Mozilla engineers are patching a previously unknown JavaScript zero-day exploit that could expose Tor users.
The exploit was delivered through a Tor mailing list that when opened could unveil the MAC address and possibly even the IP address of a user running Tor Browser on Firefox. It is “100 percent effective for remote code execution on Windows systems,” said security researcher Joshua Yabut. Versions 41 to 50 of Firefox are reportedly affected.
According to reports, the zero-day’s code exploits a memory corruption vulnerability on Windows devices. It requires JavaScript to be running on your machine in order to work. The code, which has now been reverse engineered, does not appear to be responding to connections any more.
One security researcher on Twitter, @TheWack0lian, noted that the code is almost identical to an exploit infamously used by the FBI in 2013 to hack into a child pornography site running on Tor and identify its users.
Roger Dingledine, Tor project lead, acknowledged that the bug had been discovered after it was flagged by a user called sigaint, and Tor is taking the necessary steps in response to the discovery.
“So it sounds like the immediate next step is that Mozilla finishes their patch for it; then the step after that is a quick Tor Browser update,” said Dingledine. “And somewhere in there people will look at the bug and see whether they think it really does apply to Tor Browser.”
Mozilla too is aware of the exploit, but we don’t have any update on a patch as of this writing. We do know however that this zero-day has in fact been exploited already and with the code now being publicly available, it makes the whole thing a little bit more dangerous. Firefox users should consider using a different browser until an update is released, or at least disable JavaScript as much as possible.
