In 2015, the FBI hacked Tor to identify users of child sex websites. Now, Mozilla is begging courts to divulge how the operation was carried out so that it can ensure its code for Firefox remains secure.
The original hack saw the FBI seize servers running a paedophile website called Playpen. But rather than shutting it down, the agents continued to run the servers, using software to identify the real IP and MAC addresses of users, despite the fact they were using Tor to access the site. ISPs were forced to hand over customer details and arrests followed.
The FBI refers to the approach it used as a network investigative technique, but it has steadfastly refused to divulge how it was performed. In a blog post, Mozilla’s Denelle Dixon-Thayer explained why it’s so desperate to know more about the vulnerability:
The Tor Browser is partially based on our Firefox browser code. Some have speculated, including members of the defence team, that the vulnerability might exist in the portion of the Firefox browser code relied on by the Tor Browser. At this point, no one (including us) outside the government knows what vulnerability was exploited and whether it resides in any of our code base.
Mozilla has now filed a brief with the US courts, requesting that the US government disclose the vulnerability. It points out that if the details were disclosed publicly without prior access granted to Mozilla, hackers may be able to exploit Firefox — a browser used by millions of people.
Firefox users the world over can probably get behind that particular line of argument.
[Mozilla]
Image by Håkan Dahlström