Zero Day

Ryan Naraine, Emil Protalinski and Dancho Danchev

12-year-old finds critical Firefox flaw, earns $3,000 bounty

By Ryan Naraine | October 22, 2010, 4:22pm PDT

Summary: The security researcher who found and reported this critical buffer overflow and memory corruption vulnerability in Mozilla’s Firefox browser is none other than Alex Miller, a 12-year-old boy who earned a $3,000 bounty for his discovery.

The security researcher who found and reported this critical buffer overflow and memory corruption vulnerability in Mozilla’s Firefox browser is none other than Alex Miller, a 12-year-old boy who earned a $3,000 bounty for his discovery.

According to the San Jose Mercury News, Miller (right) was motivated to search for Firefox security holes after Mozilla increased its bug bounty from $500 to $3,000.

The seventh grader, described as a “Firefox loyalist,” had previously reported a Firefox vulnerability but that one did not qualify for the cash payout.

Alex returned to the computer and his exploration. By Alex’s estimation he spent about 90 minutes each day for about 10 days until he spotted it–a flaw in the memory of the running program.

The vulnerability, which can be exploited to crash a victim’s browser and potentially run arbitrary code on their computer, was patched this week in Firefox 3.6.11 and Firefox 3.5.14.

It also affects Mozilla’s Thunderbird 3.1.5, Thunderbird 3.0.9 and SeaMonkey 2.0.9.

ALSO SEE:

Mozilla increases flaw bounty to $3K, adds Firefox Mobile

Firefox dirty dozen: Mozilla patches ‘critical’ browser flaws

* Image via MercuryNews.com.

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

More from “Zero Day”

Exploit published for unpatched Adobe Shockwave vulnerability

Apple unbundles Flash Player from Mac OS X; Java next

Topics

Mozilla Firefox, Bounty, Web Browser, Mozilla Corp., Alex, Bug Bounty, Web Browsers, Internet, Ryan Naraine

Ryan Naraine is a journalist and social media enthusiast specializing in Internet and computer security issues.

Full Bio
Disclosure
Contact

Vendor HotSpot

The 360° Conversation around Cloud Computing

TECH VISUALIZER brings the social conversation to life... powered by Brocade

Learn More »

Comments

Add Your Opinion

Join the conversation!

Follow via:: RSS; Email Alert

Just In

Would it affect linux?

Tom6 28th Oct 2010

Would the flaw have affected a linux system or just Windows (again)?

In linux a bug is where a really unlikely combination of events on an out-dated system might lead to soem minor problem. At worst you are going to have to run updateds and probably wont even have to reboot.

In Windows a bug is when thousands of machines world-wide have been crashing and passing around infections for months or even years before a patch gets released.

Regards from
Tom happy

View in thread

Please Select
Please Select

0 Votes

+ -

Good for him, but where was all that vaunted peer review

croberts 22nd Oct 2010

Seriously... all those open source programmers who can review each other's code before it makes it into a release and yet the bugs keep coming.

I think it's time to admit that programming isn't like going to home depot and doing your own plumbing. Yes anyone has the theoretical ability to find and fix their own bugs, there is only a tiny fraction of the population with the time/skill/resources to actually bother.

Reply
Flag

0 Votes

+ -

RE: 12-year-old finds critical Firefox flaw, earns $3,000 bounty

betelgeuse68 22nd Oct 2010

@croberts

Uh... I'm guessing you never have written code.

-M

Reply
Flag

0 Votes

+ -

FLOSS promises are as credible as Obama's "summer of recovery"

LBiege Updated - 24th Oct 2010

They throw all the lip stick and some more at their piggy products trying to convince you that they can fly, which fools only college nerds rather than real world Pros.

0 Votes

+ -

RE: 12-year-old finds critical Firefox flaw, earns $3,000 bounty

PMC-CON Updated - 25th Oct 2010

@betelgeuse68 So what happened with the peer review? This kid has been writing code for twenty years? Oh wait, he's only twelve, probably needed to learn to read first .....

0 Votes

+ -

RE: 12-year-old finds critical Firefox flaw, earns $3,000 bounty

Cardhu 26th Oct 2010

@betelgeuse68: A static code analyzer could have found the buffer overflow. There is no excuse for the defect to have been there at all.

Yes, I have slung code. I have over 15 years of engineering experience in systems software development for extremely large, highly distributed, hard-real-time safety-critical systems.

The present culture of American software development regards defects as just part of business as usual. In this modern era with readily available tools and proven methods for preventing defects, this cultural acceptance of defective work is unacceptable.

0 Votes

+ -

RE: 12-year-old finds critical Firefox flaw, earns $3,000 bounty

x I'm tc 23rd Oct 2010

@croberts This IS that peer review.

Reply
Flag

0 Votes

+ -

Umm no it's "even a 12 year old can spot this bug" review. And it was after

Johnny Vegas 23rd Oct 2010

the release not before. He asked where's the PEER, as in thousands of professional experienced programmers, review that would have caught this BEFORE release. FOSS peer reviews don't work well on FireFox or any other open source projects. Look how many times more security vulnerabilities linux has than windows even though it contains so much less functionality.

0 Votes

+ -

So many fallacious assumptions, so feww sentences

Letophoro Updated - 23rd Oct 2010

@Johnny Vegas

He asked where's the PEER, as in thousands of professional experienced programmers, review that would have caught this BEFORE release.

Assumption 1: That all contributors to FOSS projects are professional experienced programmers. Many contributors are people who code for a hobby.

Assumption 2: All bugs are caught by peer review. As someone who gets paid to write and review code, some bugs will make it through peer review no matter how rigorous.

FOSS peer reviews don't work well on FireFox or any other open source projects.

Assumption: FOSS peer review is any less rigorous than peer review at Microsoft, Google, or Adobe. Given the number of paid programmers at those software development houses, they should be entirely bug-free at each and every release.

Look how many times more security vulnerabilities linux has than windows even though it contains so much less functionality.

Assumption: Equating the number of publicly patched vulnerabilities with the number of vulnerabilities that actually exist. In actuality, the number of vulnerabilities in Windows is unknown simply because the code is not publicly available. That is to say, MS relies on keeping their source code private to minimize their exposure to exploits while FOSS software relies on public exposure of their code to minimize exploits. For a relative comparison of the effectiveness of those approaches, research the number of MS patches that remove exploited vulnerabilities with the number of FOSS patches that remove potential vulnerabilities.

0 Votes

+ -

RE: 12-year-old finds critical Firefox flaw, earns $3,000 bounty

doh123 Updated - 23rd Oct 2010

@Johnny Vegas
"Look how many times more security vulnerabilities linux has than windows even though it contains so much less functionality."

LOL... thats the funniest joke I've heard on ZDNet yet! Less functionality, thats hilarious.

0 Votes

+ -

This IS that peer review

Cardhu 26th Oct 2010

Note that the kid spent 1.5 hours a day over 10 days just to find the defect. At a typical full software engineer's salary of $70,000 a year or $35 an hour, that's an extra $350 just to find that one single defect. That does not include fixing the defect and retesting the corrected code.

The point is that peer reviews are inefficient. They take too long and find too few defects in the time they have available. An effective development program will use defect prevention methods and automated analysis tools to shift much of the burden from peer reviews. Then peer reviews can focus on bigger and more important questions that machines cannot address, such as why one particular design approach (e.g. a sorting algorithm) was chosen over another.

0 Votes

+ -

RE: 12-year-old finds critical Firefox flaw, earns $3,000 bounty

SkyBon 26th Oct 2010

@Johnny Vegas hello to you too, troll!

0 Votes

+ -

RE: 12-year-old finds critical Firefox flaw, earns $3,000 bounty

Media Whore 25th Oct 2010

@croberts "where was all that vaunted peer review"

Do you really think that all (or even most) closed-source code goes thru peer-review? ROFLMAO.

Yes, I work for a company that produces (non-mass market) closed source systems.

Reply
Flag

0 Votes

+ -

RE: 12-year-old finds critical Firefox flaw, earns $3,000 bounty

PMC-CON 25th Oct 2010

@croberts Amen, Amen, Amen, Amen.

And how many blackhats found this flaw first and exploited it w/o us knowing?

Reply
Flag

0 Votes

+ -

RE: 12-year-old finds critical Firefox flaw, earns $3,000 bounty

DevonS 25th Oct 2010

@PMC-CON in response to this, i have one word. adobe.

0 Votes

+ -

RE: 12-year-old finds critical Firefox flaw, earns $3,000 bounty

tkejlboom 25th Oct 2010

@croberts

Yes, only a select and rarified group, like 12 year olds. My God, whatever shall we do if we run out of 12 year olds? Hmm, I suspect we my have bigger problems should the supply of 12 year olds dry up.

Reply
Flag

0 Votes

+ -

RE: 12-year-old finds critical Firefox flaw, earns $3,000 bounty

snoop0x7b 26th Oct 2010

@tkejlboom The good thing about free software is anyone can review the sourcecode. If that person happens to be 12 years old and they have a real suggestion or comment, who cares? It's not like this guy is one of the principal software architects behind firefox... He's just a random programmer who reviewed the code and found something.

Who cares who noticed the bug so long as it's fixed?

0 Votes

+ -

RE: 12-year-old finds critical Firefox flaw, earns $3,000 bounty

rengek Updated - 25th Oct 2010

@croberts
It never cease to amaze me at how clueless people are when it comes to software development. My users no longer question why we don't take short cuts or why some things that seem like it should be a breeze to fix isn't. Why? Because I involved them in a big way in testing with some of our products. Talking about it does nothing. But once they saw the iterative process and the HUUUUUGE number of combination of things that can happen because they wanted a particular set of crazy features, thats when they realize why bugs are hard to find and why it is hard to test. The combination of test cases just goes on and on and on. its impossible to test for everything unless you have unlimited resources, lots of time on your hands, a management team who is ok with you taking your time (yeah right), no new releases, 1 single platform and no changes to requirements half way through development (because that never happens, yeah right again).

The people who complains about it are usually the one's who created the situation by changing their minds. Thats why I advocate IT dragging their users into testing. It really opens their eyes.

Reply
Flag

0 Votes

+ -

how clueless people are when it comes to software development

Cardhu 26th Oct 2010

@rengek: Yes, I've been there too.

The expectation that defects just happen and it's the job of testing to find them is a very unreasonable one. As you state, stakeholder education on the limits of testing within budget and time constraints is essential for the test team's proper role and capabilities to be understood.

The truth about software engineering is that perfection is practially impossible to attain. It is possible to attain for a very well-defined problem, e.g.:

http://www.adaic.org/news/praxis-nsa.html

But the approach requires an attention to specifying the solution that takes longer than most customers or management organizations will allow:

http://www.praxis-his.com/pdfs/c_by_c_better_cheaper.pdf

http://software.isixsigma.com/library/content/c060719b.asp

However, perfection is a far loftier and productive goal than mediocrity. Mediocrity is implicit in the "defects just happen - they're testing's problem to find."

0 Votes

+ -

RE: 12-year-old finds critical Firefox flaw, earns $3,000 bounty

garethmcc 25th Oct 2010

@croberts This IS peer review .... Thats what open source is about that anyone (including a 12 year old) can find a fault in the software. I bet proprietary vendors dream that they can get that kind of code coverage.

And FYI, the only reason you hear about bug fixes more in OSS isn't because there are more bugs to catch, just there isn't a rug to sweep them under.

Reply
Flag

0 Votes

+ -

RE: 12-year-old finds critical Firefox flaw, earns $3,000 bounty

Cardhu 26th Oct 2010

@croberts: Or even a decent static code analyzer.

Reply
Flag

0 Votes

+ -

RE: 12-year-old finds critical Firefox flaw, earns $3,000 bounty

Jimster480 26th Oct 2010

@croberts Just because its open source doesnt mean that its bug free. If I contribute something to a project, that doesn't mean that every other person who works on the project is going to review my code. Probably someone will review my code before including it, but that person may or may not be as skilled as me, and may or may not understand what my code is doing while reviewing it. And even if they do, there is no guarentee that they will find any bugs, whether or not they are there.

Reply
Flag

0 Votes

+ -

RE: 12-year-old finds critical Firefox flaw, earns $3,000 bounty

snoop0x7b 26th Oct 2010

@croberts Commercial code has a lot of vulnerabilities as well... It's just a matter of how it's found and how quickly. FOSS can potentially have more eyes on it which is good. Personally, I write commercial enterprise software for a living and contribute to some free software projects.

In a lot of cases the same people writing the "golden" commercial software are writing the free software. I've seen "great" programmers with college degrees make really dumb elementary mistakes, I've seen self-trained programmers catch those mistakes... Your programming pedigree doesn't matter, great programmers come from all walks of life, and in a lot of cases professionals work on free software because it's the right thing to do.

Reply
Flag

0 Votes

+ -

Would it affect linux?

Tom6 28th Oct 2010

Reply
Flag

0 Votes

+ -

RE: 12-year-old finds critical Firefox flaw, earns $3,000 bounty

cybursoft 23rd Oct 2010

I found a flaw in wine firefox ,but i never reported it because i'm not sure they consider "wine " a real application.Anyway with wine firefox you can paste data from another firefox an it will log you into the secure page you were on (? -- ). That is a hole if i had ever seen one aye? happy

Reply
Flag

0 Votes

+ -

RE: 12-year-old finds critical Firefox flaw, earns $3,000 bounty

Who Am I Really 25th Oct 2010

@cybursoft

not a hole per se but rather because 2 or more Firefox windows all run under & share the same process, whether in Windows, Mac, etc.
so your authentication is passed from one window to another, just the same as passing authentication between tabs works

it's not like starting notepad 3 times starts 3 separate instances of notepad in separate memory spaces

Reply
Flag

0 Votes

+ -

RE: 12-year-old finds critical Firefox flaw, earns $3,000 bounty

robbiethe1st 25th Oct 2010

@Who Am I Really
That's very true.
In addition, if you want to look at "security holes", copying your profile folder to another machine also copies all saved sessions, cookies and saved passwords.
On the other hand, that's also considered "functionality", so...

0 Votes

+ -

RE: 12-year-old finds critical Firefox flaw, earns $3,000 bounty

MoeFugger 23rd Oct 2010

Good going kid.

Reply
Flag

0 Votes

+ -

I agree.

mhbowman@... 25th Oct 2010

@MoeFugger

How'd this get side tracked into a discussion of different detection methods, and Windows VS Linux??

The REAL story here is that a 12 year old had the ability and tenacity to come out ahead of everyone.

Good Job Alex!!!

Reply
Flag

0 Votes

+ -

12 years?, is it a netscape vulnerability?

magallanes 25th Oct 2010

:-3

Reply
Flag

0 Votes

+ -

RE: 12-year-old finds critical Firefox flaw, earns $3,000 bounty

MLHACK 26th Oct 2010

@magallanes

Probably i bet one of this kids parents worked for netscape ;-O

Reply
Flag

0 Votes

+ -

RE: 12-year-old finds critical Firefox flaw, earns $3,000 bounty

danny@... 25th Oct 2010

At least Mozilla doesn't get paid to produce "non-peer reviewed" code - See Patch Tuesday...

Reply
Flag

0 Votes

+ -

$200 per hour

Mahegan 25th Oct 2010

Now that's real bug-hunting incentive 3k$ / (90 minutes x 10 days)
Perhaps it speaks to the attention span of adults!

Reply
Flag

0 Votes

+ -

RE: 12-year-old finds critical Firefox flaw, earns $3,000 bounty

kurtesmaximus Updated - 25th Oct 2010

I have a 12 year old, he's far more interested in bugs found in CoD:MW2.
Good job Alex!

Reply
Flag

0 Votes

+ -

RE: 12-year-old finds critical Firefox flaw, earns $3,000 bounty

jmwells21 Updated - 25th Oct 2010

Way to go kiddo! GIT-R-DONE!

Reply
Flag

0 Votes

+ -

RE: 12-year-old finds critical Firefox flaw, earns $3,000 bounty

pjdiller 25th Oct 2010

we can at least agree that evidently neither open source nor a propriety/private development model can keep smart people from trying and succeeding in finding a way to exploit code to their own benefit.

Reply
Flag

0 Votes

+ -

RE: 12-year-old finds critical Firefox flaw, earns $3,000 bounty

DevonS Updated - 25th Oct 2010

@pjdiller finally a non-stupid comment about the FOSS exploits. thank you so much

Reply
Flag

0 Votes

+ -

RE: 12-year-old finds critical Firefox flaw, earns $3,000 bounty

BL PUMPK9 25th Oct 2010

Man alive kid... go outside!

Reply
Flag

0 Votes

+ -

Like Old Times

kg6ygs@... Updated - 25th Oct 2010

Reminds me of the good ol' days when there were a lot of teenage hackers out there testing the limits of systems that could only be accessed via dial-up modems. (Remember the 300-baud telephone cradle modems?) A lot of times programmers had a hard time debugging each others code because they all tended to think the same way and miss more obscure issues simply because it had never occurred to them. More often than not, these kids on the outside had no experience with structured programming guidelines to limit their point of view, just the fun of breaking into a system and finding unexpected holes; it was great because you actually got rewarded for your work, usually by employment, and the software developers gained a much broader view of how people think out of the box in order come up with a more secure product. Now, if you're not careful, you'll get arrested. Good for Mozilla for encouraging it and good for Alex for taking advantage of it.

Reply
Flag

0 Votes

+ -

RE: 12-year-old finds critical Firefox flaw, earns $3,000 bounty

MowGreen 25th Oct 2010

The bug is *fixed* in Mozilla?s Thunderbird 3.1.5, Thunderbird 3.0.9 and SeaMonkey 2.0.9 according to Mozilla Foundation Security Advisory 2010-65, Ryan.

Reply
Flag

0 Votes

+ -

RE: 12-year-old finds critical Firefox flaw, earns $3,000 bounty

alex9113 25th Oct 2010

I choked on my pop when I saw this. I'm 15 years old and have alot experience in linux and programming. I wonder how he discovered it!

Reply
Flag

0 Votes

+ -

RE: 12-year-old finds critical Firefox flaw, earns $3,000 bounty

Goldie07 25th Oct 2010

you can argue all you want on the internet, but even if you win you are still retarded

Reply
Flag

0 Votes

+ -

Why all the hate?

Ketura 25th Oct 2010

So many people seem eager to jump out and play the "if a 12 year old can find it, the system is broken" card, but no one seems to comment on the fact that this kid searched for an hour and a half for ten days before he found it--I don't know of many adults that would do something like this outside their jobs, let alone twelve year olds. The kid's dedicated, and apparently quite capable. I'd find that the more remarkable point than that the open source method of bughunting missed it (although there's also the point to make that this WAS the open source model working).

Reply
Flag

0 Votes

+ -

RE: 12-year-old finds critical Firefox flaw, earns $3,000 bounty

Simba7 25th Oct 2010

We need more people like him in the Open Source area. Awesome job!

Instead of bashing this kid, congratulate him. He could've been like the (possibly) other kids that could've exploited the flaw instead of bringing it to everyone's attention.

It's nice to see another white-hat in the works.

Reply
Flag

0 Votes

+ -

RE: 12-year-old finds critical Firefox flaw, earns $3,000 bounty

rynovz1 25th Oct 2010

"...Miller was motivated to search for Firefox security holes..."

Hell, this boy should be outside playing with his friends.

Reply
Flag

0 Votes

+ -

Years ago

gkiefferjfk2@... 25th Oct 2010

Back in the dark ages [1980's & early 1990's] many BBS SYSOPS had me check out their running bbs programs for bugs. WHEN found and i gained access to their computer through the running bbs program i just left a text message telling the person of the bug... AND I DIDN'T GET ANY MONEY... Well.... Back then it was CHEAP BUG CATCHER PAY....

Reply
Flag

0 Votes

+ -

RE: 12-year-old finds critical Firefox flaw, earns $3,000 bounty

awells@... 26th Oct 2010

Say what you want about the review process, but I think he's damn smart! If his parents keep him well rounded in activities so he doesn't become a nerd he will be set for life. He has the brains so he will most likly go to MIT. Forget the review process, your looking at the next generation that will drive the information age.

Reply
Flag

0 Votes

+ -

You get what you paid for

jtollack 26th Oct 2010

I browsed to the Mozilla site and clicked "download now" and was not prompted for a credit card, or minutes of advertising, nor license keys. Works pretty darn well for a product I paid nothing for. I run a security suite and firewall and have no issues. And I will happily download the patch that this impressive kid help get into distro.