Latest in Browser

Image credit:

Tor browser for Windows exploit discovered, malware may be gathering info for Uncle Sam (updated)

12 Shares
Share
Tweet
Share
Save

Sponsored Links

It was just over two years ago that the paragon of internet privacy, the Tor project, decided to build its own browser by forking Firefox. Wired reports that an exploit of that very same browser has been recently discovered that allowed a number of users' Windows computers to be infected with malware. Once installed, the code delivered infected machines' hostnames and MAC addresses to a remote web server in Reston, Virginia, a city located just outside Washington D.C. The browser exploit -- a JavaScript vulnerability inherent to Firefox version 17, the version upon which the Tor browser was built -- was enabled by a breach of Freedom Hosting servers. In this case, affected Freedom Hosting servers delivered web pages to users with the JavaScript exploit embedded in them.

There's no direct evidence that the malware comes from the government, but the malware's command and control IP address is registered to a governmental defense contractor. Plus, the data pulled from infected machines indicates it could be an example of the FBI's computer and internet protocol address verifier (CIPAV) software first identified by Wired in 2007. CIPAV has been used by the FBI to help identify and catch terrorists, hackers and criminals since 2002, but the exact nature of the software has never been revealed. Regardless, the vulnerability in the browser has been identified and fixed, so users need only update to the newest version of the Tor browser to keep their web traffic away from prying eyes... for now, at least.

Update: To be clear, the Firefox exploit in question was fixed, along with the Tor browser well over a month ago, and any users who have updated since June 26th were not affected.

All products recommended by Engadget are selected by our editorial team, independent of our parent company. Some of our stories include affiliate links. If you buy something through one of these links, we may earn an affiliate commission.
Comment
Comments
Share
12 Shares
Share
Tweet
Share
Save

Popular on Engadget

Bill Gates (still) doesn't think regulators should break up Big Tech

Bill Gates (still) doesn't think regulators should break up Big Tech

View
Apple pours another $250 million into iPhone glass supplier Corning

Apple pours another $250 million into iPhone glass supplier Corning

View
Amazon Music HD offers lossless streaming starting at $12.99 per month

Amazon Music HD offers lossless streaming starting at $12.99 per month

View
1Password's corporate tool can enforce two-factor use company-wide

1Password's corporate tool can enforce two-factor use company-wide

View
Google brings its Data Saver feature to Android TVs

Google brings its Data Saver feature to Android TVs

View

From around the web

Page 1Page 1ear iconeye iconFill 23text filevr