Simply put, a UAF bug means that the faulty part of the program asks the system to allocate it a block of memory, uses that memory for temporary data storage, hands the memory back when it’s no longer needed… That means that they don’t get blurry or pixellated, like regular images do, when you change the size of your browser window. SVGs are widely used on the web these days for line drawings and logos because they are converted from lines, circles, blocks and so on into images only at the moment they are displayed. The buggy code appears in the part of Firefox that deals with reading and displaying SVGs, or Scalable Vector Graphics files. That malware could be ransomware, a keylogger, a password stealer, a zombie to blast out spam, a DDoS attack bot, or any of a number of money-making criminal tools.Īccording to Mozilla, the bug that makes this exploit work, dubbed CVE-2016-9079, is what’s known as a use-after-free, or UAF for short. If you’re a Firefox user who isn’t worried about anonymity, this exploit is still a serious problem, because the crooks could easily change the payload to install malware without you knowing. That’s a pretty serious degree of de-anonymisation. If the computer in Portugal should answer the connection request, the code in the exploit sample we examined will transmit an HTTP request that contains your MAC address (the unique identifier of your network card) and your computer name. That means crooks (or law enforcement officers, or intelligence agents) who can entice you to visit a hidden site somewhere in the Tor network can use this exploit on their webserver to tie your real IP number to your activities on the dark web. TCP network connections include, as part of the protocol, the IP address of both the sender and recipient, so just attempting this connection gives away the true IP number of your computer, even if you’re browsing anonymously via Tor. If you’re a Firefox user or, even more importantly, a Tor Browser user, make sure you have the latest update.Īn zero-day exploit has been found in the wild that tricks an unpatched browser into making a web connection to a network address in Portugal.

Their behind-the-scenes work on this article. Thanks to Sophos exploit experts Mark Loman and Andrew O’Donnell for

Mozilla firefox esr 45.5.1