Fifefox hacker exposed as a fraud

By Tom Sanders on Oct 4, 2006 10:06 AM
Filed under Security

Reported Firefox flaw incapable of remote code execution,
hacker admits.

A security expert who claimed to have discovered a critical vulnerability in the open source Firefox browser has retracted his original claims.

Mischa Spiegelmock over the weekend demonstrated a Javascript vulnerability at the Toorcon hacker conference in San Diego. At the time he claimed that the flaw would allow for remote code execution and boasted that he knew of at least another 30 undisclosed vulnerabilities.

Spiegelmock has now admitted to Mozilla that his security vulnerability would only crash the browser and that he had been unable to execute arbitrary code.

"The main purpose of our talk was to be humorous," he said in a statement that was posted on the Mozilla website.

"I do not have 30 undisclosed Firefox vulnerabilities, nor did I ever make this claim. I have no undisclosed Firefox vulnerabilities. The person who was speaking with me made this claim, and I honestly have no idea if he has them or not."

"I apologise to everyone involved, and I hope I have made everything as clear as possible."

Mozilla security chief Window Snyder prior to Spiegelmock's confession had reported that the vulnerability was incapable of remote code execution. She said that despite the limited risk to end users, the software developer still takes the issue seriously and will continue its investigation.