Security News Tor Browser Zero-Day Exploit Revealed Online – Patch Now

[comefly_withME]

Content source

https://thehackernews.com/2018/09/tor-browser-zero-day-exploit.html

Zerodium, the infamous exploit vendor that earlier this year offered $1 million for submitting a zero-day exploit for Tor Browser, today publicly revealed a critical zero-day flaw in the anonymous browsing software that could reveal your identity to the sites you visit.

In a Tweet, Zerodium shared a zero-day vulnerability that resides in the NoScript browser plugin comes pre-installed with the Mozilla Firefox bundled in the Tor software.

NoScript is a free browser extension that blocks malicious JavaScript, Java, Flash and other potentially dangerous content on all web pages by default, though users can whitelist sites they trust.

According to Zerodium, NoScript "Classic" versions 5.0.4 to 5.1.8.6--with 'Safest' security level enabled--included in Tor Browser 7.5.6 can be bypassed to run any JavaScript file by changing its content-type header to JSON format.

In other words, a website can exploit this vulnerability to execute malicious JavaScript on victims' Tor browsers to effectively identify their real IP address.

It should be noted that the latest version of Tor browser, i.e., Tor 8.0, is not vulnerable to this flaw, as the NoScript plugin designed for the newer version of Firefox ("Quantum") is based upon a different API format.

Therefore, Tor 7.x users are highly recommended to immediately update their browser to the latest Tor 8.0 release.

NoScript has also fixed the zero-day flaw with the release of NoScript "Classic" version 5.1.8.7.

 

[upnorth]

Dosen't Tor notify automatic when it's out of date?

Never mind as I just found the answer.

Tor Browser must be kept updated at all times. If you continue to use an outdated version of the software, you may be vulnerable to serious security flaws that compromise your privacy and anonymity. Tor Browser will prompt you to update the software once a new version has been released: the Torbutton icon will display a yellow triangle, and you may see a written update indicator when Tor Browser opens. You can update either automatically or manually.

Updating

 

[509322]

Zerodium disclose exploit for NoScript bug in version 7 of Tor Browser

(Watch people not read and freak-out...)

 

[Gandalf_The_Grey]

That's clickbait... and if you keep Tor and your extensions up to date it's already solved, but looking forward to all the comments

 

[LDogg]

Sometimes it's best to do some digging . However comment thread could be interesting.

~LDogg

 

[509322]

That's clickbait... and if you keep Tor and your extensions up to date it's already solved, but looking forward to all the comments

People don't bother to read. That's the whole point.

Sometimes it's best to do some digging . However comment thread could be interesting.

~LDogg

People don't research. They expect articles to provide all the details that they need to know - and that is precisely what these type articles never do - and that is to provide key details to prevent a ton of needless panic.

 

[LDogg]

People don't research. They expect articles to provide all the details that they need to know - and that is precisely what these type articles never do - and that is to provide key details to prevent a ton of needless panic.

Agree with every single letter you just typed. People don't do enough and take most things at face value.

~LDogg

 

[509322]

Agree with every single letter you just typed. People don't do enough and take most things at face value.

~LDogg

I blame the IT security news\press. They are the ones who mislead and misinform - either intentionally or unintentionally.

The issue of details being left out - important details. Either they're idiots that don't know what they're talking about, they cannot explain things properly, or they're doing it deliberately.

 

[erreale]

I'm more and more convinced that it's the first one you said ...

Either they're idiots that don't know what they're talking about,