Critical Tor flaw leaks users’ real IP address • Hacker News Board

Re: Critical Tor flaw leaks users’ real IP address

#21

Post by sillysaurus3 » Mon, Nov 06, 2017, 7:03 AM UTC

JoshTriplett wrote: post #18

sillysaurus3 wrote: post #16

If anyone is wondering how the attack works, here's a guess: file://../../dev/tcp/74.125.225.19/80 That would also explain why it works on 'nix but not windows. (This is probably mistaken, but the attack might be something along those lines.) Hmm... Anyone have a link to the hotfix diff? We could just look rather than guess.

/dev/tcp doesn't exist on the filesystem, only in bash, and only if enabled; some distributions like Debian disable it.

Yeah, it was a wild guess. I just looked over all the new bug tracker entries in Tor since Oct 28th, but none of them seem particularly critical.

Our best bet would be to look at Firefox's commit history since the 28th.

One crafty way to determine the exploit would be to bindiff the hotfix'd firefox binary vs the previous release and examine the diffs in a disassembler to see what code changed. Non-deterministic builds make that tricky, but it's a neat technique to be aware of.

Re: Critical Tor flaw leaks users’ real IP address

#22

Post by captainmuon » Mon, Nov 06, 2017, 7:04 AM UTC

saurik wrote: post #15

"Critical Tor flaw leaks users’ real IP address" This is not a problem with Tor: this is a problem with the Tor Browser (and even then, only on macOS and Linux: users on Windows are not affected)... I'd recommend changing the title as this otherwise sounds like some extremely concerning flaw in the platform itself, which this attack is not targeting.

The Tor project itself muddles the distinction. If you go to their website and click "download", you get the Tor Browser. They actively encourage people to only use Tor Browser and not roll their own (because your browser requests would look different and you would be trackable).

The "only way" (without contortions) to get Tor without the bundle is via linux package manager.

Re: Critical Tor flaw leaks users’ real IP address

#23

Post by mirimir » Mon, Nov 06, 2017, 7:06 AM UTC

This is truly such an obvious exploit, given well-acknowledged risks of opening files downloaded via Tor browser. I'm quite embarrassed that I didn't think of it. And I'm pretty sure that others have exploited it.

But on reflection, this is actually excellent news. At least, for those of us who don't rely on Tor browser. That is, Tor users occasionally get pwned. And now there's less reason to suspect unreported vulnerabilities in Tor itself.

Re: Critical Tor flaw leaks users’ real IP address

#24

Post by saurik » Mon, Nov 06, 2017, 7:30 AM UTC

captainmuon wrote: post #22

saurik wrote: post #15

"Critical Tor flaw leaks users’ real IP address" This is not a problem with Tor: this is a problem with the Tor Browser (and even then, only on macOS and Linux: users on Windows are not affected)... I'd recommend changing the title as this otherwise sounds like some extremely concerning flaw in the platform itself, which this attack is not targeting.

The Tor project itself muddles the distinction. If you go to their website and click "download", you get the Tor Browser. They actively encourage people to only use Tor Browser and not roll their own (because your browser requests would look different and you would be trackable). The "only way" (without contortions) to get Tor without the bundle is via linux package manager.

I know a bunch of people who use Tor in various ways that does not in any way involve a browser at all, and the ramifications of an attack at these two levels (in the routing stack vs. in the app layer) are very different. I appreciate why Ars Technica's headline is what it is, but this is Hacker News.

Re: Critical Tor flaw leaks users’ real IP address

#25

Post by kakarot » Mon, Nov 06, 2017, 7:42 AM UTC

mirimir wrote: post #23

This is truly such an obvious exploit, given well-acknowledged risks of opening files downloaded via Tor browser. I'm quite embarrassed that I didn't think of it. And I'm pretty sure that others have exploited it. But on reflection, this is actually excellent news. At least, for those of us who don't rely on Tor browser. That is, Tor users occasionally get pwned. And now there's less reason to suspect unreported vuln…

With an implementation like Whonix, arguably the only safe and (relatively) easy way to use Tor, this exploit wouldn't have worked. The Tor Project's insistence on placing ease of use above security is admirable and understandable, but it provides a very false sense of security for the majority of users, to the point where it can potentially be detrimental.

We sometimes take for granted our intelligence in this domain and forget that the average Tor user doesn't know shit about opsec.

Just last week I found out a relative has been exploring Tor behind a VPN, and try as I may, I couldn't make them understand what a MitM attack was. They just read from a random page on the internet that it was safer to use a VPN and didn't bother doing research because frankly, how would they know what to look for?

Re: Critical Tor flaw leaks users’ real IP address

#26

Post by kakarot » Mon, Nov 06, 2017, 7:46 AM UTC

cjbprime wrote: post #8

forapurpose wrote: post #5

If an attacker learned a Tor Browser user's real IP address yesterday, and the leak gets fixed today, can the attacker still somehow identify that user's traffic tomorrow? Browser fingerprinting comes to mind, but is there another method?

Depends on the attacker -- if they're able to surveil the network upstream of the IP address they just learned, they could use timing analysis. i.e. if the attacker is the FBI and they're trying to unmask visitors to an onion service, and they learned your IP address (and hence real life name) through this method, they can also confirm that you're visiting the site they're surveiling through correlating packet times…

It's my understanding that this exploit wouldn't work with a hidden service because there is no way for your machine to know how to connect to it directly and the connection must be established through the Tor network, unlike a regular website. Is this not the case?

Re: Critical Tor flaw leaks users’ real IP address

#27

Post by captainmuon » Mon, Nov 06, 2017, 7:47 AM UTC

saurik wrote: post #24

captainmuon wrote: post #22

Earlier quoted context omitted.

The Tor project itself muddles the distinction. If you go to their website and click "download", you get the Tor Browser. They actively encourage people to only use Tor Browser and not roll their own (because your browser requests would look different and you would be trackable). The "only way" (without contortions) to get Tor without the bundle is via linux package manager.

I know a bunch of people who use Tor in various ways that does not in any way involve a browser at all, and the ramifications of an attack at these two levels (in the routing stack vs. in the app layer) are very different. I appreciate why Ars Technica's headline is what it is, but this is Hacker News.

Yeah, you're right. This would be one of the cases where it makes sense to change the title.

Re: Critical Tor flaw leaks users’ real IP address

#28

Post by Buge » Mon, Nov 06, 2017, 8:01 AM UTC

mirimir wrote: post #12

> TorMoil, as the flaw has been dubbed by its discoverer, is triggered when users click on links that begin with file:// rather than the more common https:// and http:// address prefixes. When the Tor browser for macOS and Linux is in the process of opening such an address, "the operating system may directly connect to the remote host, bypassing Tor Browser," according to a brief blog post published Tuesday by We Are…

What do you mean the FBI's NIT used basically the same thing? Do you have a source?

Re: Critical Tor flaw leaks users’ real IP address

#29

Post by Buge » Mon, Nov 06, 2017, 8:09 AM UTC

forapurpose wrote: post #5

If an attacker learned a Tor Browser user's real IP address yesterday, and the leak gets fixed today, can the attacker still somehow identify that user's traffic tomorrow? Browser fingerprinting comes to mind, but is there another method?

If they saw the person's username, then they can keep tracking that username. Same with any type of cookies. Https obviously makes it harder to do on sites they don't own, but it still works on http sites and https sites they own.

Re: Critical Tor flaw leaks users’ real IP address

#30

Post by anonymous5133 » Mon, Nov 06, 2017, 8:16 AM UTC

mirimir wrote: post #12

> TorMoil, as the flaw has been dubbed by its discoverer, is triggered when users click on links that begin with file:// rather than the more common https:// and http:// address prefixes. When the Tor browser for macOS and Linux is in the process of opening such an address, "the operating system may directly connect to the remote host, bypassing Tor Browser," according to a brief blog post published Tuesday by We Are…

Agree completely. If you are running a TOR service/browser you should at least have an option to block all data that wants to move outside of TOR. Imo, the option should be enabled by default. It is better to have a "broken" service rather than risk leaking the real IP.

If I recall correctly, wasn't silkroad and alphabay compromised by such a flaw? silkroad leaked the server IP through the captcha and I think something similar for alphabay.