71–80 of 138 posts
So going on a not-HSTS site through tor can now infect your computer (through the MITM of the exit node)? Seems that using regular internet is actually safer now.
So going on a not-HSTS site through tor can now infect your computer (through the MITM of the exit node)? Seems that using regular internet is actually safer now.
In China the "regular internet" intercepts http and inserts javascript malware to create a DDOS botnet.
I reversed the shellcode, it's almost exactly the same used in 2013 (freedom hosting): https://twitter.com/TheWack0lian/status/803736507521474560
As much as I love Mozilla and their philosophy, it has to be said that - if you have any sort of worries about security - using Firefox is a bad choice and borderline reckless. It lacks even basic exploit mitigations that other browser have had for years now (most importantly a feature-complete sandbox). Right now, Firefox is just a single process with zero separation of privileges. Any bug in the rendering code is a…
Could you elaborate? I'm curious what they do for security.
Earlier quoted context omitted.
> A 30 second glance at the source code makes it looks like this exploit pivots to attacker-controlled memory on the heap, and spawns a thread using kernel32.dll. As EMET has hardening against attacks like this, I am curious if this exploit works at all on EMET-enabled Windows systems. EMET can be bypassed so it's no guarantee that it would stop the exploit (but it would probably stop THIS exploit). I don't know if s…
> A better solution would be to run javascript in a sandbox (as is done in Chrome/Chromium based browser) which has a much higher barrier to exit. Sure, but we can't get TBB rewritten overnight to work instantly with Chromium, and I'm sure there'd be a lot of push back on that.
Earlier quoted context omitted.
This likely points to this being an FBI "network investigative technique".* I'm really curious where this attack was injected, as that also means that that .onion is also compromised. My guess? Some darknet market. * Sure, this could be some type of awkward false flag, but it seems unlikely to my gut.
It's on a CP site (giftbox). The exploit got loaded on the confirmation page after logging in.
+1 to FBI on this being pretty well targeted; you had to have had a successful login for them to be attempting this in the first place. It's about as precise as they can get; you're only going after users that are active members of the service. They are at least being reasonable in who they are targeting. I can't really think of how they can be more targeted in attempting to deanonymize people in the network.
I don't like this whole NIT garbage because I'm afraid this will lead to fishing expeditions, where you just root everyone on an .onion that happens to visit it, and then clean up with a multitude of search warrants later and hope you get something. I also don't believe it's the FBI's (or America's) job to play world police.
-1 to the FBI, at least: they were (once again) actively serving CP on a compromised server again, which seems like something you shouldn't be doing as an LEA fighting the distribution of the content. Illegal actions shouldn't be taken to fight crime. Distributing the thing you are fighting is the definition of the abyss having gazed into you.
Earlier quoted context omitted.
> A 30 second glance at the source code makes it looks like this exploit pivots to attacker-controlled memory on the heap, and spawns a thread using kernel32.dll. As EMET has hardening against attacks like this, I am curious if this exploit works at all on EMET-enabled Windows systems. EMET can be bypassed so it's no guarantee that it would stop the exploit (but it would probably stop THIS exploit). I don't know if s…
I don't know much about EMET. How would they mitigate this? After all, it's obviously valid for a VM to call CreateThread.
So going on a not-HSTS site through tor can now infect your computer (through the MITM of the exit node)? Seems that using regular internet is actually safer now.
Exit nodes will also steal any unencrypted passwords and put malware in any binaries you download. It's been happening for years. In China the "regular internet" intercepts http and inserts javascript malware to create a DDOS botnet.
I'm talking about going anywhere on Tor can infect you.
So going on a not-HSTS site through tor can now infect your computer (through the MITM of the exit node)? Seems that using regular internet is actually safer now.
The same vulnerability apparently also exists in Firefox, which Tor Browser is based on.
Regular internet has a few protections:
1. Google safe browsing
2. AdBlocking
3. Websites try to keep their reputation.
Tor exit nodes, on the other hand, have no reputation (and if one gets sullied, spin up another) and costs money.