Mozilla announced on Monday that it has issued a new GPG signing subkey used for some Firefox and Thunderbird artifacts after the previous key was accidentally exposed in a GitHub repository.
In general, if a GPG private signing key used for software releases is exposed, an attacker who obtains it could create valid signatures on malicious files.
This creates a supply chain attack risk: the attacker could distribute modified or malicious versions of the software that appear authentic. Successful exploitation would still require a way to deliver the signed files to users, for instance via a compromised mirror, an alternate download path, or social engineering.
However, in Mozilla’s case, the potential impact is mitigated by several factors.
The exposed GPG key was used to sign Firefox and Thunderbird artifacts such as Linux tarballs, RPM packages, and checksum files. An unencrypted copy of the key was inadvertently committed to a GitHub repository, but it was a private repository accessible only to a small group of Mozilla developers who already had access to the key via other means.
“Our review of available audit records found no evidence that the key was accessed by an unauthorized party while it was present in the repository,” Mozilla said.
Nevertheless, the organization has decided to revoke the exposed key and issue a new one. In addition, it has added protections to prevent similar incidents in the future.
Mozilla noted that most users do not need to take any action. Users who manually verify GPG signatures will have to import the new key and revocation for the old one. In addition, those who use Firefox RPM packages may need to take some steps — Mozilla has shared detailed instructions for them.
It’s not surprising that Mozilla has decided not to take any chances. Given the well-documented surge in software supply chain attacks over the past year, organizations are increasingly rotating signing keys at the first sign of potential exposure.
Related: Over 400 NPM Packages Infected in ChainDrop Supply Chain Attack
Related: Multiple Jscrambler Packages Impacted by Supply Chain Attack
Related: North Korean Hackers Target Open Source Developers in Supply Chain Attacks