Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Javascript exploit actively used against TorBrowser

lists.torproject.org

Post reply on HN
Print view View original

101–110 of 138 posts

Re: Javascript exploit actively used against TorBrowser

#101

Post by gcp »

lima wrote: post #97
gcp wrote: post #93

Earlier quoted context omitted.

There's no questioning that Chrome's sandbox implementation is ahead of Firefox: they've been shipping it for several years, whereas Firefox only got its first one out in Firefox 50 (for content! They had a Flash sandbox and DRM/media decoder sandbox for longer), with the more strict ones being in the Nightly/Dev Edition branches. It's possible the real Firefox is not vulnerable to this exploit because of that, but w…

> Parent sounds so bad because he seems to grade security by seeing how many CVE's the developer publishes, ignores the fact that browser exploits are often done by exploiting attack surface outside the browser (because all browsers are - relatively speaking to other software - secure), and conflating Chrome vs Chromium. By counting CVEs alone, Chrome would be the least secure since it has more CVEs than any other br…

In Chrome, yes. They happen rather often with Firefox.

Shrug, I disagree. The fuss made here illustrates it: 0-days are rare enough that "rather often" is a serious mischaracterisation.

Their security features are identical. It's the same code.

You said: "And it being open source means that I can use without worrying about backdoors or data leakage." Which has nothing to do with security. Inspecting Chromium tells you nothing about what Chrome does, and using Chromium means you miss features that Chrome has (H264, Netflix, ...)

Re: Javascript exploit actively used against TorBrowser

#102

Post by gcp »

akerro wrote: post #96
dispose13432 wrote: post #80

Earlier quoted context omitted.

But its worse on Tor. Regular internet has a few protections: 1. Google safe browsing 2. AdBlocking 3. Websites try to keep their reputation. Tor exit nodes, on the other hand, have no reputation (and if one gets sullied, spin up another) and costs money.

> But its worse on Tor. Oh is it? The exploit for upstream Firefox on Windows is now completely public, free of charge. How is that worse on Tor, where most people using it have idea that JS and 3rd party connections should be blocked?

You still need to intercept a users' connection and redirect them to malicious JS with a regular Firefox. For the attack to work on a large scale you'd typically you do this by compromising an ad network and hoping you get enough users before SafeBrowsing blacklists you.

With Tor on the other hand you can just run an exit node and infect the user even if (s)he's visiting a regular site.

Re: Javascript exploit actively used against TorBrowser

#103

Post by [deleted] »

lima wrote: post #100
gcp wrote: post #82

Earlier quoted context omitted.

Last time I checked, it was just for process separation and did not provide any security guarantees. It's a separate project from e10s (though it depends on it): https://wiki.mozilla.org/Security/Sandbox Chromium had a fair bit of sandbox escapes during the first years, and there's no reason to believe this is going to be different with Firefox. I agree. Note that people still find sandbox escapes against Chrome anyw…

> CVE counting See my reply below. Counting exploits, not CVEs. By CVE count, Chrome would be the worst.

[deleted]

Re: Javascript exploit actively used against TorBrowser

#105

Post by CmdrSprinkles »

michaelt wrote: post #88
vilhelm_s wrote: post #48

Earlier quoted context omitted.

I've never understood the Tails threat model, and this comment does not really help. You say that it will prevent the attackers from learning any information, except the real IP address of the user. But hiding the IP address of the user is the whole point of Tor. If you give that up, then what's even the point? The state can simply drive a black van to your house and get the rest of your information at their leisure.

If you're using Tor from a coffee shop, so an IP address alone isn't enough to identify you. Or if you're in a country oppressive enough that they'll raid your house for using Tor, but free enough that they'll let you off if they don't find evidence you were doing something illegal over Tor, and they didn't compromise the site you were visiting just asked your ISP to look for Tor users.

Definitely ignorant on the subject, but are there ANY nations that would meet that requirement? I would assume any that are savvy enough to detect tor AND care about it would probably not just say "Oh you crazy kids. Be more careful next time"

Re: Javascript exploit actively used against TorBrowser

#106

Post by codedokode »

gcp wrote: post #82
lima wrote: post #13

As much as I love Mozilla and their philosophy, it has to be said that - if you have any sort of worries about security - using Firefox is a bad choice and borderline reckless. It lacks even basic exploit mitigations that other browser have had for years now (most importantly a feature-complete sandbox). Right now, Firefox is just a single process with zero separation of privileges. Any bug in the rendering code is a…

Last time I checked, it was just for process separation and did not provide any security guarantees. It's a separate project from e10s (though it depends on it): https://wiki.mozilla.org/Security/Sandbox Chromium had a fair bit of sandbox escapes during the first years, and there's no reason to believe this is going to be different with Firefox. I agree. Note that people still find sandbox escapes against Chrome anyw…

> Note that people still find sandbox escapes against Chrome anyway. Yes, sometimes they use the OS, but due to how the sandboxing works that's to be expected.

Google developed special architecture to make browser safer. Other vendors did nothing, they just wait until exploit becomes public and patch the code (and yet they call their product "secure"). Google also motivated Microsoft to allow disabling potentially vulnerable kernel library. Google since long ago has their own PDF viewer (so people don't have to use Adobe viewer) and their own Flash plugin. As a result on contests like pwn2own exploits for Chrome are the most expensive.

Regarding Tor I am not sure if JS is really necessary for a secure network. You don't need it to read sites like wikileaks bit it provides a large attack surface and it might be better to have it disabled by default.

Re: Javascript exploit actively used against TorBrowser

#107

Post by lima »

gcp wrote: post #101
lima wrote: post #97

Earlier quoted context omitted.

> Parent sounds so bad because he seems to grade security by seeing how many CVE's the developer publishes, ignores the fact that browser exploits are often done by exploiting attack surface outside the browser (because all browsers are - relatively speaking to other software - secure), and conflating Chrome vs Chromium. By counting CVEs alone, Chrome would be the least secure since it has more CVEs than any other br…

In Chrome, yes. They happen rather often with Firefox. Shrug, I disagree. The fuss made here illustrates it: 0-days are rare enough that "rather often" is a serious mischaracterisation. Their security features are identical. It's the same code. You said: "And it being open source means that I can use without worrying about backdoors or data leakage." Which has nothing to do with security. Inspecting Chromium tells yo…

> The fuss made here illustrates it: 0-days are rare enough that "rather often" is a serious mischaracterisation.

A RCE in a browser is literally the worst possible case and Firefox had multiple of them, most trivially exploitable with JavaScript. This simply doesn't happen with Chrome.

> Chromium means you miss features that Chrome has (H264, Netflix, ...)

Google made an effort to open-source everything, including their PDFium PDF reader.

The only remaining bits are the Pepper flash player and the Encrypted Media Extensions. Both are closed source in Firefox as well. You can use them with Chromium just fine and both are sandboxed. They cannot be distributed with Chromium for licensing reasons, but nothing prevents you from downloading the Chrome package and extracting those two files. Many Linux distros have scripts which automate this.

Re: Javascript exploit actively used against TorBrowser

#108

Post by gcp »

lima wrote: post #107
gcp wrote: post #101

Earlier quoted context omitted.

In Chrome, yes. They happen rather often with Firefox. Shrug, I disagree. The fuss made here illustrates it: 0-days are rare enough that "rather often" is a serious mischaracterisation. Their security features are identical. It's the same code. You said: "And it being open source means that I can use without worrying about backdoors or data leakage." Which has nothing to do with security. Inspecting Chromium tells yo…

> The fuss made here illustrates it: 0-days are rare enough that "rather often" is a serious mischaracterisation. A RCE in a browser is literally the worst possible case and Firefox had multiple of them, most trivially exploitable with JavaScript. This simply doesn't happen with Chrome. > Chromium means you miss features that Chrome has (H264, Netflix, ...) Google made an effort to open-source everything, including t…

I specifically pointed out H264 support (and you ignored it) because it's an annoyance when using Chromium. And yes, that's due to licensing reasons as well.

Re: Javascript exploit actively used against TorBrowser

#109

Post by tdullien »

lima wrote: post #13

As much as I love Mozilla and their philosophy, it has to be said that - if you have any sort of worries about security - using Firefox is a bad choice and borderline reckless. It lacks even basic exploit mitigations that other browser have had for years now (most importantly a feature-complete sandbox). Right now, Firefox is just a single process with zero separation of privileges. Any bug in the rendering code is a…

Just to provide some balance: Chrome exploits are not as rare as you claim in this post. Pretty much any time Pwn2Own or similar contests are held, with non-trivial prize money, somebody brings a fully working Chrome exploit.

If you check https://zerodium.com/program.html you can see that the current market prize for a Chrome exploit with sandbox escape is about 80k USD. Firefox is cheaper (30k USD), but only by a bit more than factor 2.

(I've been working on security vulnerabilities pretty continuously since 1998, so I somewhat know what I am talking about)

In general, for any major browser: Given the size, complexity, and code churn, an attacker just needs enough motivation / time.

Re: Javascript exploit actively used against TorBrowser

#110

Post by tdullien »

tdullien wrote: post #109
lima wrote: post #13

As much as I love Mozilla and their philosophy, it has to be said that - if you have any sort of worries about security - using Firefox is a bad choice and borderline reckless. It lacks even basic exploit mitigations that other browser have had for years now (most importantly a feature-complete sandbox). Right now, Firefox is just a single process with zero separation of privileges. Any bug in the rendering code is a…

Just to provide some balance: Chrome exploits are not as rare as you claim in this post. Pretty much any time Pwn2Own or similar contests are held, with non-trivial prize money, somebody brings a fully working Chrome exploit. If you check https://zerodium.com/program.html you can see that the current market prize for a Chrome exploit with sandbox escape is about 80k USD. Firefox is cheaper (30k USD), but only by a bi…

Also, it is safe to say that ChakraCore (the JS interpreter inside Edge) is much more broken / easier to find bugs in than Firefox, at least at the moment.
Post reply on HN