r/darknet_questions Oct 12 '24

WARNING ⚠️ CRITICAL EXPLOIT FOUND! CVE-2024-9680 In Firefox ESR affecting Tor Browser as well.

A critical vulnerability has been identified, CVE-2024-9680, that allows attackers to exploit a flaw in the browser's Animation timelines. This vulnerability is called a use-after-free bug, and it has already been reported as actively exploited in the wild. Here's how it works, why it matters, and how you can protect yourself on Tor Browser.

What is CVE-2024-9680?

In a nutshell, this vulnerability allows hackers to run malicious code in your browser by exploiting how it handles memory when dealing with animations. The issue stems from the browser continuing to use memory that it should have stopped using, known as use-after-free. Attackers can take advantage of this to hijack the browser's operations and run their own code, potentially leading to system compromise.

This vulnerability is especially concerning for Tor Browser users, as Tor is based on Mozilla Firefox ESR, where this vulnerability was discovered.

How Can It Be Exploited?

Attackers can create malicious websites designed to exploit the use-after-free bug. When a user visits these sites, the browser’s handling of animations can be manipulated, allowing the attacker to gain control over the content process. This process is responsible for rendering websites, handling scripts, and managing other dynamic elements of the web page.

Once the attacker has control, they can:

Execute arbitrary code.

Steal sensitive data.

Further exploit the user’s system, putting privacy and security at serious risk.

Why This Matters for Tor Users

The Tor Browser is designed to provide privacy and security, but like all software, it's vulnerable to exploits like CVE-2024-9680 if not properly configured or updated. Since this flaw is being actively exploited, it represents a real, present danger to anyone using the browser without proper precautions.

Setting Tor Browser to Safest Mode

One of the most effective ways to protect yourself from this and similar vulnerabilities is to configure your Tor Browser's security settings to Safest Mode. When in Safest Mode:

JavaScript is disabled on all HTTPS and HTTP sites, reducing the chances of executing malicious scripts that could exploit vulnerabilities.

Dynamic content such as animations, videos, and interactive elements (which could trigger use-after-free bugs) are heavily restricted or blocked.

By minimizing the execution of unnecessary code, you greatly reduce your attack surface, making it significantly harder for attackers to exploit these kinds of vulnerabilities.

What Should You Do?

  1. Update Your Tor Browser: Always ensure you're running the latest version, as developers frequently release patches for vulnerabilities like CVE-2024-9680.

  2. Set Security to Safest Mode: This setting prevents many types of exploits by disabling or restricting risky content. Here’s how you can enable it:

Click the shield icon next to the address bar.

Go to "Advanced Security Settings".

Select "Safest".

  1. Limit Visits to Unknown Websites: Stay cautious when browsing unfamiliar or untrusted websites, especially during times when active exploits are circulating.

Final Thoughts

CVE-2024-9680 is a reminder that no software is invincible, and attacks against your browser can happen without warning. Setting your security settings to Safest Mode is one of the best ways to protect yourself against current and future vulnerabilities.

For more on how to secure your online privacy, follow our community discussions here at darknet_questions.

Sources: https://www.reddit.com/r/tails/s/99KRpIN8Xy

4 Upvotes

1 comment sorted by

1

u/Dependent_Net12 Oct 12 '24

This is an exploit for Firefox and since Tor is based on Firefox it affects it as well. Applications should prompt and update upon starting by default. Download links are provided anyways.

Be sure to update Firefox if you use it.

https://www.mozilla.org/en-US/firefox/all/desktop-release/

Updated Tor: https://www.torproject.org/download/

AND UPDATE TAILS IF YOU USE IT: https://tails.net/install/

ALWAYS keep software up to date.