{"id":1691,"date":"2016-11-30T10:50:21","date_gmt":"2016-11-30T09:50:21","guid":{"rendered":"http:\/\/borncity.com\/win\/?p=1691"},"modified":"2020-12-13T07:05:40","modified_gmt":"2020-12-13T06:05:40","slug":"firefox-zero-day-exploit-puts-tor-users-at-risk","status":"publish","type":"post","link":"https:\/\/borncity.com\/win\/2016\/11\/30\/firefox-zero-day-exploit-puts-tor-users-at-risk\/","title":{"rendered":"Firefox Zero-day exploit puts Tor users at risk"},"content":{"rendered":"<p><img loading=\"lazy\" decoding=\"async\" title=\"Firefox\" style=\"border-left-width: 0px; border-right-width: 0px; border-bottom-width: 0px; float: left; margin: 0px 10px 0px 0px; display: inline; border-top-width: 0px\" border=\"0\" alt=\"Mozilla\" src=\"https:\/\/web.archive.org\/web\/20191012042946\/https:\/\/l06.imgup.net\/Mozilla01cadd.jpg\" width=\"65\" align=\"left\" height=\"63\"><\/a>A publicly released exploit (zero-day exploit) works against many Firefox browser versions \u2013 and put Tor users (and possibly other Firefox users) at risk. Officials at Tor has confirmed the vulnerability, no Firefox patch is available yet.<\/p>\n<p><!--more--><\/p>\n<p>The first mention of the exploit was made within <a href=\"https:\/\/lists.torproject.org\/pipermail\/tor-talk\/2016-November\/042639.html\" target=\"_blank\" rel=\"noopener\">this Tor forum post<\/a> fom November, 29, 2016. <\/p>\n<blockquote>\n<p>This is an Javascript exploit actively used against TorBrowser NOW. It consists of one HTML and one CSS file, both pasted below and also de-obscured. The exact functionality is unknown but it's getting access to \"VirtualAlloc\" in \"kernel32.dll\" and goes from there. Please fix ASAP. <\/p>\n<\/blockquote>\n<p>The posting indicates, that a JavaScript exploit is used in the wild that works on Windows systems. Tor founder Roger Dingledine <a href=\"https:\/\/lists.torproject.org\/pipermail\/tor-talk\/2016-November\/042640.html\" target=\"_blank\" rel=\"noopener\">confirms<\/a> the vulnerability. <a href=\"https:\/\/twitter.com\/TheWack0lian\" target=\"_blank\" rel=\"noopener\">@TheWack0lian<\/a> points out within <a href=\"https:\/\/twitter.com\/TheWack0lian\/status\/803736507521474560\" target=\"_blank\" rel=\"noopener\">a tweet<\/a>, that this vulnerability already has been used in 2013 from FBI (see <a href=\"http:\/\/arstechnica.com\/security\/2013\/08\/attackers-wield-firefox-exploit-to-uncloak-anonymous-tor-users\/\" target=\"_blank\" rel=\"noopener\">this Arstechnica post<\/a>). <\/p>\n<blockquote class=\"twitter-tweet\" data-lang=\"de\">\n<p lang=\"en\" dir=\"ltr\">The shellcode used is almost exactly the shellcode of the 2013 one <a href=\"https:\/\/t.co\/6vuIzqp0rj\">https:\/\/t.co\/6vuIzqp0rj<\/a><\/p>\n<p>&#8230;except it builds sockaddr_in on the stack. <a href=\"https:\/\/t.co\/pWsUe4uHiZ\">https:\/\/t.co\/pWsUe4uHiZ<\/a><\/p>\n<p>\u2014 slipstream\/RoL (@TheWack0lian) <a href=\"https:\/\/twitter.com\/TheWack0lian\/status\/803736507521474560\">29. November 2016<\/a><\/p><\/blockquote>\n<p><script async src=\"\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script> <\/p>\n<p>Analysis from security researcher points out, that the vulnerability allows remote code execution within Firefox (versions 41 till 50) under Windows. Because there is no fix available yet, it's wise to switch off JavaScript in Firefox browser. Further details may be found within <a href=\"http:\/\/arstechnica.com\/security\/2016\/11\/firefox-0day-used-against-tor-users-almost-identical-to-one-fbi-used-in-2013\/\" target=\"_blank\" rel=\"noopener\">this ArsTechnica article<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A publicly released exploit (zero-day exploit) works against many Firefox browser versions \u2013 and put Tor users (and possibly other Firefox users) at risk. Officials at Tor has confirmed the vulnerability, no Firefox patch is available yet.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[530,69,529,194,67],"class_list":["post-1691","post","type-post","status-publish","format-standard","hentry","category-windows","tag-firefox","tag-security","tag-tor","tag-windows","tag-zero-day-vulnerability"],"_links":{"self":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/1691","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/comments?post=1691"}],"version-history":[{"count":0,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/1691\/revisions"}],"wp:attachment":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/media?parent=1691"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/categories?post=1691"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/tags?post=1691"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}