Latest in Browser

Image credit:

Tor browser for Windows exploit discovered, malware may be gathering info for Uncle Sam (updated)

12 Shares
Share
Tweet
Share

Sponsored Links

It was just over two years ago that the paragon of internet privacy, the Tor project, decided to build its own browser by forking Firefox. Wired reports that an exploit of that very same browser has been recently discovered that allowed a number of users' Windows computers to be infected with malware. Once installed, the code delivered infected machines' hostnames and MAC addresses to a remote web server in Reston, Virginia, a city located just outside Washington D.C. The browser exploit -- a JavaScript vulnerability inherent to Firefox version 17, the version upon which the Tor browser was built -- was enabled by a breach of Freedom Hosting servers. In this case, affected Freedom Hosting servers delivered web pages to users with the JavaScript exploit embedded in them.

There's no direct evidence that the malware comes from the government, but the malware's command and control IP address is registered to a governmental defense contractor. Plus, the data pulled from infected machines indicates it could be an example of the FBI's computer and internet protocol address verifier (CIPAV) software first identified by Wired in 2007. CIPAV has been used by the FBI to help identify and catch terrorists, hackers and criminals since 2002, but the exact nature of the software has never been revealed. Regardless, the vulnerability in the browser has been identified and fixed, so users need only update to the newest version of the Tor browser to keep their web traffic away from prying eyes... for now, at least.

Update: To be clear, the Firefox exploit in question was fixed, along with the Tor browser well over a month ago, and any users who have updated since June 26th were not affected.

All products recommended by Engadget are selected by our editorial team, independent of our parent company. Some of our stories include affiliate links. If you buy something through one of these links, we may earn an affiliate commission.
Comment
Comments
Share
12 Shares
Share
Tweet
Share

Popular on Engadget

'Game of Thrones' duo will co-produce a Netflix series with Sandra Oh

'Game of Thrones' duo will co-produce a Netflix series with Sandra Oh

View
Flat Earth advocate dies after homemade rocket crashes

Flat Earth advocate dies after homemade rocket crashes

View
The best GPS trackers for cats and dogs

The best GPS trackers for cats and dogs

View
After Math: The rule of threes

After Math: The rule of threes

View
KidKraft's Alexa-powered toy kitchen sizzles and tells dad jokes

KidKraft's Alexa-powered toy kitchen sizzles and tells dad jokes

View

From around the web

Page 1Page 1ear iconeye iconFill 23text filevr