Slashdot Mirror
FBI May Be Hoarding a Firefox Zero-Day (softpedia.com)
An anonymous reader writes: Vice reported at the end of March that the FBI and the U.S. Department of Justice are fighting tooth and nail to keep a Tor Browser exploit hidden from the public eye. Computer experts were quick to point out that this Tor Browser exploit, technically speaking, is a Firefox exploit, since Tor's browser is based on Firefox's ESR platform. Taking into account that Firefox follows open-source philosophy and reveals all security flaws reported, the effort which the FBI puts into restricting access to its exploit leads to only one conclusion, and that is that the FBI is hoarding a Firefox zero-day, currently unpatched in the browser's core -- something it hopes to use once again.
hoarders don't just have ONE.
It feels like we're coming to a head here with regards to the government and technology. At some point, we will have to find a reasonable solution to the problem of something which is strong enough for us, but in some way allows the government (with an appropriate warrant) to access data. If we (the tech community) don't come up with a solution, at some point an inferior one might be forced on us. Imagine a significant (nuclear) terrorist threat that could be averted if the government could access X or Y. In the aftermath of such a threat (or, in the worst case, attack), public opinion will force a change. Let's find a solution. Perhaps we need a new way of encrypting things that allows a third "government" key? I know the anti-government types will shy away from this, but, with a warrant, is this so unreasonable?
Cemil.
Nor is it proven that the problem is within Firefox...it could as well be in the Tor modifications to Firefox...if, indeed, there is such a problem at all.
Wild speculation, whether here at /., or at Motherboard, is absent evidence. If I were an agent of the FBI and I DIDN'T know ANYTHING about some putative "back door" into Tor, I'd claim I did, to scare the #$&*%^ out of people who DO use Tor. They can, apparently, legally do that with impunity as officers for the law.
Until there's evidence to support this idle speculation, it is bunkum.
I think I can speak for most of the internet in saying "Oh, shit!"
C|N>K
It feels like we're coming to a head here with regards to the government and technology. At some point, we will have to find a reasonable solution to the problem of something which is strong enough for us, but in some way allows the government (with an appropriate warrant) to access data.
This statement seems to be based on a common misinterpretation of what a warrant is. Search warrants allow the police to search for things, but they do not necessarily guarantee that they will find what they're looking for, and most importantly, the existence of warrants does NOT incur an obligation on the public to live their day-to-day lives in such a way that future searches (with warrants) will be successful. Requiring computer users to use weakened or backdoored software for the simple reason that a warrant might be issued at some future time turns the Fourth Amendment to the Constitution entirely on its head
If I can be modded down for being a troll, can I be modded up for being an orc, or a balrog?
>Since the US DoJ is mounting an all-out assault to keep the Tor Browser exploit out of the public eye, common sense dictates that this is a previously unknown issue, otherwise, why bother.
Must every story on Slashdot about data security, privacy and the law be linked to articles that are so fucking hysterical in tone, so lacking in facts but so plentiful in speculation, and written so amateurishly (read: like a blog)?
http://imgur.com/uomFe7A
They have no respect for anything in the US anymore. Citizens, the Constitution, the Bill of Rights and anything else that gets in their way. Regardless if that way is against the very principles of the founding fathers or anybody's father.
The FBI has at least one zero-day exploit for Firefox. The thought that they wouldn't is just a flight of fantasy. The FBI is crooked, it has been for much longer than we thought sad to say. At least the current director doesn't wear dresses. Nothing to see here, move on, move on.
Do You know what is wrong in the world? What's the color of the panties of the president of Germany? If You use exploits to know that, that's a crime.
(I know this isn't funny, but that's the difference between European women and Amerian woman - American men doesn't respect American women like European men respect European woman, because Angry Bird (yes, that's was her MSN nick once) would just punch the guy who disrespects her. An women CAN be president, making things better to woman (what a hell am I talking about???) but rich men - basicaly the patriarc stereotypes, like the that enemy of Deadpool, Pope Francis - will not play by her rules... So, what are You gong to do? HUH? You're so much of a cunt, that You have a pregnant pussy full of pussies inside your pussy. Meh.
... this Tor Browser exploit, technically speaking, is a Firefox exploit, since Tor's browser is based on Firefox's ESR platform.
Not necessarily. This could be an exploit introduced in the code specific to the Tor Browser. There's no reason to believe it must also be present in the ESR platform.
According to their website
The National Security Branch carries out the FBI’s responsibilities as the lead intelligence and law enforcement agency in the nation to detect, deter, and disrupt national security threats to the United States and its interests. Our goal is to collect, analyze, and share intelligence to develop a comprehensive understanding of—and to defeat—national security threats directed against the United States while preserving civil liberties.
We continue to refine our intelligence capabilities to position ourselves to stay ahead of the evolving threats our nation faces. Intelligence directs how we understand threats, how we prioritize and investigate these threats, and how we target our resources to address them.
To ensure success, we continue to integrate our intelligence and law enforcement capabilities in every operational program. The traditional distinction between national security and criminal matters is increasingly blurred as terrorists commit crimes to finance their activities and computer hackers create vulnerabilities that can be exploited. The integration of intelligence and investigations makes the FBI uniquely situated to address these threats and vulnerabilities across programs. The FBI draws on both intelligence and law enforcement tools to determine strategically where and when to disrupt threats.
Is it just me or does a reasonable reading of this statement imply that a big part of the FBI's mission is to help eliminate vulnerabilities in software used by American citizens and companies? Is there an interpretation in which they are credibly following their own mission statement?
When things get complex, multiply by the complex conjugate.
After the level of intolerance displayed at their former CEO, does anyone still use Firefox?
But let me point out the remotest possibility that the IP address tracked down wouldn't necessarily prove a particular person was involved.
Theoretically the best way for person to hide would be to hide behind and implicate another person. (Seriously watch more Columbo.) You would have to show that a computer wasn't infected in such a way as to secretly relay traffic. One would have to assume the software was designed to erase itself if discovered.
But I have to make the point. Getting an IP address is only the first step. I suggest that is enough information to get a warrant and then do a real investigation such as physically bugging their computer and gathering keystrokes and mousestrokes and possibly video evidence of his activity at the computer.
To prove a person was downloading child porn you would need a complete tap of their internet connection checking for relayed transmission. Then check that no one hacked into their wireless network from outside their home. Then finally show that that person was home when no one else was.
And a pedophile wouldn't require vast technical knowledge. Just like everything else you can buy expertise. To another hacker it would look like a noob buying help to get started being a hacker.
In general hacking into at least one neighbors WIFI is something any hacker should easily be able to do.
So to sum it up. Stock slacking off on your job. Get the warrant and catch him jerking off on his computer to what is obviously child porn.
Firefox is a fucking SIEVE
the tor project should shy away from Firefox (ESR)?
https://it.slashdot.org/story/...
http://www.eweek.com/security/...
...because we want to advertise our system to criminals...
I don't think this is Apple's intention.
It's not the criminals that sent a message that they don't want government to snoop in all their communications at will, but ordinary users like... me, and others.
Apple doesn't want to loose its market share because of the common knowledge that their devices are open to any government that likes to have a look (of course they are, but they like to pretend they're not) and so they are opposing government intrusion at this level. On a higher level of course they will fully cooperate, don't worry.
"Trump!!", the new Godwin.
As I posted elsewhere, that headline is a half-truth. It doesn't mean that Firefox has a lot of holes.
They 'disqualified' it because Mozilla had not recently implemented new features intended to bolster security, while the other browsers had done so in the same timeframe.
Whether those security features actually harden the browser, make it more difficult to exploit, is a different question.
And people wonder why I run the HotJava program as my main browser...;-)
Malicious code can be injected at ISP level much like ISP-based warning popups and other messages. I'm certain this is how it works from how I was targeted.
No idea on details of targetted flaw, but Firefox very much dumped core for no reproducible reason after logging on to internet from a new wifi AP in a small town that only has 1 physical network pipeline. Easily targetted by the feds in a long-standing area of interest for DEA investigations.. w00t w00t. 0x1deadfed.
I've had previous electronic encounters with FBI in '03-'04, at that time it was AOL IM linux client 0day. And yes, it was the FBI 100%. I had downloaded/copied (hacked?) a government voter database at the time for a political group that needed to verify voter petition validity (NORML/MPP). There was also ground activity surveillance from that, and it's public record FBI sent _hundreds_ of field agents to the college town I was in the summer this went down. At the time I couldn't believe it, but now I know it's how they roll when they get motivated to leave the office.
This is not for troll, wake up and realize that Americans really are targeted without warrants. You'd be insane to think I'm not on a few watchlists. -helo
No doubt that China, Russia and others are hoarding zero-days, but we wouldn't have any data to even suggest such a thing because those countries lack an open court system. These discussions about the limitations of law enforcement and intelligence do not occur there because the conversations are censored, the bloggers are jailed, and the dissidents are executed. Compared to your idea of perfect (whatever it happens to be at this particular self-serving moment), the U.S. looks bad, with all its dirty laundry aired daily. But compared to the rest of the world, the U.S. is doing quite well when it comes to individual freedom. Even the liberal countries of western Europe censor these discussions and keep their intelligence authorities under wraps. I'd rather live in a country where the dirt is out there for debate, than one where its buried by a carefully honed propaganda machine (or worse, a closed tyranny) where there's nothing to complain about because the dirt is keep well concealed beneath the rug. And if you think that the U.S. government has a propaganda machine, then you live in Fantasy Land and know nothing about the deliberately designed dysfunctional system that is the U.S. government. One U.S. agency's secret is another agency's weapon against it. The fact that you're even talking about this is a positive mark for the U.S. system, not another sign of doom. I was once asked by an Iranian academic the process that I needed to go through in the U.S. to publish a research paper. He didn't believe me when I said that I don't need to tell them anything, and would revolt if such a demand were made. USA: Openly imperfect, but better than the polished turds. Welcome to Earth.
If (you - the FBI, NSA, etc...) think it is okay to have access to ALL my (i.e. our) stuff, then WE require access to ALL of your stuff!
Self-importance and self-indulgence is the root of ALL evil.