Mozilla is going to patch a flaw in Firefox that if used properly, could be used by attackers to pretend to be the browsers software update servers, and inject malicious code into the victim’s computer.
The vulnerability can be exploited to unmask people using the Tor Projects Firefox based, Tor Browser. The hole in security allows an attacker to obtain a valid certificate for addons.mozilla.org to pretend to be the update servers and deliver a malicious extension update.
Georg Koppen, a key developer at The Tor Project, cited this, while announcing the newest version of Tor, which addresses this problem:
“This could lead to arbitrary code execution. Moreover, other built-in certificate pinning’s are affected as well. Obtaining such a certificate is not an easy task, but it’s within reach of powerful adversaries such as nation states. Additionally, this attack enables an attacker to conduct exploitation at a massive scale against all Tor Browser users and to move towards implantation after selected criteria are met, such as an installed language pack, public IP address, DNS cache, stored cookies, stored web history, and so on.”
He also stated that the need to obtain a legitimate TLS certificate for addons.mozilla.org was the cause of the high cost of entry to the attack, something Movrcx says was ‘difficult to accomplish but not impossible’. He went on to state that initially the developers at Tor didn’t believe his claims.
Ryan Duff, an independent security researcher says Firefox used its own weak version of key pinning, which then created the attack vectors. Adding Mozilla had fixed the flaw in the version of its browser.
“Firefox uses its own static key pinning method for its own Mozilla certifications instead of using HPKP,” Duff said. “The enforcement of the static method appears to be much weaker than the HPKP method and is flawed to the point that it is by-passable in this attack scenario.
Mozilla has pushed the remedy into its stable version, which is to be released September 20th.
If you liked this article follow us on Twitter @themerklenews and make sure to subscribe to our newsletter to receive the latest bitcoin and altcoin price analysis and the latest cryptocurrency news.
new erectile dysfunction treatment http://canadaedwp.com buy prescription drugs without doctor
best place to buy viagra online arlmpdvc sildenafil generic online viagra
http://tadalafilfast20.com where can i get tadalafil
cheapest cialis web prices http://generictadalafil20.com generic tadalafil 20mg
30ml liquid cialis walgreens price for cialis 20mg
how to take cialis
tadalafil 60 mg for sale: http://tadalafilonline20.com/ buy tadalafil us
order tadalafil tadalafil pills 20mg
tadalafil generic
prescription drugs without a doctor: https://genericwdp.com/ cheap generic drugs from india
cheap generic drugs from india: https://genericwdp.com/ india pharmacy mail order
buying prescription drugs from canada: https://genericwdp.com/ pills without a doctor prescription
pills without a doctor prescription: https://genericwdp.com/ prescription drugs without a doctor
generic drugs without doctor’s prescription generic pills
best online international pharmacies india: https://genericwdp.com/ generic pills for ed
viagra from india viagra online usa
order viagra online
cheap viagra online mexican viagra
viagra price
п»їviagra pills viagra over the counter walmart
cost of viagra
buying viagra online price of viagra
viagra cost per pill
where to buy viagra online best over the counter viagra
cheap viagra online
where to buy viagra how much is viagra
where can i buy viagra over the counter
viagra from canada when will viagra be generic
buy viagra online usa
best place to buy generic viagra online viagra without a doctor prescription usa
order viagra online
best over the counter viagra viagra over the counter
buying viagra online
buy viagra online canada viagra from india
over the counter viagra
paxil brain zaps paxil 40 mg
paxil 30 mg 10mg paxil
erectile dysfunction medications
http://paxil100.com/ – paxil generic
http://doxycyclinest.com/# doxycycline pills
http://clomidst.com/# where can i buy clomiphene
https://diflucanst.com/# diflucan best price
online drugstore metformin: metformin 1g – metformin without prescription canada