Firefox Zero-Day Can Be Used To Unmask Tor Browser Users (computerworld.com)

An anonymous reader quotes a report from Computerworld: A Firefox zero-day being used in the wild to target Tor users is using code that is nearly identical to what the FBI used in 2013 to unmask Tor-users. A Tor browser user notified the Tor mailing list of the newly discovered exploit, posting the exploit code to the mailing list via a Sigaint darknet email address. A short time later, Roger Dingledine, co-founder of the Tor Project Team, confirmed that the Firefox team had been notified, had "found the bug" and were "working on a patch." On Monday, Mozilla released a security update to close off a different critical vulnerability in Firefox. Dan Guido, CEO of TrailofBits, noted on Twitter, that "it's a garden variety use-after-free, not a heap overflow" and it's "not an advanced exploit." He added that the vulnerability is also present on the Mac OS, "but the exploit does not include support for targeting any operating system but Windows." Security researcher Joshua Yabut told Ars Technica that the exploit code is "100% effective for remote code execution on Windows systems." "The shellcode used is almost exactly the shellcode of the 2013 one," tweeted a security researcher going by TheWack0lian. He added, "When I first noticed the old shellcode was so similar, I had to double-check the dates to make sure I wasn't looking at a 3-year-old post." He's referring to the 2013 payload used by the FBI to deanonymize Tor-users visiting a child porn site. The attack allowed the FBI to tag Tor browser users who believed they were anonymous while visiting a "hidden" child porn site on Freedom Hosting; the exploit code forced the browser to send information such as MAC address, hostname and IP address to a third-party server with a public IP address; the feds could use that data to obtain users' identities via their ISPs.

Comments

headline resummarized: Tor!=Panacea

[rectalfeeding]

Any tor utilizing application's zero-day bugs can be used to unmask that tor utilizing app's users.

Re:headline resummarized: Tor!=Panacea

[DarkOx]

Right, at the very least you need to install a perfectly clean VM taking all the default install options on the OS so you don't do anything that might be identifiable or make it more unique. Make sure you do not enable any of the host integration stuff, no copy paste, don't install the VMware tools, ensure all the host isolation stuff is on, don't even allow the power status or system clock to the VM. Only then do you install tor. After that take a snapshot. Be sure to revert to that snapshot each and ever time you use the VM before you do any tor browsing! Start over and make a fresh build every few months as you can't trust upgrade processes won't leave something finger-printable and using a browser even a few months old might separate you from the masses somewhat now that most of the world auto updates.

If you do those things you *might* have a fighting chance of actually remaining anonymous.

Re:headline resummarized: Tor!=Panacea

[Anonymous Coward]

Right, at the very least you need to install a perfectly clean VM taking all the default install options on the OS so you don't do anything that might be identifiable or make it more unique. Make sure you do not enable any of the host integration stuff, no copy paste, don't install the VMware tools, ensure all the host isolation stuff is on, don't even allow the power status or system clock to the VM. Only then do you install tor. After that take a snapshot. Be sure to revert to that snapshot each and ever time you use the VM before you do any tor browsing! Start over and make a fresh build every few months as you can't trust upgrade processes won't leave something finger-printable and using a browser even a few months old might separate you from the masses somewhat now that most of the world auto updates.

Or you can skip all that bullshit and just boot a TAILS CD.

Re:headline resummarized: Tor!=Panacea

[TheCarp]

That is not the very least. That is a whole bunch of extra work when entire distributions exist just to obviate the need for this. Take a look at tails.

It is, of course, recommended to put it on a usb stick and clean boot hardware off the stick to use it; however, there is nothing stopping you from bringing it up in a VM if you are ok with the trade offs.

Accomplishes the same thing, for less work, and with a much larger already setup base which will be identical to other users, in ways that increase the work of differentiating you from other users.

also, it is possible to jail an environment better.... What you really want on you VM is to jail it onto a network segment with no gateway where its only connection to the outside world is a tor client on a second VM.

Which i care enough to state, not enough to even setup for myself. I have a few tails sticks for the few things I really need a secure environment for....so far that means mostly for times I want to drop off the network entirely in order to work with key generation.

Re:headline resummarized: Tor!=Panacea

[DarkOx]

I am sorry I can't agree. There are going to be ALOT more people running a stock Windows 8.1 or stock Ubuntu than any of the 'privacy' distributions, all of which almost certainly can be finger printed. If you want to blend into the heard I would certainly pick on of those two platforms.

I like the idea of running tor an a separate VM from the one you do your browsing on.

Re:headline resummarized: Tor!=Panacea

[TheCarp]

> I like the idea of running tor an a separate VM from the one you do your browsing on.

It is a proxy and most of the attack vectors attack the end client, not the network itself.... the tor client needs internet access, the client behind it can only harm itself with direct acces.... so don't give it...not even dns, nothing. Just port 9050 alone and only one responding IP.

Maybe drop another interface on there and log all the non-port 9050 traffic as well :)

Use NoScript

[Anonymous Coward]

Use NoScript and forbid scripts globally and this will mitigate the exploit.

Re:Use NoScript

[sims 2]

IKR having scripting turned on by default is one of the dumbest things they have ever done.

I remember back when it was disabled by default and they said not to turn it on because it was a security risk.

Re:Use NoScript

[acrimonious howard]

Use NoScript and forbid scripts globally and this will mitigate the exploit.

Or I think uMatrix will work? (howto)

Re:Use NoScript

[AHuxley]

What does a whitelist do per site with the code?
Does the code run from the whitelisted site visited or its on a third party site that expects a browser to allow it to work?

Re:I don't understand

[lgw]

What does this have to do with Trump.

They should change this site to trumpdot.org!

Hey, that's not fair. Only half the stories are Trump-bashing. The other half are Facebook or Reddit bashing.

Re:AMZN getting into FREE email like gmail

[sims 2]

What?! where?! I want an @amazon.com

Firefox Zero-Day Can Be Used To RUN CODE

[WD]

The bug can be used to run any code of an attacker's choosing.

Re:Firefox Zero-Day Can Be Used To RUN CODE

[AHuxley]

Whats the origin story? Gov code used by gov/s again? Or old gov code thats been found and been reused by someone/anyone?

Re:Firefox Zero-Day Can Be Used To RUN CODE

[zifn4b]

The bug can be used to run any code of an attacker's choosing.

Funny thing about this, the security conscious IT department of the company I work for insists that we all ought to prefer Firefox yet all the developers for the most part use Chrome. Bwah hah hah hah.

Windows and Javascript

[Anonymous Coward]

Again a Windows and javascript explot. Use linux or bsd, and disable javascript from the config.

Re:Windows and Javascript

[gravewax]

This exploit is OS agnostic retard and if you bothered to read the article you would know that.

Re:Windows and Javascript

[RuffMasterD]

Calls to KERNEL32.dll are OS agnostic? Fuck me sideways!

Fixed even before this story got published

[Giorgio Maone]

Great work by Mozilla and the Tor Project on the lighting fast (

And yes, NoScript did protect against this (the Tor Browser has it built-in, for users who know what they're doing).

Re:Fixed even before this story got published

[WD]

And yet the fix that they chose to implement STILL causes Firefox to crash. Just not in an exploitable manner. Seems kind of non-ideal to me.

Re:Fixed even before this story got published

[Anonymous Coward]

You're always welcome to submit patches yourself. -PCP

Re:I don't understand

[Highdude702]

Don't forget to add the Linux bashing in the process. This place is becoming a "Safe Zone".

Re:I don't understand

[FatdogHaiku]

What does this have to do with Trump.

They should change this site to trumpdot.org!

Hey, that's not fair. Only half the stories are Trump-bashing. The other half are Facebook or Reddit bashing.

Geez, way to feel Microsoft marginalized...

Re:I don't understand

[imadeyoureadpoop]

What does this have to do with Trump.

They should change this site to trumpdot.org!

Finds a non-Trump article on Slashdot, complains about how everything on Slashdot is related to Trump.... Well you're not technically wrong, you're just stupid.

Relevant sig

Re: tor huh

[RuffMasterD]

And yet you post anonymous. Because you don't want anyone to link what you say online back to your identity. Go right ahead and lead by example AC.

Don't use the Tor browser on a darknet!

[GameboyRMH]

It probably seems crazy to tell you not to use the official darknet browser on a darknet, but sadly the Tor browser is the top attack vector used by law enforcement against darknet users. It's the biggest target by far. You have to roll your own darknet browser. It's a PITA but otherwise, every exploit in the TLA's books is going to be aimed at you. Also it should go without saying that your browser should be running in a Linux VM whose state is discarded on shutdown, and ideally you should have a firewall setup that blocks all outgoing traffic not going to the darknet proxy address.

Re:I don't understand

[zifn4b]

Hey, that's not fair. Only half the stories are Trump-bashing. The other half are Facebook or Reddit bashing.

I know right? I'm appalled by this, it is discrimination! There should be mandatory bashing quotas to ensure that all bashing is fair, equitable and evenly distributed. No favoritism! Equal rights for all!

Re:TOR Exploit on VM?

[b0bby]

I may be totally wrong, but iirc the previous exploit tricked the browser into visiting a non-tor site controlled by the FBI which then collected the information.