Mozilla, owners of Firefox browser, are asking the Federal Bureau of investigation (FBI) to reveal information on how it was able to hack the Tor browser last year. Mozilla believe that since Tor is based on the Firefox browser’s coding, any bug or vulnerability able to hack into Tor might be easily replicated on Firefox browser.
Mozilla’s concerned is that knowledge of the bug would help it to improve security for Firefox users. That is a legitimate demand anyhow you look it. Every company has the right to ensure the protection of its clients. And this is what this demand from Mozilla is all about; the protection of Firefox users like me.
Mozilla’s chief in charge of legal matters, Denelle Dixon-Thayer, outlined these concerns in a blog post,
“Today, we filed a brief in an ongoing criminal case asking the court to ensure that, if our code is implicated in a security vulnerability, that the government must disclose the vulnerability to us before it is disclosed to any other party. We aren’t taking sides in the case, but we are on the side of the hundreds of millions of users who could benefit from timely disclosure.
The relevant issue in this case relates to a vulnerability allegedly exploited by the government in the Tor Browser. The Tor Browser is partially based on our Firefox browser code. Some have speculated, including members of the defense team, that the vulnerability might exist in the portion of the Firefox browser code relied on by the Tor Browser. At this point, no one (including us) outside the government knows what vulnerability was exploited and whether it resides in any of our code base. The judge in this case ordered the government to disclose the vulnerability to the defense team but not to any of the entities that could actually fix the vulnerability. We don’t believe that this makes sense because it doesn’t allow the vulnerability to be fixed before it is more widely disclosed.”
Mozilla’s case against the FBI was the fallout from a big operation carried out last year. The FBI was able to crack a website in the Dark Web, the part of the Internet that is only accessible anonymously through browsers like Tor. What made the case notorious was the fact that it was previously thought no websites in the Dark Web could be hacked. The operation led to the successful arrest of over a thousand men who were using the site for child pornography. The most notorious was the arrest of a former math teacher Alex Schreiber.
As for whether the FBI would comply with the request from Mozilla, that is very debatable. According to a report from Seattle Post-Intelligencer reports, rather than reveal how it hacked Tor, the Bureau would rather drop the case against one of the pedophiles charged to court. It is this particular case that Mozilla wants to be joined in so that the judge can compel the vulnerability to be released. The lawyers for the defendant on the one hand hand seem to be on the side of Mozilla. They are arguing that information on the malware used by the FBI needs to be released so that they can prove it was the malware that accessed the pornography material rather the the accused. This is like saying it is guns, rather than people, that kill.
However, though Mozilla is desirous of having that information like counsel to the defendants, their argument rests mainly on the fact that the information should be released to them first before anybody. The reason being that having that information in the open could be used against Firefox browser users like me. So Mozilla need the bug vulnerability to able to understand and fix the problem asap.
One gets the feeling Mozilla is trying to get water from stone. As far as the lawyers to the FBI are concerned, the main defendant in the case has all the data needed to determine if the accused actually accessed the child pornography website. That is another way of saying, ‘Take a hike Mozilla, we would never reveal that information to you.’ After the case with Apple, it is a safe bet that the FBI would do anything not to reveal how it hacked Tor last year.
photo credit: churchm.ag; bp.blogspot.com