TOR is the dark side of the Internet, the so-called dark web, which provides a safe haven to privacy advocates but is also where drugs, assassins for hire and other weird and illegal activities can allegedly be traded.





A claimed zero-day vulnerability in Firefox 17 was used by the FBI to identify some users of the privacy-protecting Tor anonymity network. The FBI did not compromise the TOR network itself and The complex multi-layers of encryption still stand. Instead the FBI compromised the TOR browser only using a zero-day JavaScript exploit and used this to implant a cookie which fingerprinted users through a specific external server.

Eric Eoin Marques, 28 year-old man in Ireland believed to be behind Freedom Hosting, the biggest service provider for sites on the , 28 year-old man in Ireland believed to be behind, the biggest service provider for sites on the encrypted Tor network , is awaiting extradition on p*rno charges. It is understood the FBI had spent a year trying to locate Mr Marques.





the largest facilitator of child p*rn on the planet." That need has been particularly heightened with the many revelations of the US Prism program and other Marques was arrested on a Maryland warrant that includes charges of distributing and promoting child p*rn online. He faced four charges relating to alleged child p*rno offenses with a total of 30 years jail, reportedly dubbed by the FBI as "" That need has been particularly heightened with the many revelations of the US Prism program and other cyber spying initiatives.





Mr Marques told the court he was born in the US but has lived in Ireland since he was five. He said he was last in Romania a few weeks ago when he withdrew €6,000 from his credit card to help a friend start a business.





The Tor Network is a robust tool for journalists, whistleblowers, dissidents and others looking to publish information in a way that is not easily traced back to them. His arrest coincides with mass outages across the Darknet affecting popular services like Tor Mail, HackBB and the Hidden Wiki which were run on Freedom Hosting. Worse, there are reports of many well known TOR hidden services may be compromised using a browser exploit.

The current news indicates that someone has exploited the software behind Freedom Hosting. From what is known so far, the breach was used to configure the server in a way that it injects some sort of javascript exploit in the web pages delivered to users. This exploit is used to load a malware payload to infect users' computers. The malware payload could be trying to exploit potential bugs in Firefox 17 ESR, on which our Tor Browser is based. We're investigating these bugs and will fix them if we can." Andrew Lewman, Tor Project's Executive Director said in a " Andrew Lewman, Tor Project's Executive Director said in a blog post





Mozilla says it has been notified of a potential security vulnerability in Firefox 17 ( MFSA 2013-53 ) , which is currently the extended support release (ESR) version of Firefox. The Exploit code posted by Mozilla and Deobfuscated JS used by the Tor Browser exploit posted on Google Code.





The malicious Javascript is a tiny Windows executable hidden in a variable named "Magneto", but the Magneto code doesn't download anything. It looks up the victim's MAC address and the victim's Windows hostname. Then it sends it to the Virginia server, outside of Tor, to expose the user's real IP address, and coded as a standard HTTP web request.





The FBI appears to have gained access to Freedom Hosting and injected malicious HTML code that checks the visitor's browser to see if he is using Firefox 17. Some visitors looking at the source code of the maintenance page realized that it included a hidden iframe tag that loaded a mysterious clump of Javascript code from a Verizon Business internet address located in eastern Virginia.





The Openwatch reported that, The execution of malicious JavaScript inside the Tor Browser Bundle, perhaps the most commonly used Tor client, comes as a surprise to many users. Previously, the browser disabled JavaScript execution by default for security purposes, however this change was recently reverted by developers in order to make the product more useful for average internet users. As a result, however, the applications have become vastly more vulnerable to attacks such as this.





Briefly, this payload connects to 65.222.202.54:80 and sends it an HTTP request that includes the host name (via gethostname ( )) and the MAC address of the local host (via calling SendARP on gethostbyname ( ) ->h_addr_list). After that it cleans up the state and appears to deliberately crash." The JavaScript code's payload analyzed by reverse engineering and exploit developer Vlad Tsyrklevich, who reveals that it briefly connects to a server and sends the hostname and MAC address of the victim. "





Microsoft used to provide the US government with a an early start on its security vulnerabilities, which was reportedly used to aid its cyber espionage programs. But here no idea at this point, that Mozilla worked with the government in this case.



