Mozilla Replaces Firefox GPG Key After Accidental GitHub Exposure

Mozilla has announced the revocation and replacement of a GPG signing subkey crucial for verifying the authenticity of Firefox and Thunderbird software artifacts. The decision stems from the accidental exposure of the subkey in a private GitHub repository, a move taken to preempt any potential supply chain risks.

While the exposed key was a private subkey, its presence in a repository accessible to a limited group of developers necessitated immediate action. The primary concern with exposed GPG keys is the potential for attackers to sign malicious files, making them appear as legitimate software releases. This could enable sophisticated supply chain attacks, where compromised download mirrors or social engineering tactics could deliver malware disguised as authentic updates.

Fortunately, Mozilla's internal review found no evidence that the exposed key was accessed by unauthorized parties during its brief presence in the repository. The key was primarily used for signing artifacts such as Linux tarballs, RPM packages, and checksum files, meaning the potential impact was somewhat contained. However, the organization opted for a precautionary approach, emphasizing its commitment to software supply chain security.

To mitigate any residual risk and bolster future security, Mozilla has not only revoked the compromised key and issued a new one but has also implemented enhanced protections to prevent similar incidents. These measures aim to strengthen the security posture around key management and code signing processes.

Most end-users of Firefox and Thunderbird are unlikely to be affected by this change and do not need to take any specific action. The browser and email client's update mechanisms are designed to handle key rotations seamlessly. However, users who manually verify GPG signatures for downloaded artifacts will need to import the new key and acknowledge the revocation of the old one.

Specific instructions have been provided for users who rely on Firefox RPM packages, as these may require manual intervention to ensure continued verification of software integrity. Mozilla's detailed guidance aims to assist these users in navigating the transition to the new GPG key.

The incident underscores the increasing vigilance required in software development and distribution, particularly in light of the escalating number of supply chain attacks observed globally. Organizations are increasingly adopting a zero-trust approach to key management, rotating signing keys proactively at the first indication of potential compromise.

By taking swift action, Mozilla demonstrates a commitment to maintaining user trust and safeguarding the integrity of its widely used open-source software. The replacement of the GPG key, coupled with strengthened internal controls, reinforces the security of the Firefox and Thunderbird ecosystems.