Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Javascript exploit actively used against TorBrowser

lists.torproject.org

Post reply on HN
Print view View original

21–30 of 138 posts

Re: Javascript exploit actively used against TorBrowser

#21

Post by micaksica »

secfirstmd wrote: post #12
micaksica wrote: post #11

Earlier quoted context omitted.

What's their biggest struggle with it? PS, if you're ever on the US West Coast or in Singapore, drop me a DM. I'll buy you a drink someplace.

Honestly? Many things: -It's tricky for a non-technical user to setup -It disrupts their regular workflow -People get frustrated with speeds of Tor etc -People get frustrated with Captcha (Dam Cloudflare!) and other things caused by using Tor in a safe manner. -People get annoyed as it doesn't solve their problems and exposure on mobile -You have to restart to run it -They can't run their regular programs on it - MS…

What's their threat model, then?

If you're going to be actively targeted by exploits like this, then you shouldn't give a damn about some of these tradeoffs. If you have journalists/activists willing to go to information war with a nation-state, they shouldn't be surprised when their adversaries have the resources to pwn them. If David wants to fight goliath, they will need to take this into account. The guys with guns and power want their heads.

If the activists/journalists/whatever don't want to take the necessary precautions to use computers to talk to people in a way in which they are protected from capable adversaries, then I'm not sure what it is that they are expecting.

Also, I was recommending these users simply defending in depth by using Tails as a sandbox for a leaky browser, to require a chain of expensive exploits (browser 0day + VM escape 0day). Training someone to install VirtualBox or VMWare and run an ISO from it doesn't really disrupt too much workflow and defends in depth against the browser issues, then again I am likely wrongfully assuming VT-x/VT-d and a lot of RAM on the activists' computers.

Re: Javascript exploit actively used against TorBrowser

#22

Post by tlrobinson »

easychewie wrote: post #18
tlrobinson wrote: post #10

I feel like Tor Browser should just spin up a fresh VM with a minimal Linux distribution and fullscreen Tor browser, with the VM's only networking tunneled through Tor. I think Hyper-V can do graphics as well and it looks like bhyve added some sort of graphics support earlier this year, but xhyve has none. Not sure if there are any other lightweight hypervisors that support graphics (or maybe just use a protocol like…

> fullscreen Tor browser Tor recommends not going full-screen, since window size can be used as one of several identifiers.

I mean fullscreen within the VM's desktop (no need for normal GNOME/KDE/whatever desktop), which itself may not be fullscreen on host OS. It would act like a native app. If you quit the browser it shuts down the VM.

Re: Javascript exploit actively used against TorBrowser

#23

Post by micaksica »

easychewie wrote: post #18
tlrobinson wrote: post #10

I feel like Tor Browser should just spin up a fresh VM with a minimal Linux distribution and fullscreen Tor browser, with the VM's only networking tunneled through Tor. I think Hyper-V can do graphics as well and it looks like bhyve added some sort of graphics support earlier this year, but xhyve has none. Not sure if there are any other lightweight hypervisors that support graphics (or maybe just use a protocol like…

> fullscreen Tor browser Tor recommends not going full-screen, since window size can be used as one of several identifiers.

The VM can go "full screen" and lock the height/width in X, then.

Re: Javascript exploit actively used against TorBrowser

#24

Post by secfirstmd »

micaksica wrote: post #21
secfirstmd wrote: post #12

Earlier quoted context omitted.

Honestly? Many things: -It's tricky for a non-technical user to setup -It disrupts their regular workflow -People get frustrated with speeds of Tor etc -People get frustrated with Captcha (Dam Cloudflare!) and other things caused by using Tor in a safe manner. -People get annoyed as it doesn't solve their problems and exposure on mobile -You have to restart to run it -They can't run their regular programs on it - MS…

What's their threat model, then? If you're going to be actively targeted by exploits like this, then you shouldn't give a damn about some of these tradeoffs. If you have journalists/activists willing to go to information war with a nation-state, they shouldn't be surprised when their adversaries have the resources to pwn them. If David wants to fight goliath, they will need to take this into account. The guys with gu…

If the activists/journalists/whatever don't want to take the necessary precautions to use computers to talk to people in a way in which they are protected from capable adversaries, then I'm not sure what it is that they are expecting.

I get what your saying but humans are humans, journalists are busy and security is a pain for most people (until they need it).

The threat model really depends and so is too wide for me to make any sweeping statements. Clearly a US journalist working on drone strikes is a different threat model to an democracy activist in Sudan.

Re: Javascript exploit actively used against TorBrowser

#25

Post by splesjaz »

micaksica wrote: post #17
splesjaz wrote: post #14

Earlier quoted context omitted.

VMs are all nice and that but if the exploit can compromise the TBB it's too late already, sandboxing needs to happen in the browser on Linux you can use namespaces + strict seccomp rules but don't know what one would use for Windows. First priority would be to sandbox the browser and work your way down if you want to sandbox more stuff. For Windows EMET can help to prevent certain exploits I guess but yea a browser…

Working within an assumed breach scenario, the VM is defense in depth. Firefox has holes, and it will continue to be relatively easily exploitable as long as TBB allows for plugins and JavaScript by default. There is reticence from TBB team to disable JS by default even in the face of a few of these 0days, so you have to protect TBB users a level down from the browser and assume it'll be popped. There are Windows "sa…

Last time I checked they were working on a TBB sandbox [1] Let's hope it will be there soon, subgraph has oz[2] and can be used with any program really then there is firejail[3] but these 2 are only on Linux available.

1: https://blog.torproject.org/blog/q-and-yawning-angel 2: https://github.com/subgraph/oz 3: https://github.com/netblue30/firejail

Re: Javascript exploit actively used against TorBrowser

#26

Post by mtgx »

tlrobinson wrote: post #10

I feel like Tor Browser should just spin up a fresh VM with a minimal Linux distribution and fullscreen Tor browser, with the VM's only networking tunneled through Tor. I think Hyper-V can do graphics as well and it looks like bhyve added some sort of graphics support earlier this year, but xhyve has none. Not sure if there are any other lightweight hypervisors that support graphics (or maybe just use a protocol like…

So basically Whonix?

https://www.whonix.org/

Re: Javascript exploit actively used against TorBrowser

#27

Post by nilved »

ikeboy wrote: post #15
tlrobinson wrote: post #10

I feel like Tor Browser should just spin up a fresh VM with a minimal Linux distribution and fullscreen Tor browser, with the VM's only networking tunneled through Tor. I think Hyper-V can do graphics as well and it looks like bhyve added some sort of graphics support earlier this year, but xhyve has none. Not sure if there are any other lightweight hypervisors that support graphics (or maybe just use a protocol like…

One word: whonix.

Another: Qubes

Re: Javascript exploit actively used against TorBrowser

#28

Post by Kenji »

lima wrote: post #13

As much as I love Mozilla and their philosophy, it has to be said that - if you have any sort of worries about security - using Firefox is a bad choice and borderline reckless. It lacks even basic exploit mitigations that other browser have had for years now (most importantly a feature-complete sandbox). Right now, Firefox is just a single process with zero separation of privileges. Any bug in the rendering code is a…

I learned this the hard way. Got a drive-by virus infection on Firefox a couple of years ago. I clicked on a link from a google search, and that website completely infected my machine, .exes started running. I thought it was a browser popup at first. It was not. Scary stuff. With Chrome, I feel much safer, and no such thing has happened again. To you, the reader, this might just be an anecdote. But to me it was very frustrating and time-consuming. These days, I always secure my browser properly, allowing only minimal amounts of cross-site requests, JavaScript and plugins.

Re: Javascript exploit actively used against TorBrowser

#29

Post by ryuuchin »

This may be an unpopular opinion here but if the TorBrowser folks cared about security they should switch to a Chromium based browser. The sandbox provided by it would be robust and well tested as it's used in Chrome.

I don't see why the two objectives of having a secure browser and the privacy/anonymity provided by Tor have to be diametrically opposed. You can have both.

Re: Javascript exploit actively used against TorBrowser

#30

Post by curveship »

micaksica wrote: post #8
slipstream- wrote: post #5

I reversed the shellcode, it's almost exactly the same used in 2013 (freedom hosting): https://twitter.com/TheWack0lian/status/803736507521474560

This likely points to this being an FBI "network investigative technique".* I'm really curious where this attack was injected, as that also means that that .onion is also compromised. My guess? Some darknet market. * Sure, this could be some type of awkward false flag, but it seems unlikely to my gut.

It's not much, but the code redirects the user to a 'member.php' page after 2 seconds. So whatever the target was, it probably had a member.php page.
Post reply on HN