A company that sells exploits to government agencies drops Tor Browser zero-day on Twitter after recent Tor Browser update renders exploit less valuable.
Zerodium, a company that buys and sells vulnerabilities in popular software, has published details today on Twitter about a zero-day vulnerability in the Tor Browser, a Firefox-based browser used by privacy-conscious users for navigating the web through the anonymity provided by the Tor network.
In a tweet, Zerodium said the vulnerability is a full bypass of the "Safest" security level of the NoScript extension that's included by default with all Tor Browser distributions.
NoScript is a browser extension that uses a whitelist approach to let the user decide from what domains the browser can execute JavaScript, Flash, Java, or Silverlight content. It is included with all Tor Browser distributions because it provides an extra layer of security for Tor Browser users.
Zerodium's Tor zero-day basically allows malicious code to run inside the Tor Browser by bypassing NoScript's script-blocking ability.
(Score: 2) by linuxrocks123 on Wednesday September 12 2018, @04:22AM (1 child)
Swallowing the card may not be enough: https://petapixel.com/2016/06/13/swallowed-64gb-microsd-card/ [petapixel.com]
(Score: 0) by Anonymous Coward on Wednesday September 12 2018, @05:08AM
Swallowing is not "to get rid of it", just plausible deniability. If they don't know you had one in the first place, they will not come looking. But I'd wager it'd be hard to notice even in a cursory X-Ray. Those cards are fucking tiny.
If you wanna be sneaky, use a double-layered belt and jam the card between the layers. There are probably more ways to hide a microSD on the spot.