Mozilla Accidentally Put a Firefox Signing Key on GitHub. Here's Why You're Probably Fine.
A private key used to authenticate Firefox and Thunderbird downloads was briefly stored in the wrong place. Mozilla has replaced it and found no sign anyone misused it.
Key points
- Mozilla announced on Monday that it accidentally stored a private GPG signing key, used to verify Firefox and Thunderbird downloads, in a GitHub repository.
- The repository was private and restricted to a small group of Mozilla developers who already had legitimate access to the key.
- Mozilla's review of access logs found no evidence that an unauthorised person ever saw or copied the key.
- Mozilla has revoked the old key and issued a new one; most users need to do nothing.
- Anyone who manually checks digital signatures on Firefox or Thunderbird packages will need to import the new key.
A GPG signing key is essentially a secret stamp of approval. When Mozilla releases Firefox, it uses this key to produce a digital signature, a cryptographic tag that proves the file came from Mozilla and was not tampered with after it left the building. Someone who stole that key could stamp their own malicious files with what looks like Mozilla's seal of approval.
That's the worst-case picture. The actual picture is considerably less alarming.
How did this happen?
Somebody on Mozilla's team accidentally committed, meaning uploaded, an unencrypted copy of the key to a GitHub code repository. GitHub repositories are normally where software teams store and share their code. This one was set to private, meaning only a small group of Mozilla developers could see it, and every one of them already had authorised access to the key through other channels.
Mozilla checked its audit logs, the records of who accessed the repository and when, and found no sign that anyone outside that circle ever reached the key.
Could criminals have used this to push fake Firefox updates?
In theory, yes. In practice, the barriers were steep. The repository was private. Access was limited. Even if someone had obtained the key undetected, they would still have needed a way to get their tampered files onto users' computers, perhaps by corrupting a download mirror or tricking someone into visiting a fake site. That's a multi-step attack, not a simple one.
Mozilla's statement was direct: "Our review of available audit records found no evidence that the key was accessed by an unauthorized party while it was present in the repository."
Still, Mozilla revoked the key (formally cancelling it so it can no longer be trusted) and issued a fresh one. It has also added controls to stop the same mistake happening again.
| Detail | Information |
|---|---|
| Key type | GPG private signing key |
| Affected software | Firefox and Thunderbird (Linux tarballs, RPM packages, checksum files) |
| Repository visibility | Private, restricted to a small developer group |
| Evidence of misuse | None found in audit logs |
| Action taken | Key revoked, new key issued |
What should ordinary Firefox users do?
For most people: nothing. Firefox updates through the normal browser update mechanism are unaffected.
If you are a Linux user who manually verifies GPG signatures on downloaded packages (you would know if you did this), you need to import Mozilla's new public key and the revocation notice for the old one. Mozilla has published step-by-step instructions for people using RPM packages, the package format common on Red Hat-based Linux systems.
If you downloaded Firefox or Thunderbird recently and it behaves normally, there is no reason for concern. First reported by SecurityWeek, this story is one of process improvement, not active attack.
