Firefox Zero-Day Used in Child Porn Hunt?
Summary: A claimed Firefox 17 zero-day was reportedly used in tandem with a U.S. law enforcement effort to identify Tor Browser users visiting child porn sites, after a large number of hidden service addresses tied to Freedom Hosting disappeared from the Tor Network around midnight on August 4, 2013. According to researcher Ofir David, code injected into pages served by Freedom Hosting checked whether visitors used Firefox 17 and redirected them to a site outside the Tor network that issued a UUID, allowing the operator to match a Tor user to a true Internet address.
Bottom line: The exploit was fixed in Firefox 22 and ESR 17.0.7, but the Tor Browser Bundle was built on Firefox 17 ESR, so the anonymity tool's own users carried the exposure. A domaintools.com lookup cited by Wired's Kevin Poulsen resolved the malicious script's controlling IP to a Verizon address space managed by defense contractor SAIC.
Read the original at Krebs on Security ↗
- Topics
- Cybercrime & Law Enforcement
- Related
- Gootloader Malware Disrupted After Infecting 25,000 Computers Cyber Risks · Nov 13, 2026354 dark web vendors and buyers arrested in Operation Tor Nado Cyber Risks · Nov 13, 2026Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure Cyber Risks · Nov 13, 2026