Zero Day Porn

Zero Day Porn

Firefox Zero-Day Used in Child Porn Hunt?

A claimed zero-day vulnerability in Firefox 17 has some users of the latest Mozilla Firefox browser ( Firefox 22 ) shrugging their shoulders. Indeed, for now it appears that this flaw is not a concern for regular, up-to-date Firefox end users. But several experts say the vulnerability was instead exposed and used in tandem with a recent U.S. law enforcement effort to discover the true Internet addresses of people believed to be browsing child porn sites via the Tor Browser — an online anonymity tool powered by Firefox 17 .
Freedom Hosting’s entry on the Tor network’s The Hidden Wiki page.
Tor software protects users by bouncing their communications across a distributed network of relays run by volunteers all around the world. As the Tor homepage notes, it prevents anyone who might be watching your Internet connection from learning what sites you visit, it prevents the sites you visit from learning your physical location, and it lets users access sites that are blocked by Internet censors.
The Tor Browser bundle also is the easiest way to find Web sites that do not want to be easily taken down, such as the Silk Road (a.k.a. the “ eBay of hard drugs “) and sites peddling child pornography.
On Saturday, Aug. 3, 2013, Independent.ie , an Irish news outlet, reported that U.S. authorities were seeking the extradition of Eric Eoin Marques , a 28-year-old with Irish and American citizenship reportedly dubbed by the FBI as “the largest facilitator of child porn on the planet.” According to the Independent, Marques was arrested on a Maryland warrant that includes charges of distributing and promoting child porn online.
The Tor Project’s blog now carries a post noting that at approximately midnight on August 4th “a large number of hidden service addresses disappeared from the Tor Network, sites that appear to have been tied to an organization called Freedom Hosting — a hosting service run on the Tor Network allegedly by Marques.
Hidden services can be used to run a variety of Web services that are not directly reachable from a normal Internet connection — from FTP and IRC servers to Web sites. As such, the Tor Network is a robust tool for journalists, whistleblowers, dissidents and others looking to publish information in a way that is not easily traced back to them.
“There are rumors that a hosting company for hidden services is suddenly offline and/or has been breached and infected with a javascript exploit,” writes “phobos,” a Tor Project blogger. Phobos notes that the person, or persons, who run Freedom Hosting are in no way affiliated or connected to The Tor Project, Inc., the organization coordinating the development of the Tor software and research, and continues:
“The current news indicates that someone has exploited the software behind Freedom Hosting. From what is known so far, the breach was used to configure the server in a way that it injects some sort of javascript exploit in the web pages delivered to users. This exploit is used to load a malware payload to infect user’s computers. The malware payload could be trying to exploit potential bugs in Firefox 17 ESR, on which our Tor Browser is based. We’re investigating these bugs and will fix them if we can.”
Even if the claimed vulnerability is limited to Firefox version 17, such a flaw would impact far more than just Tor bundle users. Mozilla says it has been notified of a potential security vulnerability in Firefox 17, which is currently the extended support release (ESR) version of Firefox. Last year, Mozilla began offering an annual ESR of Firefox for enterprises and others who didn’t want to have to keep up with the browser’s new rapid release cycle.
“We are actively investigating this information and we will provide additional information when it becomes available,” Michael Coates , director of security assurance at Mozilla, wrote in a brief blog post this evening.
Ofir David , head of intelligence for Israeli cybersecurity firm Cyberhat , said he believes the now-public exploit code is indeed related to Marques’ arrest. David said someone appears to have gained access to Freedom Hosting and injected malicious HTML code that checks the visitor’s browser to see if he is using Firefox 17. If so, the code silently redirects that visitor’s browser to another site which generates a unique identifier called a ‘UUID.'”
David said that although the exploit can be used to download and run malicious code on the visitor’s computer, whoever infiltrated Freedom Hosting appear to have only used the exploit to gather the true Internet addresses of people visiting the child porn sites hosted there.
“Ironically, all [the malicious code] does is perform a GET request to a new domain, which is hosted outside of the Tor network, while transferring the same UUID,” David said. “That way, whoever is running this exploit can match any Tor user to his true Internet address, and therefore track down the Tor user.”
For more on this developing story, check out this Reddit thread . Also, Mozilla has an open Bugzilla entry analyzing the exploit code.
Update, Aug. 5, 1:45 a.m. ET: Reverse engineer Vlad Tsrklevich has posted a brief analysis of what the exploit does. His conclusion (which seems sound): “Because this payload does not download or execute any secondary backdoor or commands it’s very likely that this is being operated by an [law enforcement agency] and not by blackhats.”
Also, here’s a bit more from Mozilla’s security lead Dan Veditz on the vulnerability:
“The vulnerability being exploited by this attack was fixed in Firefox 22 and Firefox ESR 17.0.7. The vulnerability used is MFSA 2013-53
People who are on the latest supported versions of Firefox are not at risk.
Although the vulnerability affects users of Firefox 21 and below the exploit targets only ESR-17 users. Since this attack was found on Tor hidden services presumably that is because the Tor Browser Bundle (TBB) is based on Firefox ESR-17. Users running the most recent TBB have all the fixes that were applied to Firefox ESR 17.0.7 and were also not at risk from this attack.”
Update, Aug. 5, 4:08 p.m., ET: Kevin Poulsen from Wired.com notes that, according to a domaintools.com lookup , the IP address used by the malicious script’s controllers found by Tsrklevich resolves to a Verizon address space that is managed by Science Applications International Corp. (SAIC) , an American defense contractor headquartered in Tysons Corner, Va.

This entry was posted on Sunday 4th of August 2013 08:13 PM

I don’t think anyone here has mentioned it yet, but the “malicious HTML code” is being picked up by multiple AVs now.
Here’s a scan of the .js Krebs posted ( http://pastebin.mozilla.org/2777139 )
Some people were wondering if AVs would even flag an exploit apparently used by “the FBI” or what-have-you, and they are. A lot of reputable vendors too. So, even with it requiring an outdated Firefox to work, if it ever was reused by anyone (exploit kits) it’d be picked up by AVs.
@Chris Hansen: I am thinking that the post a bit above this one was not really you. Confirm?
Hm this date stamp above should have been 08 August at 06:58 UTC
Well, there’s basically a simple answer to this vulnerability : do not use the Browser Bundle and route your traffic yourself using Tor+Vidalia+Privoxy, and whatever up-to-date browser you can find. I sort of remember the Tor website indicating that while the Browser Bundle is easily set up it’s not perfect in terms of anonymity…
The USDOJ/FBI lied to the Irish Courts. Freedom Hosting houses TorMail and they’ve been after TorMail since WikiLeaks popped up. When Eric Snowden broke big they accelerated their efforts. They couldn’t exercise NDL Patriot Act authority over Freedom Hosting because it’s not in the U.S. So they networked with some of the usual anonymous cowards to upload illegal porn over the course of several years/months – then they networked with civilian organizations briefly (SAIC, Verizon) to locate the Admin in Ireland. They couldn’t get Ireland’s cooperation just to grab TorMail because it would be an obvious privacy issue, but the court in Ireland bought the bit about illegal porn so they arrested Mr. Marques for extradition to the U.S.
Thinking of a Cybersecurity Career?
Your email account may be worth far more than you imagine.
Why So Many Top Hackers Hail from Russia

This site does not store any files on its server. We only index and link to content provided by other sites.
Contact us - admin [@] pornorips(dot)com
Contact us spare address - pr.pr.rips@gmail.com

Create an account to follow your favorite communities and start taking part in conversations.
No more zero day streaks. It's time, to set off and fly, free from the addiction of porn I currently face.
A porn addiction and compulsive sexual behavior recovery peer support forum. We host challenges ("reboots") in which participants ("Fapstronauts") abstain from pornography and masturbation for a period of time, generally between 7-30 days. Whether your goal is casual participation in a monthly challenge as a test of self-control, or whether excessive porn use has become a problem in your life, you will find a supportive community here.
My progress so far and what I learned. AMA.
relapsed after 1 month idk what to do anymore
I paid a hooker to shit on me because of porn
I am going to commit sucide. It's been 3 years and I am done
Porn addiction the worse of them all
I used to be up late looking at p*rn-now I'm up late...
Reddit Inc © 2022. All rights reserved
you don't understand. This isn't about 'last go' or 'promises'
you're just removing, slowly or quickly, an addiction from your life.
Few people do this perfectly the 1st, 2nd, 3rd, or 20th.. try, and no one gets a special prize for doing so.
What I HAVE seen is many people promise they will never do this again...
...and then, because we are not perfect and this is an addiction that is difficult to quit, they 'break' their promise - they fap - and then they go to fucking pieces and have a breakdown because 'their word doesn't mean anything anymore'
Basically they disappont themselves and their expectations so badly that they give up even trying!
Do you see? I'm not trying to discourage you, quite the opposite, I'm trying to encourage you in an effective way... just go forward, now that you know you have a problem with porn and fapping. Change takes time, but the effort, even if it's 'imperfect' will yield the result you want, a better life not ruled by this addiction.
You can do it. Leave your promise for more promise-appropriate things :)
read these tips carefully, and go forward.
I wish you success on your endeavour. You got this, stay strong champ
Thanks yesterday i barely started my day 1 streak hope this one stays longer
Let’s do this together - I’ve been trying to quit porn and masturbation since April this year, have been addicted for 5 years. It’s finally time to be free. We must enter 2023 with a clear mind and no porn. Our journey to freedom begins now.

Audrey Show Porn
Korina Kova Porn Photo
Lesbians Passionate Lovers

Zero Day Porn

Report Page