Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Critical Tor flaw leaks users’ real IP address

arstechnica.com

Post reply on HN
Print view View original

71–80 of 91 posts

Re: Critical Tor flaw leaks users’ real IP address

#71

Post by lawnchair_larry »

mirimir wrote: post #12

> TorMoil, as the flaw has been dubbed by its discoverer, is triggered when users click on links that begin with file:// rather than the more common https:// and http:// address prefixes. When the Tor browser for macOS and Linux is in the process of opening such an address, "the operating system may directly connect to the remote host, bypassing Tor Browser," according to a brief blog post published Tuesday by We Are…

This is nothing at all like the FBI exploit, which was an RCE vulnerability against firefox.

The reason they have been ignoring you about requiring a vm is likely because it is out of scope and doesn't make practical sense. They don't control the parent operating system.

Re: Critical Tor flaw leaks users’ real IP address

#72

Post by lawnchair_larry »

stevekemp wrote: post #11
linkmotif wrote: post #2

Just the other day I saw some file://-based exploit. Didn’t read the specifics of this, but not validating a URL’s scheme must be a very common source of problems. It’s so easy to overlook the scheme when everything is https?:// all the time. But alas, file://, it’s real, browsers attempt to work with it. Another edge to be aware of!!

Lots of online services are vulnerable to this kind of attack. I've seen numerous forms that do things like check security headers, scan your HTML, or do benchmarking. You're supposed to enter a site like: * https://example.com/ But instead you can access local files via file:////etc/passwd

The remote site does not get the contents of your /etc/passwd if you do that, due to same origin policy. And you cannot see the /etc/passwd of the remote site. If you want to see your own, you can also open your /etc/passwd in vim. So, there is no vulnerability there.

Re: Critical Tor flaw leaks users’ real IP address

#73

Post by forapurpose »

3pt14159 wrote: post #57
forapurpose wrote: post #5

If an attacker learned a Tor Browser user's real IP address yesterday, and the leak gets fixed today, can the attacker still somehow identify that user's traffic tomorrow? Browser fingerprinting comes to mind, but is there another method?

If you are paying very close attention you'll see that Tor hasn't been as reliable against well funded state actors for a while now. This is probably one of several vulnerabilities, and IP ownership at a given time is something readily accessible to most states if they really need it. It isn't going to go to catching petty criminals, but it could be used to catch a mole or a leaker.

> Tor hasn't been as reliable against well funded state actors for a while now.

Can anyone provide more detail? I never thought Tor was a panacea, but do we know that it's becoming more vulnerable?

Re: Critical Tor flaw leaks users’ real IP address

#74

Post by mirimir »

yjftsjthsd-h wrote: post #47
mirimir wrote: post #12

> TorMoil, as the flaw has been dubbed by its discoverer, is triggered when users click on links that begin with file:// rather than the more common https:// and http:// address prefixes. When the Tor browser for macOS and Linux is in the process of opening such an address, "the operating system may directly connect to the remote host, bypassing Tor Browser," according to a brief blog post published Tuesday by We Are…

I wonder how hard it would be to ship tor as a bundle with qemu and a very thin Linux image that provided just enough functionality to run it, then when you click on the start icon, it opens the emulator, which opens up the browser in a environment that's thin enough you don't even really need to pay attention to it because you've just got a window containing window containing your browser. With the right wm inside,…

That'd be cool. As long as the network isolation was solid. And easier than getting people to install VBox and Whonix.

Re: Critical Tor flaw leaks users’ real IP address

#75

Post by mirimir »

mook wrote: post #69
yjftsjthsd-h wrote: post #47

Earlier quoted context omitted.

I wonder how hard it would be to ship tor as a bundle with qemu and a very thin Linux image that provided just enough functionality to run it, then when you click on the start icon, it opens the emulator, which opens up the browser in a environment that's thin enough you don't even really need to pay attention to it because you've just got a window containing window containing your browser. With the right wm inside,…

I've been doing similar things, just in docker instead of a VM (and doing X11 forwarding via xpra). Not entirely happy with the setup yet; I still need to figure out how to do that with two containers so that the browser doesn't get accidental internet access. Not quite as good as a VM, but better than nothing and easier for me to maintain.

Why do you say "easier for me to maintain"? Are you talking about keeping them updated? That does get to be a pain.

Re: Critical Tor flaw leaks users’ real IP address

#76

Post by boogiewoogie »

yjftsjthsd-h wrote: post #47
mirimir wrote: post #12

> TorMoil, as the flaw has been dubbed by its discoverer, is triggered when users click on links that begin with file:// rather than the more common https:// and http:// address prefixes. When the Tor browser for macOS and Linux is in the process of opening such an address, "the operating system may directly connect to the remote host, bypassing Tor Browser," according to a brief blog post published Tuesday by We Are…

I wonder how hard it would be to ship tor as a bundle with qemu and a very thin Linux image that provided just enough functionality to run it, then when you click on the start icon, it opens the emulator, which opens up the browser in a environment that's thin enough you don't even really need to pay attention to it because you've just got a window containing window containing your browser. With the right wm inside,…

Check out tails: https://tails.boum.org/about/index.en.html

Pretty much that. Forward some X11?

Re: Critical Tor flaw leaks users’ real IP address

#77

Post by mirimir »

3pt14159 wrote: post #55
yjftsjthsd-h wrote: post #47

Earlier quoted context omitted.

I wonder how hard it would be to ship tor as a bundle with qemu and a very thin Linux image that provided just enough functionality to run it, then when you click on the start icon, it opens the emulator, which opens up the browser in a environment that's thin enough you don't even really need to pay attention to it because you've just got a window containing window containing your browser. With the right wm inside,…

It might be irrational, but I have this vague notion that it's somehow less secure than Tor on a router. Breaking out of virtualization is certainly not easy, but it seems easier than hacking a locked down router.

Yes, it's almost certainly less secure than running Tor on a router. But I sometimes use multiple Whonix instances, for different personas, and they hit Tor through different nested VPN chains. And using hardware for that would be too tedious.

Re: Critical Tor flaw leaks users’ real IP address

#78

Post by mirimir »

rbanffy wrote: post #67
3pt14159 wrote: post #55

Earlier quoted context omitted.

It might be irrational, but I have this vague notion that it's somehow less secure than Tor on a router. Breaking out of virtualization is certainly not easy, but it seems easier than hacking a locked down router.

You can always start two VMs with very thin OSs on them. The Tor proxy could even be a unikernel with no functionality beyond being a Tor proxy.

I've played some with that. Whonix uses a full Debian install for the gateway, and that uses lots of disk. I used OpenWRT VMs for a while, but Tor releases in their repo got way out of data, and I never managed a build.

If someone can point to a distro that works for this, many of us would be very happy.

Re: Critical Tor flaw leaks users’ real IP address

#79

Post by mirimir »

Santosh83 wrote: post #58
StavrosK wrote: post #50

Earlier quoted context omitted.

Does anyone know the differences between Whonix/Tails/Qubes? Which one is better?

Better regarding what? Depends on what you want. AFAIK, Whonix is focused on anonymity by using Tor as an integral part of its architecture. TAILS has the same goal but is designed specifically to be run from removable media and to leave no trace on the host system after it's done, much like using a live CD. Qubes is focused on security through isolation by means of an hypervisor. Whonix can run upon Qubes, beside ot…

Yeah, Whonix on Qubes is the strongest option, I believe.

Re: Critical Tor flaw leaks users’ real IP address

#80

Post by mirimir »

StavrosK wrote: post #60
Santosh83 wrote: post #58

Earlier quoted context omitted.

Better regarding what? Depends on what you want. AFAIK, Whonix is focused on anonymity by using Tor as an integral part of its architecture. TAILS has the same goal but is designed specifically to be run from removable media and to leave no trace on the host system after it's done, much like using a live CD. Qubes is focused on security through isolation by means of an hypervisor. Whonix can run upon Qubes, beside ot…

I see, thank you. I want this to be running off a removable drive (although, realistically, I'll probably just keep using Tor Browser as I don't really do anything much with it), so I'll either use Tails or see if Whonix can run off a USB disk, thank you.

Whonix is a pair of Debian instances. One is a Tor gateway, and the other is a workstation. The Tor gateway isn't a router, in that it doesn't route packets. It just exposes Tor ports on a shared private network. The gateway and workstation instances can be run on separate hardware, as KVM or VBox VMs, or in Qubes.

Some years ago, I managed to build a LiveDVD with Debian OS, VBox, a pfSense Tor gateway VM, and a stripped-down Whonix workstation VM with Openbox. But it took ~20 min to boot :(

Post reply on HN