Exploit Vendor Drops Tor Browser Zero-Day on Twitter (zdnet.com) 78
An anonymous reader writes: Zerodium, a company that buys and sells vulnerabilities in popular software, has published details today on Twitter about a zero-day vulnerability in the Tor Browser, a Firefox-based browser used by privacy-conscious users for navigating the web through the anonymity provided by the Tor network. The vulnerability is a bypass of the NoScript extension that's included by default with all Tor Browser distributions. Once bypassed, an attacker can run malicious code inside the Tor Browser, code that under certain circumstances would have been stopped by NoScript.
"This Tor Browser exploit was acquired by Zerodium many months ago as a zero-day and was shared with our government customers," Zerodium CEO Chaouki Bekrar told ZDNet in an interview. "We have decided to disclose this exploit as it has reached its end-of-life and it's not affecting Tor Browser version 8 which was released last week." The NoScript extension released a patch in record time today to fix the vulnerability, two hours after Zerodium dropped its code on Twitter.
"This Tor Browser exploit was acquired by Zerodium many months ago as a zero-day and was shared with our government customers," Zerodium CEO Chaouki Bekrar told ZDNet in an interview. "We have decided to disclose this exploit as it has reached its end-of-life and it's not affecting Tor Browser version 8 which was released last week." The NoScript extension released a patch in record time today to fix the vulnerability, two hours after Zerodium dropped its code on Twitter.
Re: (Score:2)
Rule One (Score:3, Informative)
Rule one of Tor: disable javascript in about:config.
Re: (Score:1)
Most of the web is now unusable without JS.
Re: (Score:1)
Rule two of Tor: most of the web is a privacy invading nightmare, and js is most often the means of the invasion.
Re: (Score:2, Insightful)
Not saying you're wrong, but the reason many people use tor is to use the web. If it isn't useful for that, it's never going to get the kind of traction it needs among people "not doing anything wrong".
And if those people don't use it, all it does is paint a HUGE target on the backs of people who do... and who need it to protect themselves.
bypasses a *legacy* NoScript (Score:3)
From the mouth (well keyboard) of the NoScript dev himself [slashdot.org], this is a bug which affects the old NoScript version 5, the XUL extension that is still used in a few old browsers still based on the Firefox 52 ESR (like Tor Browser).
The NoScript version 10, the Web Extension that works in more recent version of Firefox (they switched to Web Extensions exclusively since Firefox version 57), isn't affected.
Thus the current version of TorBrowser, version 8, which is based on FireFox ESR 60 [torproject.org], is running an unaffected
Welcome to Internet 2.0 (Score:1)
This should be sending chills down your spine:
This Tor Browser exploit was acquired by Zerodium many months ago as a zero-day and was shared with our government customers,"
What in the FUCK. Who are your "Govrernment Customers" and why are they using Tor? What else have you disclosed but not told anyone? Or would that cut into your nice profits selling snake oil?
Responsible disclosure my ass, the security industry is a joke.
Re: (Score:2)
Who are your "Government Customers" and why are they using Tor?
They are probably the NSA and CIA. The NSA wants ways to access and extract information from anything and everything. The CIA wants that, plus, they want secure and anonymous communications for their operatives doing "fun and games", ie. killing people, running drugs, asserting force on governments, and collecting the profits.
What else have you disclosed but not told anyone? Or would that cut into your nice profits selling snake oil?
This might be their "advertising campaign" to get more awareness to their company.
"Posts" not "drops" (Score:3, Informative)
The link was posted (added), not dropped (removed).
Re: (Score:1)
It's file sharing lingo: drop is short for drag & drop.
Re: (Score:2)
Potatoe Potatoe. Your post is 100% correct when you're talking about SQL tables. Though speaking of tables what happens when you table a piece of legislation in the UK vs tabling a piece of legislation in the USA?
Re: (Score:2)
"to drop an exploit" means "to make an exploit public", so that the exploit is now worthless (dropped) because whatever it was exploiting will be fixed.
Black hat lingo I guess.
Here's an example: https://www.zdnet.com/article/... [zdnet.com]
Ex-NSA hacker drops macOS High Sierra zero-day hours before launch
Yay, NoScript! (Score:5, Insightful)
There've been quite a number of posts beardmuttering about a severe NoScript vulnerability for much of the past couple of weeks. The fact is that, if you use the Tor browser at all regularly, you've been seeing a notification flag about that very thing in the addons bar for the whole of that time.
What I take from this story is that, although the existence of the vulnerability had to have been disclosed to the Tor developers - and very likely to the NoScript folks, as well - just prior to the appearance of that flag, it wasn't until today that the Zerodium folks disclosed the actual code to them. Now, if you know there's some kind of vulnerability that's been discovered, but you don't know exactly what that vulnerability consists of, it's pretty fucking difficult to fix the damned thing, because, essentially, you'd have to just blindly guess at its nature and where in your code it might be hiding.
Otherwise you'd just quietly fix it, push out an update, and get on with the task of developing the next version, rather than have to expend those resources on more bughunting. So, to me, the fact that the NoScript team produced a fix in two hours from the time Zerodium released the exploit code is a tribute to their commitment to protecting their users.
It also tells me that the fix itself must have been relatively trivial - which in no way diminishes my admiration for the devs who coded it, tested it, integrated it into the addon, and got it out the door in the duration of a typical garage band rehearsal.
So, good job, guys!
What does give me pause is Zerodium's casual disclosure that they had already thoroughly saturated their market for that exploit, and concluded that they couldn't squeeze another dollar out of the black hat sector (having previously sold it to every nation-state in the intelligence world - or, rather, every one in the market for zero-days). At a guess, that means they've been actively hawking it for not less than six months or so.
And that is a Very Bad Thing, indeed ...
Re: (Score:2)
And that is a Very Bad Thing, indeed ...
It's pretty cool in a dystopian, cyberpunk way, though.
Re: (Score:2)
Seriously, yay Noscript? Their one reason to exist is to block Javascript. Their "safest" mode is often used as a substitute for turning it off completely since Noscript has an easy GUI to allow some scripts to run, which means they basically compromised a simple on/off switch. It's the kind of total meltdown that makes me wonder if this is a NSA plant or if they're totally incompetent or were drunk during code reviews, if they have any. Sorry but this is a massive black mark that says that all the tin foil
Re:Yay, NoScript! (Score:5, Informative)
The NoScript dev -- not "devs" ;) -- here.
Thank you for your commentary, which is quite to the point except for two details which I'd like to set straight:
* NoScript 10 "Quantum" has been the main branch and the only I focused on since December 2017: it's a complete rewrite and was born unaffected by this bug. NoScript 5 has been kept around so far for the Tor Browser and the others based on Firefox ESR 52, like Palemoon.
I'd like also to add that NoScript 10's code [github.com] is much simpler, leaner and easier to understand / maintain, and has got a lot more "friendly" eyeballs reviewing it for possible flaws. Therefore I'm quite confident something like this wouldn't go unnoticed that easily. Anyway, I vow to keep fixing whatever security bug is found (either cooperatively or in a hostile and disturbing way, like in this case) as fast as humanly possible, and even a bit faster, like I always did :)
Re: (Score:3)
It's rare to see the dev of a tool respond here on Slashdot. That's more typical on Hackernews. Seriously this place is a cesspit. :-P
But good on you, and thanks for clearing this up too. People don't get enough appreciation for this kind of work, especially porting your plugin to WebExtensions .. something that has been really challenging to quite a few plugin authors.
Thank you for your candour and information and setting the record straight.
Thank you (Score:3)
The NoScript dev -- not "devs" ;) -- here.
Thank you, sir, for your work. You're making one of my most favorite extension ever
(The other being gorhill's uBlock Origin).
Re: (Score:2)
Giorgio Maone responded to my post thusly:
The NoScript dev -- not "devs" ;) -- here.
Thank you for your commentary, which is quite to the point except for two details which I'd like to set straight:
Thank you for your detailed corrections to my (largely guesswork-based) post. I couldn't ask for a more credible source for them!
(I'm more impressed by your patch-fu now than I was in the first place, btw.)
While I have your attention, I also want to thank you for what you do for us FF users. Without NoScript, I wouldn't feel safe browsing the modern web with anything short of a completely air-gapped PC that had a browser, an OS, and basically nothing else of value i
End of life? (Score:4, Insightful)
Really weird when an exploit vendor says one of their exploits is reaching "end of life".
Also creepy that they are selling this to governments. I'd bet this sort of thing happens all the time from all sorts of shady companies like this.
Re: (Score:2, Insightful)
It should be illegal, or at the very least heavily regulated.
We need to find economic and legal ways of doing things that result in better security, not simply allowing private companies to profit from making everybody less secure.
Re: (Score:2)
Legal? They said they sold it to government customers. Probably the DEA to unmask darknet market participants.
Who do you think it going to make it illegal, that same government that benefits?
Whitelisting vs blacklisting.... (Score:2)
Not that serious (Score:2)
Security-aware Tor users disable JS completely in about:config instead of using extensions.
FBI exploit? (Score:1)
I wonder if this is the exploit the FBI were using a while back (the one where they decided to let a scumbag pedophile off the hook rather than reveal how they were able to catch the guy) or if its a different exploit and the FBI one is still a problem...
firefox plugin api (Score:2)
interesting to read that this exploit only worked for the old plugin api on firefox.
remember that a lot of people were upset about the change in the api as a lot of plugins wouldn't work anymore unless rewritten.
mozilla at the time did state that the api was a bit messy and insecure.
clearly they were correct to rewrite this api, as we can see now.
Who watches the watchmen enablers? (Score:2)
"Who are your government customers?"
If any are dictatorships, you should be thrown in jail.
Cool! I worked on this. (Score:1)
We also have quite a few new 0d's (yes, remote priv-esc) in the Linux kernel attained via many common services. Fully patched distributions are still failing to stop them too. This is a really exciting time to be in this business.