Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Critical Tor flaw leaks users’ real IP address

arstechnica.com

Post reply on HN
Print view View original

31–40 of 91 posts

Re: Critical Tor flaw leaks users’ real IP address

#31

Post by anonymous5133 »

kakarot wrote: post #25
mirimir wrote: post #23

This is truly such an obvious exploit, given well-acknowledged risks of opening files downloaded via Tor browser. I'm quite embarrassed that I didn't think of it. And I'm pretty sure that others have exploited it. But on reflection, this is actually excellent news. At least, for those of us who don't rely on Tor browser. That is, Tor users occasionally get pwned. And now there's less reason to suspect unreported vuln…

With an implementation like Whonix, arguably the only safe and (relatively) easy way to use Tor, this exploit wouldn't have worked. The Tor Project's insistence on placing ease of use above security is admirable and understandable, but it provides a very false sense of security for the majority of users, to the point where it can potentially be detrimental. We sometimes take for granted our intelligence in this domai…

Most security advice is always dumbed down like that. "Always do this" "always do that" without actually explaining why or the risks of doing it etc.

Re: Critical Tor flaw leaks users’ real IP address

#32

Post by qeternity »

sillysaurus3 wrote: post #21
JoshTriplett wrote: post #18

Earlier quoted context omitted.

/dev/tcp doesn't exist on the filesystem, only in bash, and only if enabled; some distributions like Debian disable it.

Yeah, it was a wild guess. I just looked over all the new bug tracker entries in Tor since Oct 28th, but none of them seem particularly critical. Our best bet would be to look at Firefox's commit history since the 28th. One crafty way to determine the exploit would be to bindiff the hotfix'd firefox binary vs the previous release and examine the diffs in a disassembler to see what code changed. Non-deterministic buil…

Isn't this pretty standard practice?

Re: Critical Tor flaw leaks users’ real IP address

#33

Post by amluto »

Ugh. Linux has this shiny feature called network namespaces. Tor Browser should run in a network namespace such that it has no access to the Internet and doesn't know it's real IP address in the first place and therefore can't have this kind of leak barring a code execution attack and a sandbox break.

Re: Critical Tor flaw leaks users’ real IP address

#34

Post by sillysaurus3 »

anonymous5133 wrote: post #30
mirimir wrote: post #12

> TorMoil, as the flaw has been dubbed by its discoverer, is triggered when users click on links that begin with file:// rather than the more common https:// and http:// address prefixes. When the Tor browser for macOS and Linux is in the process of opening such an address, "the operating system may directly connect to the remote host, bypassing Tor Browser," according to a brief blog post published Tuesday by We Are…

Agree completely. If you are running a TOR service/browser you should at least have an option to block all data that wants to move outside of TOR. Imo, the option should be enabled by default. It is better to have a "broken" service rather than risk leaking the real IP. If I recall correctly, wasn't silkroad and alphabay compromised by such a flaw? silkroad leaked the server IP through the captcha and I think somethi…

If an adversary can achieve network access on your box, they can usually download malware.

At that point, it's game over. No firewall rules will protect you. The moment you shut off Tor, you're owned.

This is exactly why it's crucial to use Whonix or Tails.

Re: Critical Tor flaw leaks users’ real IP address

#35

Post by sillysaurus3 »

qeternity wrote: post #32
sillysaurus3 wrote: post #21

Earlier quoted context omitted.

Yeah, it was a wild guess. I just looked over all the new bug tracker entries in Tor since Oct 28th, but none of them seem particularly critical. Our best bet would be to look at Firefox's commit history since the 28th. One crafty way to determine the exploit would be to bindiff the hotfix'd firefox binary vs the previous release and examine the diffs in a disassembler to see what code changed. Non-deterministic buil…

Isn't this pretty standard practice?

It is. But no one has posted details of the exploit yet. I was hoping someone would go find that out.

(I can't right now else I would.)

Re: Critical Tor flaw leaks users’ real IP address

#36

Post by mirimir »

Buge wrote: post #28
mirimir wrote: post #12

> TorMoil, as the flaw has been dubbed by its discoverer, is triggered when users click on links that begin with file:// rather than the more common https:// and http:// address prefixes. When the Tor browser for macOS and Linux is in the process of opening such an address, "the operating system may directly connect to the remote host, bypassing Tor Browser," according to a brief blog post published Tuesday by We Are…

What do you mean the FBI's NIT used basically the same thing? Do you have a source?

What I mean is that it pwns users by bypassing Tor, and reporting their ISP-assigned IP addresses. I'm not arguing that the methods for doing that are similar.

[edited for coherence]

Re: Critical Tor flaw leaks users’ real IP address

#37

Post by mirimir »

sillysaurus3 wrote: post #34
anonymous5133 wrote: post #30

Earlier quoted context omitted.

Agree completely. If you are running a TOR service/browser you should at least have an option to block all data that wants to move outside of TOR. Imo, the option should be enabled by default. It is better to have a "broken" service rather than risk leaking the real IP. If I recall correctly, wasn't silkroad and alphabay compromised by such a flaw? silkroad leaked the server IP through the captcha and I think somethi…

If an adversary can achieve network access on your box, they can usually download malware. At that point, it's game over. No firewall rules will protect you. The moment you shut off Tor, you're owned. This is exactly why it's crucial to use Whonix or Tails.

Well, they can also download malware to when you're using Whonix or Tails. The Whonix workstation VM can not reach the Internet except through its Tor gateway VM. And the gateway VM only accepts connections from the workstation VM to the Tor process.

I'm not sure that Tails protects as well against malware. Its emphasis is on leaving no traces on your computer. Being a LiveCD, and wiping RAM during shutdown.

Re: Critical Tor flaw leaks users’ real IP address

#38

Post by mirimir »

anonymous5133 wrote: post #30
mirimir wrote: post #12

> TorMoil, as the flaw has been dubbed by its discoverer, is triggered when users click on links that begin with file:// rather than the more common https:// and http:// address prefixes. When the Tor browser for macOS and Linux is in the process of opening such an address, "the operating system may directly connect to the remote host, bypassing Tor Browser," according to a brief blog post published Tuesday by We Are…

Agree completely. If you are running a TOR service/browser you should at least have an option to block all data that wants to move outside of TOR. Imo, the option should be enabled by default. It is better to have a "broken" service rather than risk leaking the real IP. If I recall correctly, wasn't silkroad and alphabay compromised by such a flaw? silkroad leaked the server IP through the captcha and I think somethi…

Yes, that was one of the ways that Silk Road got pwned. As I recall, it was an Apache error message that bypassed Tor.

Dream Market may have had a similar problem, but I don't know specifics. AlphaBay failed more simply. The founder allegedly used his real-name email address on the site. And sadly, after being arrested, he reportedly killed himself.

Re: Critical Tor flaw leaks users’ real IP address

#39

Post by mirimir »

kakarot wrote: post #25
mirimir wrote: post #23

This is truly such an obvious exploit, given well-acknowledged risks of opening files downloaded via Tor browser. I'm quite embarrassed that I didn't think of it. And I'm pretty sure that others have exploited it. But on reflection, this is actually excellent news. At least, for those of us who don't rely on Tor browser. That is, Tor users occasionally get pwned. And now there's less reason to suspect unreported vuln…

With an implementation like Whonix, arguably the only safe and (relatively) easy way to use Tor, this exploit wouldn't have worked. The Tor Project's insistence on placing ease of use above security is admirable and understandable, but it provides a very false sense of security for the majority of users, to the point where it can potentially be detrimental. We sometimes take for granted our intelligence in this domai…

Well, I recommend using Tor through VPN services. I worry more about ISPs doing MitM than VPNs. You have far more choice about VPNs than ISPs. Governments can pressure local ISPs far more easily than VPN services, which may do business from uncooperative jurisdictions.

And mostly, it's just that the VPN provides another level of IP obscurity. If an adversary compromises Tor somehow, and learns your VPN exit IP, there's at least a chance that they won't get your ISP-assigned IP. And if you use nested VPN chains, the adversary would need information from multiple VPN providers. It's the same logic behind three-relay Tor circuits.

Re: Critical Tor flaw leaks users’ real IP address

#40

Post by mirimir »

amluto wrote: post #33

Ugh. Linux has this shiny feature called network namespaces. Tor Browser should run in a network namespace such that it has no access to the Internet and doesn't know it's real IP address in the first place and therefore can't have this kind of leak barring a code execution attack and a sandbox break.

What's the advantage over just using iptables?

    -A OUTPUT -m owner --uid-owner [Tor uid] -j ACCEPT
    -A OUTPUT -j DROP
Post reply on HN