3 ms·
The article is a bit light around the details of how it works; is it true that it only targets Windows machines?
by tankenmate 13y ago
The article is a bit light around the details of how it works; is it true that it only targets Windows machines?
- barrkel 13y agoFrom http://tsyrklevich.net/tbb_payload.txt http://tsyrklevich.net/tbb_payload.txt - yes. It uses Winsock routines and WinAPI stdcall calling conventions.
- clarkm 13y agoAnd here's the security advisory for the vulnerability, which was fixed in Firefox 22 and Firefox ESR 17.0.7: http://www.mozilla.org/security/announce/2013/mfsa2013-53.html http://www.mozilla.org/security/announce/2013/mfsa2013-53.ht...
- SageRaven 13y agoWhat does the code actually deliver in the HTTP request, and what path does the request travel? Is the exploit that the request is made outside of the TOR proxy (thus revealing the true origin IP) or that it gathers information about the host and sends that via TOR to some machine?
- Guvante 13y agoThe code is described as grabbing the MAC and hostname and sending them via a raw HTTP request to Virginia. Since it is a Windows executable, this is done outside of TOR.