Attackers can deliver Fake Tor and Firefox Add-on Updates

The vulnerability could allow a man-in-the-middle attacker who is able to obtain a forged certificate for addons.mozilla.org to impersonate Mozilla servers and as a result, deliver a malicious update for NoScript, HTTPS Everywhere or other Firefox extensions installed on a targeted computer.

"This could lead to arbitrary code execution [vulnerability]," Tor officials warned in an advisory. "Moreover, other built-in certificate pinnings are affected as well."

Although it would be challenging to obtain a fraudulent certificate for addons.mozilla.org from any one of several hundred Firefox-trusted certificate authorities (CAs), it is within reach of powerful nation states attackers.

The vulnerability was initially discovered Tuesday by a security expert that goes by the name of @movrcx, who described the attacks against Tor, estimating attackers would need US$100,000 to launch the multi-platform attacks.

According to a report posted Thursday by independent security researcher Ryan Duff, this issue also affects Firefox stable versions, although a nightly build version rolled out on September 4 is not susceptible.

Duff said the actual problem resides in Firefox's custom method for handling "Certificate Pinning," which is different from the IETF-approved HPKP (HTTP Public Key Pinning) standard.

Certificate Pinning is an HTTPS feature that makes sure the user's browser accepts only a specific certificate key for a particular domain or subdomain and rejects all others, preventing the user from being a victim of an attack made by spoofing the SSL certs.

While not very popular, HPKP standard is often used on websites that handle sensitive information.

"Firefox uses its own static key pinning method for its own Mozilla certifications instead of using HPKP," says Duff. "The enforcement of the static method appears to be much weaker than the HPKP method and is flawed to the point that it is bypassable in this attack scenario."

Mozilla is scheduled to release Firefox 49 on September 20, so the team has enough time to deliver a fix. The Tor Project took just one day to address the flaw after the bug's disclosure went online.
Users of Tor Browser should update to version 6.0.5, while Firefox users should disable automatic add-on updates, a default feature in the browser, or should consider using a different browser until Mozilla releases the update.

source: Tor, Mozilla 

 

Read More

Google Safe Browsing Warning While Accessing The Pirate Bay Download Pages

Rather than internet providers blocking access to the URL (currently thepiratebay.org), certain web browsers are flagging torrent download pages with variations on the following message:

Mozzila Firefox Warning!

Reported Unwanted Software Page!

This web page at thepiratebay.org has been reported to contain unwanted software and has been blocked based on your security preferences.
Unwanted software pages try to install software that can be deceptive and affect your system in unexpected ways.

Google Chrome Warning!

The site ahead contains harmful programs

Attackers on thepiratebay.org might attempt to trick you into installing programs that harm your browsing experience (for example, by changing your homepage or showing extra ads on sites you visit).

If you click the Details  this is the message :

"Google Safe Browsing recently found harmful programs on thepiratebay.org.
If you understand the risks to your security, you may visit this site before the harmful programs have been removed."

It sounds like there may be a bad ad network on the torrent site and that Google isn't blocking the media repository itself. So, if the bright red screen has you worried, this problem should resolve itself fairly soon. Or if you're impatient, you can deal with false warnings from The Pirate Bay that your Flash player is out of date.

The website itself is not block although when you click the Magnet Link or download link the Red Warning appear.

 
While in MS Edge  I can browse easily which is my search engine is MSN.

I experience this red flag too when one of my ad networks has malware problem which I remove the source ads. I posted -> http://www.blogmytuts.net/2015/09/how-to-troubleshoot-blog-site-with.html

Read More

Mozilla's Firefox browser will start blocking Flash content

Mozilla's Firefox browser will start blocking Flash content "not essential to the user experience" from August 2016, the company said today, helping to hasten the achingly slow demise of the ageing plugin. The move is the beginning of the end of Flash in Firefox — Mozilla

The company says its August change is expected to reduce Flash-related crashes and hangs in Firefox by up to 10 percent, as well as giving users "enhanced security, improved battery life, faster page load, and better browser responsiveness." Data shared as part of today's announcement shows that Firefox plugin crashes dropped when both YouTube and Facebook switched from Flash video as default to HTML5, part of a downward trend that coincides with Flash's slow retirement. 

Mozilla is following the lead of many of its tech peers in phasing out Flash, including Google, Microsoft, and Apple, all of whom outlined plans to stop showing the ageing plugin by default in their browsers earlier this year. Adobe itself advised people to stop using its own software last December, but Flash still has its claws into many corners of the internet, making a swift death tricky.

Read More

Mozilla's Game That Will Teach You the Basics of Encryption

Meet Codemoji: Mozilla’s New Game for Teaching Encryption Basics with Emoji Today, Mozilla is launching Codemoji, a fun, educational tool that introduces everyday Internet users to ciphers — the basic building blocks of encryption — using emoji.

People will tell you that encryption is important to maintaining your online privacy, but how do you wrap your head around the concept? Mozilla wants to help. It's introducing a web-based game, Codemoji, that illustrates how ciphers work through emoji. Type in a phrase and Codemoji will both shift the letters and replace them with emoji. 

The challenge, as you might guess, comes when you get your friends to guess the meaning without turning to the Codemoji website.

 Mozilla stresses that you shouldn't use this as an honest-to-goodness secure communication system (it isn't). However, it should illustrate just why you'd want to protect your chats -- if your friends can't easily read your data, spies and thieves can't either.

How it works
Codemoji is a Web-based platform that allows users to write a message, encode it using emoji, and then send it to a friend.

A friendly reminder: Codemoji is intended as a learning tool, not a platform for sharing personal data. Thankfully, modern encryption is much stronger than simple emoji ciphers. If you are going to be sending sensitive information, best to use a more sophisticated security tool 😏.
Source: Codemoji, Mozilla Blog,

Read More

FBI argues keep its Tor hacking tool secret be classified

Defense teams across the US have been trying to get access to a piece of malware the FBI used to hack visitors of a child pornography site. None have been successful at obtaining all of the malware's code, and the government appears to have no intention of handing it over.

Now, the FBI is classifying the Tor Browser exploit for reasons of national security, despite the exploit already being used in normal criminal investigations well over a year ago. Experts say it indicates a lack of organization or technical capabilities within the FBI.

In the legal back-and-forth surrounding the FBI's hack and subsequent arrest of 1,500 users of a dark web child pornography site called Playpen, the FBI has now moved to classify the Tor Browser exploit they used, Motherboard reports, citing reasons of national security. 

Last month, Mozilla -- whose code much of the Tor Browser is based on -- asked the FBI to identify the exploit the agency used to install location-tracking malware on users' computers. That request was approved and then quickly thrown out by a judge in Washington state, who reversed his decision when the Justice Department also convinced him that the exploit was a matter of national security.

"The FBI has derivatively classified portions of the tool, the exploits used in connection with the tool, and some of the operational aspects of the tool in accordance with the FBI's National Security Information Classification Guide," the government's attorneys wrote in a filing made in response to one of the defendants earlier this month. As Motherboard points out, the FBI originally wanted to classify their reasons for not handing over the exploit, rather than the exploit itself. That filing has been amended and is simply waiting on a signature from the FBI Original Classification Authority to confirm it will be hidden from public view. While experts believe the national security excuse is tenuous, the Department of Justice does have a recorded history of classifying inappropriate information. A 2013 report from the DOJ's own office of the Inspector General revealed several documents in which "unclassified information was inappropriately identified as being classified."

If the FBI is successful in classifying their exploit tool, it would make it difficult to verify that their evidence, which affects over 1,500 related cases, was obtained through legal means. On the other hand, a legal loophole set in place by the Classified Information Procedures Act could allow the defense teams in these cases to review certain classified materials, although that's not guaranteed.

As for the Tor Project, the problems here are clear: how can an open, yet unknown, security flaw endanger the lives or human rights of those around the world who legitimately rely on a browser built for privacy and security?

WHAT IS DARK WEB/DEEP WEB?

 The “dark web” is a part of the world wide web that requires special software to access. One these, the most popular is Tor (originally called The Onion Router), partly because it is one of the easiest software packages to use. Tor downloads as a bundle of software that includes a version of Firefox configured specifically to use Tor.

Example Dark Web onion without Tor you can NOT access

Where can I find more .onion sites?

.onion site list

• http://idnxcnkne4qt76tg.onion - The TOR Project
• http://v6pgrjno6mzbjicf.onion - The Onion Press
• http://am4wuhz3zifexz5u.onion - The TOR Library
• http://zbnnr7qzaxlk5tms.onion - WikiLeaks mirror
• http://kpvz7ki2v5agwt35.onion - Hidden Wiki
• http://dg6exbqq42btatnw.onion - GNUnet file sharing
• http://3g2upl4pq6kufc4m.onion - Duck Duck Go search engine
• http://utup22qsb6ebeejs.onion - "My Hidden Blog" privacy blog
• http://hpuuigeld2cz2fd3.onion - Deep Search

Other external resources:

• TOR hidden services - on Wikipedia
• How to find active .onion sites - external article
• http://ahmia.fi - Onion Site List

 
Once inside, web sites and other services can be accessed through a browser in much the same way as the normal web.

However, some sites are effectively “hidden”, in that they have not been indexed by a search engine and can only be accessed if you know the address of the site. Special markets also operate within the dark web called, “darknet markets”, which mainly sell illegal products like drugs and firearms, paid for in the cryptocurrency Bitcoin.

Now Dark Web is not Dark anymore because of FBI and NSA



Source: Motherboard

Read More

Mozilla Firefox includes Tracking Protection in Private Browsing

Third party trackers follow, follow, follow your trail around the Web. Smash them with Private Browsing in Firefox, the only browser with Tracking Protection. 

As you browse the web, Firefox remembers lots of information for you - like the sites you've visited. There may be times, however, when you don't want people with access to your computer to see this information, such as when shopping for a present. Private Browsing allows you to browse the Internet without saving any information about which sites and pages you’ve visited.

Private Browsing also includes Tracking Protection in Private Browsing, which prevents companies from tracking your browsing history across multiple sites. To learn more about Private Browsing with Tracking Protection in Firefox, see Tracking Protection in Private Browsing. 

You're browsing privately

Not Saved

•     History
•     Searches
•     Cookies
•     Temporary Files

Saved

•     Downloads
•     Bookmarks

How Tracking Protection works:
When you see the shield, Frirefox is blocking some parts of the page that could track your browsing activity.

Differences to expect:
Some page areas may be missing, becuase they could allow third parties to track your across different website.

 No Tracking Protection

 With Tracking Protection

Want to make changes?
it's easy to turn off tracking Protection for the website you're on by clicking "Disable protection for this session."

NOTE:
Please note that your employer or Internet service provider can still track the pages you visit. Private Browsing doesn't make you anonymous on the Internet. Your Internet service provider, employer, or the sites themselves can still track what pages you visit. Private Browsing also doesn't protect you from keyloggers or spyware that may be installed on your computer.

Read More

How to reset Firefox and Chrome back to its default state

Resetting your browser to its default state can often fix problems. For example, a program you install may change your search engine, install toolbars, and do other unwelcome things. Or you may have accidentally changed advanced settings on your own.

Google Chrome

Google Chrome has an option that will reset itself to its default settings. To find this option, open Chrome’s menu and select Settings. Perform a search for “reset browser” and you’ll see the Reset browser settings button.

1. Go to Chrome Setting , find and click "Show Advance Settings"

2. Click Reset Settigs.

Mozilla Firefox

Firefox also allows you to return it to original default state. To do so, click the Firefox menu button, point to Help, and select Troubleshooting Information.

1. Firefox menu button click the  Question Mark Icon  (Help)

2. Select Troubleshooting Information

3. There is two option for  you Reset Firefox or Reset with Add-ons are only disabled

The Reset feature accomplishes this by creating a new profile for you, copying this important data over. Your old profile will be placed on the desktop in a folder titled “Old Firefox Data.” If you lose important data in the reset, you can attempt to recover it from this folder. If you don’t need the folder, you’re free to delete it.

Wrong home page opens when I start Firefox or Chrome - How to fix

Some third-party software providers might change Firefox's shortcut so that the browser always opens their page. To prevent this from happening, make sure you decline any options to set your site preferences when installing or updating a third-party application.

If the wrong home page keeps opening even when you've taken steps to remove a toolbar that's taken over Firefox and restored your home page, try checking the Firefox shortcut:

1. Right-click on the Firefox icon on your desktop or task bar, then click on Properties.

2. In the Target: field, you'll see the web address that the software provider keeps telling Firefox to load when you open the browser (for example, "http://blogmytuts.net"). Delete that web address and click OK to save your changes: 

NOTE: This also apply to Chrome

In some cases you need to unpin all the shortcut browser on the task bar to because the have same links on your desktop shortcut.

Read More

Lightbeam for Firefox 1.2.1.1 - See who’s tracking you online

Lightbeam is a Firefox add-on that uses interactive visualizations to show you the first and third party sites you interact with on the Web. As you browse, Lightbeam reveals the full depth of the Web today, including parts that are not transparent to the average user. 


About this Lightbeam Add-on
Using interactive visualizations, Lightbeam enables you to see the first and third party sites you interact with on the Web. As you browse, Lightbeam reveals the full depth of the Web today, including parts that are not transparent to the average user. Using two distinct interactive graphic representations — Graph and List — Lightbeam enables you to examine individual third parties over time and space, identify where they connect to your online activity and provides ways for you to engage with this unique view of the Web.

How Lightbeam Works
When you activate Lightbeam and visit a website, sometimes called the first party, the add-on creates a real time visualization of all the third parties that are active on that page. The default visualization is called the Graph view. As you then browse to a second site, the add-on highlights the third parties that are also active there and shows which third parties have seen you at both sites. The visualization grows with every site you visit and every request made from your browser. In addition to the Graph view, you can also see your data in a List view to drill down into individual sites.

How is my information stored?
All info generated and used for Lightbeam’s visualizations and features are only stored locally on your computer. You can save a copy of your connection history at any time, which is also where you can see the specific data collected by the add-on. You may also reset Lightbeam to erase your locally stored connection history, disable it to stop data collection or uninstall it to instantly remove all locally stored data related to Lightbeam. Additional information related to Lightbeam’s file format is available here

The origins of Lightbeam
Lightbeam began in July 2011 as Collusion, a personal project by Mozilla software developer Atul Varma. Inspired by the book The Filter Bubble, Atul created an experimental add-on to visualize browsing behavior and data collection on the Web.

In February 2012, Gary Kovacs, Mozilla CEO at the time, introduced the Collusion add-on in a TED talk (now one of the most watched TED talks) about exposing online tracking.

In September 2012, Mozilla joined forces with students at Emily Carr University of Art + Design to develop and implement visualizations for the add-on. With the support of the Ford Foundation and the Natural Sciences and Engineering Research Council (NSERC), Collusion has been re-imagined as Lightbeam and was launched in the fall of 2013.

To read more about the collaboration, please visit http://www.simcentre.ca

How to used ?

1. Open the Lightbeam tab by clicking the logo in the Toolbar.
   
2. Lightbeam starts recording connections as soon as it's installed. If you open it now, you'll see a blank screen because nothing's been recorded yet.
3. To start visualizing your online interactions, open a new tab, navigate to a site, and then check back to the Lightbeam tab to see how your connections graph appears.

Read More

New Firefox 40.0 Can Use Cortana Web Search

Firefox 40.0 sticks it to Microsoft, redirects Cortana searches in Windows 10. Users who set Firefox as their default browser can use Cortana web search with whatever search engine they want, instead of just Bing.

However, the newly released Firefox 40, which is the first version of the browser that bring full support for Microsoft’s latest operating system, users no longer have to use Bing for web searches from Cortana on the taskbar.

Instead, Firefox shows results from whatever search engine the user has selected as default.

READ: How to Change Windows 10 Default Web Browser
 
Now that’s what you call, sticking it!

If you upgrade to 40.0 this link will pop out  https://www.mozilla.org/en-US/firefox/windows-10/welcome/

Obviously, Firefox is not the only way to replace Cortana searches from Bing to Google, or whatever search engine. However, it is currently the only browser that does this without requiring third-party extensions or plugins.

Stands to reason that Redmond wants to use the Windows platform to establish and promote Microsoft services, particularly the Bing search engine. Competitors were never going to let this happen without a little fight, and that’s the reality of the computing landscape.

Mozilla is irked by the fact that Windows 10, in its installation process, sets Edge as the default browser for anyone that uses the Express settings. Furthermore, replacing it without another choice is a bit harder this time.

At least for less experienced users.

That said, Mozilla is one of the few browser developers that have embraced the new Windows 10 platform. This latest release of Firefox includes what they call thoughtful tweaks to the user interface.

Bolder icons, a look that is more in line with Microsoft’s new OS, as well as menus that take a little less space than previews versions of the web browser, leaving more room for web content.

You may also like to read :

• How to Change Windows 10 Default Web Browser
• Update Firefox 39.03 Now! to Patch Critical File Stealing Vulnerability

Read More

Meet Firefox Hello, the easiest way to connect for free over video with anyone, anywhere

You can now make free video and voice calls directly from your Web browser without having to set up an account, thanks to Mozilla.

The browser maker introduced Firefox 35, which includes the new Hello video-calling feature first introduced in beta this past October. You'll see the new Hello icon in the menu bar and in the customization panel; simply click the button labeled "Start a conversation" to begin chatting with someone.

When you start a conversation, a new window will open showing a self-view until the other person clicks the link to join you. While you're waiting for the other person to pick up the call, you can navigate away from the video chat window to a different website, and Hello will notify you when your friend has joined the room.

Each conversation will use a unique URL, and you can create multiple conversations and name them for different occasions. Mozilla said this should make it easier to go back to the people you speak to regularly without having to create a new link each time.

"This can all be done without the need for setting up an account or giving up any of your personal information," the Mozilla team wrote in a blog post Tuesday. "You might label one conversation '121' for your weekly check-in with a co-worker and another 'Family time' for your regular family catch-up. Your saved conversations will always be there when you need them."

The person on the other end of the line doesn't even have to be using Firefox. The service lets you connect with those using Chrome and Opera as well.

You can also sign in with a Firefox account so contacts will know you're online, and import additional contacts to your Hello address book from Google. To do so, select "Import Contacts" from the address book then sign into your Google account to give permission.

Mozilla has been developing Hello with Spanish telecom giant Telefónica, and said it's just getting started. "As we look to expand Firefox Hello into a comprehensive tool for communicating over the Web, we'll be testing new features like screen sharing and online collaboration so people can be more productive and get the most out of their video calls," the team wrote.

Read More

Update Firefox 39.03 Now! to Patch Critical File Stealing Vulnerability

Earlier this week, Mozilla Security researcher Cody Crews discovered a malicious advertisement on a Russian news site that steals local files from a system and upload them to a Ukrainian server without the user ever knowing.

Mozilla released a security patch for the Firefox browser after finding a  serious vulnerability being exploited in the wild. The vulnerability allows malicious attackers to use some JavaScript magic to “search for and upload potentially sensitive” from your hard drive to their servers.

The malicious advertisement was exploiting a serious vulnerability in Firefox's PDF Viewer and the JavaScript context in order to inject a script capable of searching sensitive files on user's local file systems.

Mozilla versions of Firefox that do not contain the PDF Viewer, such as Firefox for Android, are not affected by the "Same origin violation and local file stealing via PDF reader" vulnerability.

Mozilla is asking all Firefox users to upgrade immediately to version 39.0.3. Anyone on the Firefox Extended Support release via their school or business should upgrade to version 38.1.1. 

Mozilla first became aware of the flaw after a Firefox user noticed that an ad embedded on a Russian news site was using an exploit to search for sensitive files. The malware would then upload the sensitive files to a server in the Ukraine. This all appears to happen in the background with the user none the wiser. The malware also leaves no trace it was ever on your machine.

The specific exploit found in the wild was only targeting Windows and Linux PCs; however, Veditz warns that Mac users would be vulnerable if the malware had been crafted differently.
The exploit does not execute any arbitrary code but injects a JavaScript payload into the local file context, allowing the script to search for and upload potentially user’s sensitive local files.

All an attacker need to do is load the page with this exploit and sit back and relax. The exploit will silently steal files in the background.

According to Mozilla lead security researcher Daniel Veditz the specific exploit found in the wild was only targeting Windows and Linux PCs; however, Veditz warns that Mac users would be vulnerable if the malware had been crafted differently.

The exploit specifically searches for:

• FTP configuration files, subversion, s3browser, Filezilla, libpurple, the PSI Plus and Pidgin chat clients that are popular choices for encrypted, off-the-record messaging and other account information on Windows systems.
• Global configuration files and user directories on Linux systems.

"The exploit leaves no trace it has been run on the local machine," Veditz wrote in a blog post. "If you use Firefox on Windows or Linux it would be prudent to change any passwords and keys found in the above-mentioned files if you use the associated programs. If not, you should still update your browser as soon as possible in case other, as-yet-unknown exploits are looking for sensitive files you do have on your system. "

Any files encountered by the exploit are uploaded to a server in Ukraine.

Mac users are currently safe from this exploit, but researcher warned that another payload could potentially exploit the same vulnerability to target Mac systems. 

Read More

Mozilla Firefox FoxYeah Campaign

Following our recent news which saw Firefox place 'read-it-later' support directly into the browser, Mozilla has now launched a marketing campaign titled with the slogan 'FoxYeah' in a bid to win over more users.

The spiel at the top of the page reads "know someone who needs to download Firefox? #FoxYeah you do! Go ahead, send them a personal invite below," and seems like a bid to turn its users into some form of fan-boys, advocating for a brand they support.

With panels on the foxyeah.Mozilla website telling users to do things like invite followers, 'invite your peeps' and more, he page continues on for quite some time telling you which people you should invite from random walks of life.

We're not exactly sure if there is anything else to this campaign at all.

BUT.....

Firefox helps you take control of your personal information online
Most of us grew with internet so we are used to things. Having our date share without our knowledge,
We talked to some people who got online later in life.


Firefox gives you a choice in what you share about yourself online.

Why I choose Firefox ‪#‎WhenItsPersonal‬: Maybe I don’t want to share what I’m reading. Or eating. Or buying.

When You're browsing privately

Firefox won't remember any history for this window.

That includes browsing history, search history, download history, web form history, cookies, and temporary internet files. However, files you download and bookmarks you make will be kept.

While this computer won't have a record of your browsing history, your employer or internet service provider can still track the pages you visit.

No Need to CCleaner or Clear Browsing History :)



Visit: https://foxyeah.mozilla.org/?post=255 for more info.



How do you used the Internet?

Read More

Mozilla accidentally leaks 76,000 email ids and 4000 password hashes of its developers on a public web server

Mozilla is the foundation behind popular Firefox Web Browser. Its web browser is very popular among testers, pen testers and developers.  Yesterday Mozilla Foundation issued a warning that it had mistakenly exposed information on almost 80,000 members of its Mozilla Developer Network (MDN) as a result of a botched data sanitization process internally.

Stormy Peter, Director of Developer Relations at Mozilla Foundation said that Mozilla issued a public statement via its Mozilla Security Blog on Friday.

As per the Blog, Mozilla Developer Data Exposed “Starting on about June 23, for a period of 30 days, a data sanitization process of the Mozilla Developer Network (MDN) site database had been failing, resulting in the accidental disclosure of MDN email addresses of about 76,000 users and encrypted passwords of about 4,000 users on a publicly accessible server.”

The data was leaked on to a public server but it doesnt necessarily mean that all the cyber users had access to it.  But it also means that if some person with a mala fide intent has downloaded the date before it was cleaned up, those 76000 developers are in for a lot of hell in future.  Though Peter said that Mozilla hasn’t seen any malicious activity the server, but also noted they can’t rule it out as of now.

As for the data downloads, it has been download only a small number of times according to a comment posted by Julien Vehent on Y Combinator's Hacker News.

"We traced back as much as we could. Access logs, netflow data, etc.," the user wrote. "We found that the tar.gz containing the DB dump had been downloaded only a small number of times. Mostly by known contributors. But we can't rule out that someone with malicious intentions got access to it."

According to Peter, the encrypted passwords were salted hashes and they by themselves cannot currently be used to authenticate with the MDN. However, Peter warned that MDN users may be at risk if they reused their original MDN passwords on other non-Mozilla websites or authentication systems. Peter further clarified in comments on the blog that the exposed passwords included salts that were unique to each user record.

Mozilla Foundation has sent notices to all the affected developers and suggested that those who had both email and password information exposed change any similar passwords they may be using elsewhere.

Read More