Slashdot Mirror
Exploit Vendor Drops Tor Browser Zero-Day on Twitter (zdnet.com)
An anonymous reader writes: Zerodium, a company that buys and sells vulnerabilities in popular software, has published details today on Twitter about a zero-day vulnerability in the Tor Browser, a Firefox-based browser used by privacy-conscious users for navigating the web through the anonymity provided by the Tor network. The vulnerability is a bypass of the NoScript extension that's included by default with all Tor Browser distributions. Once bypassed, an attacker can run malicious code inside the Tor Browser, code that under certain circumstances would have been stopped by NoScript.
"This Tor Browser exploit was acquired by Zerodium many months ago as a zero-day and was shared with our government customers," Zerodium CEO Chaouki Bekrar told ZDNet in an interview. "We have decided to disclose this exploit as it has reached its end-of-life and it's not affecting Tor Browser version 8 which was released last week." The NoScript extension released a patch in record time today to fix the vulnerability, two hours after Zerodium dropped its code on Twitter.
"This Tor Browser exploit was acquired by Zerodium many months ago as a zero-day and was shared with our government customers," Zerodium CEO Chaouki Bekrar told ZDNet in an interview. "We have decided to disclose this exploit as it has reached its end-of-life and it's not affecting Tor Browser version 8 which was released last week." The NoScript extension released a patch in record time today to fix the vulnerability, two hours after Zerodium dropped its code on Twitter.
Wait, what if we pay to keep the exploit around a while longer? Is that an option?
Rule one of Tor: disable javascript in about:config.
Lol. I wouldn't recommend anyone use any extension for Tor. Learn how to configure it or get burned. NOWGO2BEDFGT
This should be sending chills down your spine:
This Tor Browser exploit was acquired by Zerodium many months ago as a zero-day and was shared with our government customers,"
What in the FUCK. Who are your "Govrernment Customers" and why are they using Tor? What else have you disclosed but not told anyone? Or would that cut into your nice profits selling snake oil?
Responsible disclosure my ass, the security industry is a joke.
"As Zerodium notes in its disclosure, the vulnerability is active even when the user is running the browser with NoScript, a Javascript-blocking extension that is included with the Tor browser (but is not set to active by default). " SOURCE https://www.theregister.co.uk/...
* So, you're incorrect... the FOOLS never turned it on in the 1st place! THIS GOES FOR "TOR" ITSELF actually, NOT so much for "Zerodium" WHO SHOULD HAVE SEEN THAT THOUGH IN THEIR MODEL OF IT!
APK
P.S.=> Don't worry, I was too INITIALLY (VERY misleading headlines ARE out there on it) UNTIL I read that part I quoted above... apk
NoScript extension that's included by default with all Tor Browser distributions.
Nerds: 0 Jocks: Over 9000
The link was posted (added), not dropped (removed).
You're going to have to try harder to sow discontent around here with a fake deleted post and a fake account to try and make it look legit. People here are smarter than you.
PlanetVulkan.com
Nice try, Vlad.
OP and Jock Rock. That's enough. They adults are talking.
Why does this abomination exist?!
There've been quite a number of posts beardmuttering about a severe NoScript vulnerability for much of the past couple of weeks. The fact is that, if you use the Tor browser at all regularly, you've been seeing a notification flag about that very thing in the addons bar for the whole of that time.
What I take from this story is that, although the existence of the vulnerability had to have been disclosed to the Tor developers - and very likely to the NoScript folks, as well - just prior to the appearance of that flag, it wasn't until today that the Zerodium folks disclosed the actual code to them. Now, if you know there's some kind of vulnerability that's been discovered, but you don't know exactly what that vulnerability consists of, it's pretty fucking difficult to fix the damned thing, because, essentially, you'd have to just blindly guess at its nature and where in your code it might be hiding.
Otherwise you'd just quietly fix it, push out an update, and get on with the task of developing the next version, rather than have to expend those resources on more bughunting. So, to me, the fact that the NoScript team produced a fix in two hours from the time Zerodium released the exploit code is a tribute to their commitment to protecting their users.
It also tells me that the fix itself must have been relatively trivial - which in no way diminishes my admiration for the devs who coded it, tested it, integrated it into the addon, and got it out the door in the duration of a typical garage band rehearsal.
So, good job, guys!
What does give me pause is Zerodium's casual disclosure that they had already thoroughly saturated their market for that exploit, and concluded that they couldn't squeeze another dollar out of the black hat sector (having previously sold it to every nation-state in the intelligence world - or, rather, every one in the market for zero-days). At a guess, that means they've been actively hawking it for not less than six months or so.
And that is a Very Bad Thing, indeed ...
Check out my novel.
Really weird when an exploit vendor says one of their exploits is reaching "end of life".
Also creepy that they are selling this to governments. I'd bet this sort of thing happens all the time from all sorts of shady companies like this.
Confusing article if its disabled in about:config everything's fine.
Why does the TOR browser even have a javascript engine?
09F91102 no, 455FE104 nope, F190A1E8 uh-uh, 7A5F8A09 that's not it, C87294CE no. Ah! 452F6E403CDF10714E41DFAA257D313F.
Well that was cringe
Security-aware Tor users disable JS completely in about:config instead of using extensions.
I wonder if this is the exploit the FBI were using a while back (the one where they decided to let a scumbag pedophile off the hook rather than reveal how they were able to catch the guy) or if its a different exploit and the FBI one is still a problem...
Hey, Mozilla!
Your stupid pushing for "every gullet out there *gotta* have guaranteed Javascript" is now costing human lives. How great is that?
I want my Javascript switch back: when I say "off" it should mean "off", no Rube Goldberg plugins for that, which "enable sometimes" and "sometimes perhaps", with all security nightmares this encompasses. Off means off.
And if telemetry tells you people out there are too damn stupid to switch it back on, then it's *because you are making them stupid*. Notice?
I use Tor every other day for recreational drugs and it allows the confidence to experiment in my own home. On the one hand having these zero days kept away from the end user on purpose is a horrible thing to do, on the other it turns out through experience that whatever I do the authorities really don't care. Don't touch kids, don't be a terrorist... that's fine with me.
Stop your getting APK all hot and bothered
interesting to read that this exploit only worked for the old plugin api on firefox.
remember that a lot of people were upset about the change in the api as a lot of plugins wouldn't work anymore unless rewritten.
mozilla at the time did state that the api was a bit messy and insecure.
clearly they were correct to rewrite this api, as we can see now.
On a long enough timeline, the survival rate for everyone drops to zero.
APK is just mad that he lives in a dumpy duplex his mother left him when she fled back poland to live out her dream of a retirement free of her retarded man child of a son. He still needs a roommate at age 54 so that he can afford to pay the bills and eat. What he learned today is the ls command, just wait until he learns there are useful options that can be passed to it as he will be blown away. Eventually he will learn that being able to ping as a non root user isn't special.
From the mouth (well keyboard) of the NoScript dev himself, this is a bug which affects the old NoScript version 5, the XUL extension that is still used in a few old browsers still based on the Firefox 52 ESR (like Tor Browser).
The NoScript version 10, the Web Extension that works in more recent version of Firefox (they switched to Web Extensions exclusively since Firefox version 57), isn't affected. /. summary mentions this point).
Thus the current version of TorBrowser, version 8, which is based on FireFox ESR 60, is running an unaffected NoScript version. (Even the
Your current vanilla Firefox 62 / Firefox Android 62 isn't affected either.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
The NoScript dev -- not "devs" ;) -- here.
Thank you, sir, for your work. You're making one of my most favorite extension ever
(The other being gorhill's uBlock Origin).
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
My Mother left me nothing & in fact? I literally requested she write me out of her will (my Sis did the same) & she did. We asked she leave our nieces/nephews/children everything,
* You just can't stop lying, can you, loser OR see subject: Why are you HIDING from me? Got something to HIDE?? Yes.
APK
P.S.=> JEALOUS "Lil' Jowie" you pitiful DO-NOTHING "ne'er-do-well" who STALKS me by UNIDENTIFIABLE anonymous posts? You have SERIOUS mental issues (as well as being a HORRIBLE liar)... apk
"Who are your government customers?"
If any are dictatorships, you should be thrown in jail.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
We also have quite a few new 0d's (yes, remote priv-esc) in the Linux kernel attained via many common services. Fully patched distributions are still failing to stop them too. This is a really exciting time to be in this business.
You know which three letters
Its actually "potato".
[Edit : captcha - tomato]
You seem to be losing it. Have you sought professional help recently?
Kill yourself, my man.