Security: Tor 0-day revealed on Twitter by vulnerability vendor

It's just two weeks since a Windows 0-day was revealed on Twitter, and now the same thing has happened for the Tor browser. Zerodium -- self-described as "the premium exploit acquisition program" -- exposed a backdoor vulnerability in Tor that makes it possible to bypass security protections.

The vulnerability affects Tor 7, and the vendor says that the problem has been addressed in the recently-released Tor 8. A proof-of-concept for the security has also been published.

See also:

The Tor browser, famed for the security and relative anonymity it affords users, has a "serious vulnerability" that makes it possible to execute malicious code even if the Javascript-blocking NoScript extension is activated.

In a tweet, Zerodium revealed details of what it refers to as a "backdoor":

Security researcher x0rz was quick to share details of a proof-of-concept:

As revealed in an interview with ZDNet, Zerodium is said to have been aware of the vulnerability for "many months", and details of it had been shared with government customers. Zerodium CEO Chaouki Bekrar said:

We have decided to disclose this exploit as it has reached its end-of-life and it's not affecting Tor Browser version 8 which was released last week. We also wanted to raise awareness about the lack (or insufficient) security auditing of major components bundled by default with Tor Browser and trusted by millions of users.

The exploit by itself does not reveal any data as it must be chained to other exploits, but it circumvents one of the most important security measures of Tor Browser which is provided by NoScript component.

NoScript's author, Giorgio Maone, says he is working on a patch:

Image credit: g0d4ather / Shutterstock

Comments are closed.

© 1998-2020 BetaNews, Inc. All Rights Reserved. Privacy Policy - Cookie Policy.