related too.

New Metasploit Payloads for Firefox Javascript Exploits
https://blog.rapid7.com/2014/01/23/firefox-privileged-payloads/

[BTerclinger]

This doesn’t surprise me, for years if you had youtube open and playing in Safari on Mac and then closed a MacBook Air, the youtube video would keep playing.

The first time I reported this they made me document it like crazy, then it got fixed and now it’s happening again and it seems like it’s a common problem with either background SW still running after the lid is closed, or a corrupted SMC or NVRAM or PRAM.

https://www.guidingtech.com/47697/macbook-sleep-issues/

Not surprising that some hacker scum are taking advantage of this or something similar to run a process as described in your article.

We need Saudi punishments for hackers. Chop off their hands.

[ShadowAce]

[Darnright]

https://zdnet2.cbsistatic.com/hub/i/r/2019/02/25/a1818560-0938-450c-b664-29ccb65557a8/resize/370xauto/e9c6741fd6695234f66fd7ab92156c4a/marionet-compatibility.png

Regarding the table you referenced, I’m assuming Opera is also compromised as well? Opera shows up as chrome when I use it (and I use it primarily on the laptop I have running UBUNTU).

[Jumper]

This is something released into the wild from some country’s cyber warfare toolbox. Wikileaks has many of the CIA toolbox’s from Snowden’s treasonous activities.

[Future Useless Eater]

With firefox, I entered   about:config   then searched for "serviceworker". It listed 11 preference items.

One of them was...

dom.serviceworkers.enabled   TRUE

So I plan to toggle that to FALSE and let the chips fly. Hopefully only sh*t webpage code will be negatively affected.

if necessary, messing with the other ten preferences might also be a good idea.

[Pete from Shawnee Mission]

Thanks Swordmaker!
Have one of those Browsers!

(How was the cruise?)

[GOPJ]

The key to avoiding the worst of this is regularly quitting your browsers and starting them up from scratch.

Thanks Swordmaker

[Openurmind]

It can even happen here at the FR with no ads. Go hit the Marshmallow Beer thread and watch the processes and connections. Everyone needs to be careful from what source they link to on here. Those links complete a connection to spam API services in our browsers.

[Excellence]

And clear your cookies/cache.