There is a similar old attack with file URLs: Redirect-to-SMB (https://blog.cylance.com/redirect-to-smb). The fix is to block outbound SMB connections in your router.
Critical Tor flaw leaks users’ real IP address
51–60 of 91 posts
Re: Critical Tor flaw leaks users’ real IP address
#52> TorMoil, as the flaw has been dubbed by its discoverer, is triggered when users click on links that begin with file:// rather than the more common https:// and http:// address prefixes. When the Tor browser for macOS and Linux is in the process of opening such an address, "the operating system may directly connect to the remote host, bypassing Tor Browser," according to a brief blog post published Tuesday by We Are…
I wonder how hard it would be to ship tor as a bundle with qemu and a very thin Linux image that provided just enough functionality to run it, then when you click on the start icon, it opens the emulator, which opens up the browser in a environment that's thin enough you don't even really need to pay attention to it because you've just got a window containing window containing your browser. With the right wm inside,…
This sounds like the right approach.
Re: Critical Tor flaw leaks users’ real IP address
#53> TorMoil, as the flaw has been dubbed by its discoverer, is triggered when users click on links that begin with file:// rather than the more common https:// and http:// address prefixes. When the Tor browser for macOS and Linux is in the process of opening such an address, "the operating system may directly connect to the remote host, bypassing Tor Browser," according to a brief blog post published Tuesday by We Are…
Whoa. Whonix has a Windows installer now?! NICE!
Re: Critical Tor flaw leaks users’ real IP address
#54Earlier quoted context omitted.
What's the advantage over just using iptables? -A OUTPUT -m owner --uid-owner [Tor uid] -j ACCEPT -A OUTPUT -j DROP
So the browser itself doesn't know the IP. Then you don't have to worry about, say, a WebRTC bug leaking your IP. You also gain a considerable degree of protection from browser bugs in general. Also, using network namespaces doesn't require root.
Using network namespaces does require root. User namespaces can give you something close enough to root to use network namespaces. But that only helps you if user namespaces are usable unprivileged, which they usually aren't, due to distro/sysadmin customization.
Re: Critical Tor flaw leaks users’ real IP address
#55> TorMoil, as the flaw has been dubbed by its discoverer, is triggered when users click on links that begin with file:// rather than the more common https:// and http:// address prefixes. When the Tor browser for macOS and Linux is in the process of opening such an address, "the operating system may directly connect to the remote host, bypassing Tor Browser," according to a brief blog post published Tuesday by We Are…
I wonder how hard it would be to ship tor as a bundle with qemu and a very thin Linux image that provided just enough functionality to run it, then when you click on the start icon, it opens the emulator, which opens up the browser in a environment that's thin enough you don't even really need to pay attention to it because you've just got a window containing window containing your browser. With the right wm inside,…
It might be irrational, but I have this vague notion that it's somehow less secure than Tor on a router. Breaking out of virtualization is certainly not easy, but it seems easier than hacking a locked down router.
Re: Critical Tor flaw leaks users’ real IP address
#56> TorMoil, as the flaw has been dubbed by its discoverer, is triggered when users click on links that begin with file:// rather than the more common https:// and http:// address prefixes. When the Tor browser for macOS and Linux is in the process of opening such an address, "the operating system may directly connect to the remote host, bypassing Tor Browser," according to a brief blog post published Tuesday by We Are…
Agree completely. If you are running a TOR service/browser you should at least have an option to block all data that wants to move outside of TOR. Imo, the option should be enabled by default. It is better to have a "broken" service rather than risk leaking the real IP. If I recall correctly, wasn't silkroad and alphabay compromised by such a flaw? silkroad leaked the server IP through the captcha and I think somethi…
Just so you know, it is spelled "Tor" not "TOR".
Re: Critical Tor flaw leaks users’ real IP address
#57If an attacker learned a Tor Browser user's real IP address yesterday, and the leak gets fixed today, can the attacker still somehow identify that user's traffic tomorrow? Browser fingerprinting comes to mind, but is there another method?
If you are paying very close attention you'll see that Tor hasn't been as reliable against well funded state actors for a while now. This is probably one of several vulnerabilities, and IP ownership at a given time is something readily accessible to most states if they really need it. It isn't going to go to catching petty criminals, but it could be used to catch a mole or a leaker.
Re: Critical Tor flaw leaks users’ real IP address
#58Earlier quoted context omitted.
If an adversary can achieve network access on your box, they can usually download malware. At that point, it's game over. No firewall rules will protect you. The moment you shut off Tor, you're owned. This is exactly why it's crucial to use Whonix or Tails.
Does anyone know the differences between Whonix/Tails/Qubes? Which one is better?
Better regarding what? Depends on what you want. AFAIK, Whonix is focused on anonymity by using Tor as an integral part of its architecture. TAILS has the same goal but is designed specifically to be run from removable media and to leave no trace on the host system after it's done, much like using a live CD. Qubes is focused on security through isolation by means of an hypervisor. Whonix can run upon Qubes, beside others of course.
EDIT: if you want as foolproof of anonymity as possible it seems that Whonix holds an edge over TAILS and both are better than Qubes. Because Whonix routes all network requests through a locked down gateway VM, there is less chance that any program or system component can escape the Tor "funnel" than in TAILS and particularly Qubes, which focuses on security primarily.
Re: Critical Tor flaw leaks users’ real IP address
#59Earlier quoted context omitted.
Agree completely. If you are running a TOR service/browser you should at least have an option to block all data that wants to move outside of TOR. Imo, the option should be enabled by default. It is better to have a "broken" service rather than risk leaking the real IP. If I recall correctly, wasn't silkroad and alphabay compromised by such a flaw? silkroad leaked the server IP through the captcha and I think somethi…
Just so you know, it is spelled "Tor" not "TOR".
[deleted]
Re: Critical Tor flaw leaks users’ real IP address
#60Earlier quoted context omitted.
Does anyone know the differences between Whonix/Tails/Qubes? Which one is better?
Better regarding what? Depends on what you want. AFAIK, Whonix is focused on anonymity by using Tor as an integral part of its architecture. TAILS has the same goal but is designed specifically to be run from removable media and to leave no trace on the host system after it's done, much like using a live CD. Qubes is focused on security through isolation by means of an hypervisor. Whonix can run upon Qubes, beside ot…
I see, thank you. I want this to be running off a removable drive (although, realistically, I'll probably just keep using Tor Browser as I don't really do anything much with it), so I'll either use Tails or see if Whonix can run off a USB disk, thank you.