This will make a very interesting postmortem. I'm curious how they escaped from js
Javascript exploit actively used against TorBrowser
61–70 of 138 posts
Re: Javascript exploit actively used against TorBrowser
#62This only works in Windows, right?
This exploit is Windows-specific, though the vulnerability appears not to be.
Re: Javascript exploit actively used against TorBrowser
#63Earlier quoted context omitted.
Fine. Replace Tails with Whonix-Workstation and Whonix-Gateway, if you need to worry about leaking the IP address.
"If"? Are there any Tor users who don't need to worry about leaking their IP address? Then why do they use Tor in the first place? The Tor project itself seems to promote Tails much more than Whonix, which seems very odd to me.
After thinking about this, I agree with your point, but it's past me being able to edit my original comment to address this issue there.
OK, now you have an IP. Now what? You get a warrant and search the place. What do you find? A computer, maybe an amnesic virtual machine. No actual access to the website/onion in question. IMO Tails promotes better opsec when using Tor - you don't leave any traces behind of your browsing activity, and you can't gain persistence on the victim without a sandbox escape, since the Tails VM wipes itself. It is still a defense, but maybe not a good enough one.
Re: Javascript exploit actively used against TorBrowser
#64This only works in Windows, right?
This exploit is Windows-specific, though the vulnerability appears not to be.
Thanks. If you could say more about that, please do. Abstracting from 'The exact functionality is unknown but it's getting access to "VirtualAlloc" in "kernel32.dll" and goes from there.' to Linux etc is over my head.
Re: Javascript exploit actively used against TorBrowser
#65This only works in Windows, right?
The shellcode is Windows specific, but the bug is in Firefox. It is possible there is something server side sending the proper code depending on the user agent.
Re: Javascript exploit actively used against TorBrowser
#66Earlier quoted context omitted.
The VM can go "full screen" and lock the height/width in X, then.
We could do stretching then when the user tries to enbiggen it, that way they don't get deanonymized!
It is basically impossible to fully anonymize a browser as long as JavaScript+plugins are running. EFF's Panopticlick [1] and browserleaks [2] are good at explaining some of these fingerprinting vectors.
Re: Javascript exploit actively used against TorBrowser
#67Earlier quoted context omitted.
This exploit is Windows-specific, though the vulnerability appears not to be.
Thanks. If you could say more about that, please do. Abstracting from 'The exact functionality is unknown but it's getting access to "VirtualAlloc" in "kernel32.dll" and goes from there.' to Linux etc is over my head.
The underlying vulnerability has to do with a memory corruption of some sort in Firefox's SVG rendering, which is a code base that is shared across platforms. So probably an analogous memory corruption exists on other platforms, because it's compiled from the same C++. While it's possible that it's not exploitable outside of Windows, there is no specific reason to assume it won't be.
But the exploit here with the ROP chain, calling Windows APIs, etc., is apparently Win32-specific and doesn't have binary code that could run successfully on other platforms.
The setup for the exploit is apparently primarily in the Javascript function craftDOM() which makes some SVG objects and modifies some of their properties, presumably in a way that triggers an underlying bug in Firefox's SVG support. There is also a Win32 object code payload in the string object thecode, which would not be able to run unmodified on another platform. Also, the ROP chain code is likely to be Windows-specific in several respects. Indeed, the statement
throw"Bad NT Signature";
Re: Javascript exploit actively used against TorBrowser
#68So going on a not-HSTS site through tor can now infect your computer (through the MITM of the exit node)?
Seems that using regular internet is actually safer now.
Re: Javascript exploit actively used against TorBrowser
#69Earlier quoted context omitted.
Thanks. If you could say more about that, please do. Abstracting from 'The exact functionality is unknown but it's getting access to "VirtualAlloc" in "kernel32.dll" and goes from there.' to Linux etc is over my head.
The underlying vulnerability has to do with a memory corruption of some sort in Firefox's SVG rendering, which is a code base that is shared across platforms. So probably an analogous memory corruption exists on other platforms, because it's compiled from the same C++. While it's possible that it's not exploitable outside of Windows, there is no specific reason to assume it won't be. But the exploit here with the ROP…
Thanks, that helps.
Re: Javascript exploit actively used against TorBrowser
#70Earlier quoted context omitted.
Thanks! That's mostly what I suspected. Android does have massive market share outside of North America, but here it is much closer to 50/50. Obviously our security/privacy concerns are drastically different than those in other parts of the world so it makes sense to secure android first. It's hard to recommend alternative distributions of android to most people. I feel like it's similar to linux 15 years ago, it CAN…
Yes. Though in some countries and threat models (where Google/NSA is not your problem) we are seeing many activists/journalists switching entirely to a Google Platform...Google Apps, Docs, Android, Google Chromebooks etc. If implemented properly (two factor etc) in some threat models it actually makes more sense compared to a mishmash of systems without anyone capable of monitoring and protecting them - and it helps…
The Russian government just confirmed Sailfish for all government mobile work going forward: https://cdn.jolla.com/wp-content/uploads/bsk-pdf-manager/Jol...