Latest in Browser

Image credit:

Tor browser for Windows exploit discovered, malware may be gathering info for Uncle Sam (updated)

Michael Gorman, @Numeson
August 5, 2013
12 Shares
Share
Tweet
Share

Sponsored Links

It was just over two years ago that the paragon of internet privacy, the Tor project, decided to build its own browser by forking Firefox. Wired reports that an exploit of that very same browser has been recently discovered that allowed a number of users' Windows computers to be infected with malware. Once installed, the code delivered infected machines' hostnames and MAC addresses to a remote web server in Reston, Virginia, a city located just outside Washington D.C. The browser exploit -- a JavaScript vulnerability inherent to Firefox version 17, the version upon which the Tor browser was built -- was enabled by a breach of Freedom Hosting servers. In this case, affected Freedom Hosting servers delivered web pages to users with the JavaScript exploit embedded in them.

There's no direct evidence that the malware comes from the government, but the malware's command and control IP address is registered to a governmental defense contractor. Plus, the data pulled from infected machines indicates it could be an example of the FBI's computer and internet protocol address verifier (CIPAV) software first identified by Wired in 2007. CIPAV has been used by the FBI to help identify and catch terrorists, hackers and criminals since 2002, but the exact nature of the software has never been revealed. Regardless, the vulnerability in the browser has been identified and fixed, so users need only update to the newest version of the Tor browser to keep their web traffic away from prying eyes... for now, at least.

Update: To be clear, the Firefox exploit in question was fixed, along with the Tor browser well over a month ago, and any users who have updated since June 26th were not affected.

All products recommended by Engadget are selected by our editorial team, independent of our parent company. Some of our stories include affiliate links. If you buy something through one of these links, we may earn an affiliate commission.
Comment
Comments
Share
12 Shares
Share
Tweet
Share

Popular on Engadget

'NBA 2K21' comes with a next-gen upgrade... if you spend $100

'NBA 2K21' comes with a next-gen upgrade... if you spend $100

View
Amazon is making a Fallout series with the creators of 'Westworld'

Amazon is making a Fallout series with the creators of 'Westworld'

View
Samsung is selling a wireless charger that also sterilizes your phone

Samsung is selling a wireless charger that also sterilizes your phone

View
Will gallium nitride electronics change the world?

Will gallium nitride electronics change the world?

View
Vizio's new 4K TVs start at $230

Vizio's new 4K TVs start at $230

View

From around the web

Page 1Page 1ear iconeye iconFill 23text filevr