Firefox Zero-Day Can Be Used To Unmask Tor Browser Users (computerworld.com) 55
An anonymous reader quotes a report from Computerworld: A Firefox zero-day being used in the wild to target Tor users is using code that is nearly identical to what the FBI used in 2013 to unmask Tor-users. A Tor browser user notified the Tor mailing list of the newly discovered exploit, posting the exploit code to the mailing list via a Sigaint darknet email address. A short time later, Roger Dingledine, co-founder of the Tor Project Team, confirmed that the Firefox team had been notified, had "found the bug" and were "working on a patch." On Monday, Mozilla released a security update to close off a different critical vulnerability in Firefox. Dan Guido, CEO of TrailofBits, noted on Twitter, that "it's a garden variety use-after-free, not a heap overflow" and it's "not an advanced exploit." He added that the vulnerability is also present on the Mac OS, "but the exploit does not include support for targeting any operating system but Windows." Security researcher Joshua Yabut told Ars Technica that the exploit code is "100% effective for remote code execution on Windows systems." "The shellcode used is almost exactly the shellcode of the 2013 one," tweeted a security researcher going by TheWack0lian. He added, "When I first noticed the old shellcode was so similar, I had to double-check the dates to make sure I wasn't looking at a 3-year-old post." He's referring to the 2013 payload used by the FBI to deanonymize Tor-users visiting a child porn site. The attack allowed the FBI to tag Tor browser users who believed they were anonymous while visiting a "hidden" child porn site on Freedom Hosting; the exploit code forced the browser to send information such as MAC address, hostname and IP address to a third-party server with a public IP address; the feds could use that data to obtain users' identities via their ISPs.
Re: (Score:3)
What does this have to do with Trump.
They should change this site to trumpdot.org!
Hey, that's not fair. Only half the stories are Trump-bashing. The other half are Facebook or Reddit bashing.
Re: (Score:1)
Re: (Score:2)
What does this have to do with Trump.
They should change this site to trumpdot.org!
Hey, that's not fair. Only half the stories are Trump-bashing. The other half are Facebook or Reddit bashing.
Geez, way to feel Microsoft marginalized...
Re: (Score:2)
Hey, that's not fair. Only half the stories are Trump-bashing. The other half are Facebook or Reddit bashing.
I know right? I'm appalled by this, it is discrimination! There should be mandatory bashing quotas to ensure that all bashing is fair, equitable and evenly distributed. No favoritism! Equal rights for all!
Re: (Score:1)
What does this have to do with Trump.
They should change this site to trumpdot.org!
Finds a non-Trump article on Slashdot, complains about how everything on Slashdot is related to Trump.... Well you're not technically wrong, you're just stupid.
Relevant sig
headline resummarized: Tor!=Panacea (Score:1)
Re: (Score:2)
Right, at the very least you need to install a perfectly clean VM taking all the default install options on the OS so you don't do anything that might be identifiable or make it more unique. Make sure you do not enable any of the host integration stuff, no copy paste, don't install the VMware tools, ensure all the host isolation stuff is on, don't even allow the power status or system clock to the VM. Only then do you install tor. After that take a snapshot. Be sure to revert to that snapshot each and e
Re: (Score:1)
Right, at the very least you need to install a perfectly clean VM taking all the default install options on the OS so you don't do anything that might be identifiable or make it more unique. Make sure you do not enable any of the host integration stuff, no copy paste, don't install the VMware tools, ensure all the host isolation stuff is on, don't even allow the power status or system clock to the VM. Only then do you install tor. After that take a snapshot. Be sure to revert to that snapshot each and ever time you use the VM before you do any tor browsing! Start over and make a fresh build every few months as you can't trust upgrade processes won't leave something finger-printable and using a browser even a few months old might separate you from the masses somewhat now that most of the world auto updates.
Or you can skip all that bullshit and just boot a TAILS [boum.org] CD.
Re: (Score:2)
That is not the very least. That is a whole bunch of extra work when entire distributions exist just to obviate the need for this. Take a look at tails.
It is, of course, recommended to put it on a usb stick and clean boot hardware off the stick to use it; however, there is nothing stopping you from bringing it up in a VM if you are ok with the trade offs.
Accomplishes the same thing, for less work, and with a much larger already setup base which will be identical to other users, in ways that increase the wor
Re: (Score:2)
I am sorry I can't agree. There are going to be ALOT more people running a stock Windows 8.1 or stock Ubuntu than any of the 'privacy' distributions, all of which almost certainly can be finger printed. If you want to blend into the heard I would certainly pick on of those two platforms.
I like the idea of running tor an a separate VM from the one you do your browsing on.
Re: (Score:2)
> I like the idea of running tor an a separate VM from the one you do your browsing on.
It is a proxy and most of the attack vectors attack the end client, not the network itself.... the tor client needs internet access, the client behind it can only harm itself with direct acces.... so don't give it...not even dns, nothing. Just port 9050 alone and only one responding IP.
Maybe drop another interface on there and log all the non-port 9050 traffic as well :)
Use NoScript (Score:1)
Use NoScript and forbid scripts globally and this will mitigate the exploit.
Re: (Score:2)
IKR having scripting turned on by default is one of the dumbest things they have ever done.
I remember back when it was disabled by default and they said not to turn it on because it was a security risk.
Re: (Score:1)
Use NoScript and forbid scripts globally and this will mitigate the exploit.
Or I think uMatrix [github.com] will work? (howto [adamantine.me])
Re: (Score:2)
Does the code run from the whitelisted site visited or its on a third party site that expects a browser to allow it to work?
Re: (Score:2)
What?! where?! I want an @amazon.com
Firefox Zero-Day Can Be Used To RUN CODE (Score:2)
The bug can be used to run any code of an attacker's choosing.
Re: (Score:2)
Re: (Score:2)
The bug can be used to run any code of an attacker's choosing.
Funny thing about this, the security conscious IT department of the company I work for insists that we all ought to prefer Firefox yet all the developers for the most part use Chrome. Bwah hah hah hah.
Windows and Javascript (Score:1)
Again a Windows and javascript explot. Use linux or bsd, and disable javascript from the config.
Re: (Score:1)
Re: (Score:3)
Fixed even before this story got published (Score:3)
Great work by Mozilla and the [mozilla.org]Tor Project [torproject.org] on the lighting fast (
And yes, NoScript [noscript.net] did protect against this (the Tor Browser has it built-in, for users who know what they're doing).
Re: (Score:2)
And yet the fix that they chose to implement STILL causes Firefox to crash. Just not in an exploitable manner. Seems kind of non-ideal to me.
Re: (Score:1)
You're always welcome to submit patches yourself. -PCP
Re: (Score:3)
Don't use the Tor browser on a darknet! (Score:3)
It probably seems crazy to tell you not to use the official darknet browser on a darknet, but sadly the Tor browser is the top attack vector used by law enforcement against darknet users. It's the biggest target by far. You have to roll your own darknet browser. It's a PITA but otherwise, every exploit in the TLA's books is going to be aimed at you. Also it should go without saying that your browser should be running in a Linux VM whose state is discarded on shutdown, and ideally you should have a firewall setup that blocks all outgoing traffic not going to the darknet proxy address.
Re: (Score:2)
I may be totally wrong, but iirc the previous exploit tricked the browser into visiting a non-tor site controlled by the FBI which then collected the information.