Feds Are Suspects in New Malware That Attacks Tor Anonymity

Feuer Frei! · 08-06-13, 09:02 PM

Quote:

Security researchers tonight are poring over a piece of malicious software that takes advantage of a Firefox security vulnerability to identify some users of the privacy-protecting Tor anonymity network.

Fear not, feisty Firefox users, only v17 is affected. And who the hell would still be on v17?

SOURCE

the_tyrant · 08-06-13, 10:14 PM

Very genius, if not done before on a multitude of browsers.

Mind you, firefox 17 is VERY common, it is the Long term support version. And is used on a huge number of systems. In this case though, it is targeted because it is the version bundled with tor.

Takeda Shingen · 08-06-13, 11:08 PM

Remember when the Firefox users couldn't read SubSim for a week because the browser's listed it as a dangerous website? That was funny stuff.

The Enigma · 08-07-13, 04:02 AM

I'm still on V13, so I'm safe

Feuer Frei! · 08-07-13, 04:33 AM

Quote:

Originally Posted by The Enigma

I'm still on V13, so I'm safe

What is it with people not updating software

Seriously though,
any reason for still running 13?

The Enigma · 08-07-13, 05:13 AM

Yep. Privacy reasons.
Firefox is more and more adding code into it's browser that some might name "spyware" behavior.

For the same reason the TOR project has made it's own build of Firefox.

Jimbuna · 08-07-13, 05:41 AM

Just checked and was on v18.0.2 have upgraded and it now says v23.

Is there that high a numbered version?

Feuer Frei! · 08-07-13, 05:45 AM

Quote:

Originally Posted by Jimbuna

Just checked and was on v18.0.2 have upgraded and it now says v23.

Is there that high a numbered version?

23 is the latest (and greatest).

edit: if you ever need to know what version you have go into : help>about firefox up top Jim

Jimbuna · 08-07-13, 05:47 AM

Quote:

Originally Posted by Feuer Frei!

23 is the latest (and greatest).

edit: if you ever need to know what version you have go into : help>about firefox up top Jim

Ah, right...cheers

HW3 · 08-07-13, 12:30 PM

Quote:

edit: if you ever need to know what version you have go into : help>about firefox up top Jim

Thanks for the tip, I did not know that.

I was on v22, so not too far out of date.

the_tyrant · 08-07-13, 12:51 PM

Quote:

Originally Posted by The Enigma

Yep. Privacy reasons.
Firefox is more and more adding code into it's browser that some might name "spyware" behavior.

For the same reason the TOR project has made it's own build of Firefox.

You know that TOR's build of Firefox is v17, aka the vulnerable version right?

Firefox development went to *@&% when they decided to go on the rapid release schedule. It was stupid of them to release a new version every 6 weeks, with improvements that amounted to what is barely a patch

They don't care about enterprise users and other "long term" users:
http://www.enterpriseefficiency.com/...&doc_id=230999

Thus TOR stuck with version 17, since it is nominally "long term support". But its not like Firefox actually tried very hard to support it. Long term support editions get patches rolled out slower than mainstream versions.

August · 08-07-13, 12:51 PM

It must just have been a coincidence that after reading this thread I went to help/about to check my version and it was in the midst of updating to v23.

Ain't no moss on the feds back I tell you wut.

Penguin · 08-07-13, 03:43 PM

Not blocking javascript when surfing isn't the smartest thing to do, but not blocking it when using TOR is pure stupidity. It's not that javascript exploits have been unheard.

08-06-13, 10:14 PM	#2
the_tyrant Admiral Join Date: Jun 2010 Location: Canada Posts: 2,272 Downloads: 58 Uploads: 0	Very genius, if not done before on a multitude of browsers. Mind you, firefox 17 is VERY common, it is the Long term support version. And is used on a huge number of systems. In this case though, it is targeted because it is the version bundled with tor. __________________ My own open source project on Sourceforge OTP.net KGB grade encryption for the rest of us

08-07-13, 04:02 AM	#4
The Enigma Seer of visions Join Date: Mar 2005 Location: Under the surface Posts: 2,315 Downloads: 31 Uploads: 0	I'm still on V13, so I'm safe __________________

08-07-13, 05:13 AM	#6
The Enigma Seer of visions Join Date: Mar 2005 Location: Under the surface Posts: 2,315 Downloads: 31 Uploads: 0	Yep. Privacy reasons. Firefox is more and more adding code into it's browser that some might name "spyware" behavior. For the same reason the TOR project has made it's own build of Firefox. __________________

08-07-13, 05:41 AM	#7
Jimbuna Chief of the Boat Join Date: Feb 2006 Location: 250 metres below the surface Posts: 190,461 Downloads: 63 Uploads: 13	Just checked and was on v18.0.2 have upgraded and it now says v23. Is there that high a numbered version? __________________ Wise men speak because they have something to say; Fools because they have to say something. Oh my God, not again!!

08-07-13, 12:51 PM	#12
August Wayfaring Stranger Join Date: Apr 2005 Location: Massachusetts Posts: 23,197 Downloads: 0 Uploads: 0	It must just have been a coincidence that after reading this thread I went to help/about to check my version and it was in the midst of updating to v23. Ain't no moss on the feds back I tell you wut. __________________ Flanked by life and the funeral pyre. Putting on a show for you to see.

08-06-13, 11:08 PM	#3
Takeda Shingen Navy Seal Join Date: Mar 2000 Posts: 8,643 Downloads: 19 Uploads: 0	Remember when the Firefox users couldn't read SubSim for a week because the browser's listed it as a dangerous website? That was funny stuff.

08-07-13, 03:43 PM	#13
Penguin Ocean Warrior Join Date: Mar 2010 Location: Rheinische Republik Posts: 3,322 Downloads: 92 Uploads: 0	Not blocking javascript when surfing isn't the smartest thing to do, but not blocking it when using TOR is pure stupidity. It's not that javascript exploits have been unheard.