There's no malicious code downloaded to disk, only shell code is ran directly from memory. In this case, for example, the goal is to leak user data with as minimal of a footprint as possible. It's worth noting that not all exploits are meant to infect the target machine. This server is now down, but we were able to reproduce the exploit and observe the TCP packets where the data would be sent. Via this exploit, an attacker can collect the victim's IP and MAC addresses, as well as their hostname which it sends to a remote server ( 5.39.27.226). The Tor Browser (based on Mozilla Firefox Extended Support Release) is used worldwide by all people who want greater anonymity online which includes political activists or dissidents wanting to bypass limitations or surveillance put in place by oppressive regimes.Īccording to Mozilla, ' the exploit took advantage of a bug in Firefox to allow the attacker to execute arbitrary code on the targeted system by having the victim load a web page containing malicious JavaScript and SVG code'.

It is not the first time this has happened, as some of you may recall back in 2013, the FBI used a nearly identical one to expose some users running the Tor Browser.

Additional coverage here from Motherboard.Ī newly found vulnerability ( CVE-2016-9079) in the Firefox web browser was found to be leveraged in the wild. Update (12/2): According to Forbes, this zero-day was sold by Exodus Intel earlier this year and somehow got leaked.

Tor browser with flash player