Menu
Mozilla wants US to disclose to it first any vulnerability found in Tor by government hackers

Mozilla wants US to disclose to it first any vulnerability found in Tor by government hackers

Mozilla says it wants to check if the vulnerable code is found in Firefox code

Mozilla has asked a court that it should be provided information on a vulnerability in the Tor browser ahead of it being provided to a defendant in a lawsuit, as the browser is based in part on Firefox browser code.

“At this point, no one (including us) outside the government knows what vulnerability was exploited and whether it resides in any of our code base,” wrote Denelle Dixon-Thayer, chief legal and business officer at Mozilla, in a blog post Wednesday.

Mozilla is asking the U.S. District Court for the Western District of Washington in the interest of Firefox users to ensure that the government must disclose the vulnerability to it before it is revealed to any other party, as any disclosure without advance notice to Mozilla will increase the likelihood that the exploit will become public before Mozilla can fix any associated vulnerability in Firefox.

The Tor browser comprises a version of Firefox with some minor modifications that add privacy features, and the Tor proxy software that makes the browser's Internet connections more anonymous, according to the filing.

The FBI had in 2015 used what it described as a “network investigative technique” to monitor users visiting a child pornography site, hidden on the so-called Tor anonymity network, which it had seized but kept live to identify its visitors.

The court has asked the government to produce information related to a security vulnerability that it exploited in the Tor browser. The defense wants information on the exploit to find out if the government exceeded its warrant conditions.

In its filing on Wednesday, Mozilla warned that “absent great care, the security of millions of individuals using Mozilla’s Firefox Internet browser could be put at risk by a premature disclosure of this vulnerability,” according to the filing.

The government has so far refused to tell Mozilla whether the vulnerability at issue in the case involves a Mozilla product. But Mozilla said in the filing that it has reason to believe that the exploit used by the government “is an active vulnerability in its Firefox code base that could be used to compromise users and systems running the browser.”

The government has also refused to tell Mozilla if the exploit went through the Vulnerabilities Equities Process (“VEP”), which is a government process for deciding whether to share or not information on security vulnerabilities, according to Mozilla.

If Mozilla is not allowed to intervene in the case to protect its interests, the court should certainly allow Mozilla to appear as a friend of the court or amicus curiae, according to the filing.

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Slideshows

IN PICTURES: Ingram Micro Innovation hits Auckland with Hewlett Packard Enterprise

IN PICTURES: Ingram Micro Innovation hits Auckland with Hewlett Packard Enterprise

Ingram Micro completed its nationwide roadshow in Auckland last month, kicking off its Innovation Hour series with Hewlett Packard Enterprise. Uncovering the latest in storage, networking and servers, the event outlined key market trends for resellers in 2016 and beyond.

IN PICTURES: Ingram Micro Innovation hits Auckland with Hewlett Packard Enterprise
IN PICTURES: FireEye celebrates channel at 2016 Partner Conference

IN PICTURES: FireEye celebrates channel at 2016 Partner Conference

FireEye welcomed 143 channel partners and distributors to FireEye's 2016 annual Partner Conference, FireEye A/NZ Momentum - held at Establishment in Sydney. Delegates heard from senior trans-Tasman channel leaders, marketing and the product divisions in the morning, with FireEye customers, incident responders and threat intelligence analysts sharing knowledge during the afternoon.

IN PICTURES: FireEye celebrates channel at 2016 Partner Conference
​IN PICTURES: Disruption in the data centre - Can the Kiwi channel capitalise?​

​IN PICTURES: Disruption in the data centre - Can the Kiwi channel capitalise?​

With New Zealand businesses now open to innovation, the industry sits on the cusp of significant disruption in the data centre. Driven by software-defined networking, the future of the data centre is fast becoming reality, as the channel seeks to keep up, keep innovating and keep growing. APC by Schneider Electric, Lenovo and key partners outlined how the channel can capitalise at The Grill restaurant in Auckland.

​IN PICTURES: Disruption in the data centre - Can the Kiwi channel capitalise?​
Show Comments