Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Critical Tor flaw leaks users’ real IP address

arstechnica.com

Post reply on HN
Print view View original

11–20 of 91 posts

Re: Critical Tor flaw leaks users’ real IP address

#11

Post by stevekemp »

linkmotif wrote: post #2

Just the other day I saw some file://-based exploit. Didn’t read the specifics of this, but not validating a URL’s scheme must be a very common source of problems. It’s so easy to overlook the scheme when everything is https?:// all the time. But alas, file://, it’s real, browsers attempt to work with it. Another edge to be aware of!!

Lots of online services are vulnerable to this kind of attack. I've seen numerous forms that do things like check security headers, scan your HTML, or do benchmarking. You're supposed to enter a site like:

* https://example.com/

But instead you can access local files via file:////etc/passwd

Re: Critical Tor flaw leaks users’ real IP address

#12

Post by mirimir »

> TorMoil, as the flaw has been dubbed by its discoverer, is triggered when users click on links that begin with file:// rather than the more common https:// and http:// address prefixes. When the Tor browser for macOS and Linux is in the process of opening such an address, "the operating system may directly connect to the remote host, bypassing Tor Browser," according to a brief blog post published Tuesday by We Are Segment, the security firm that privately reported the bug to Tor developers.

Oh, well ... This is basically the same vulnerability exploited by the FBI's NIT. And this is the key aspect ...

> ... "the operating system may directly connect to the remote host, bypassing Tor Browser," ...

Well, in any sort of secure Tor implementation, such a thing should be impossible. The Tor client should be running in a router or gateway VM, and the machine used for browsing should not even have a public IP address. That's easy to manage with Whonix.

I've badgered Tor Project about this for years. And they've ignored me. Their mantra has been about keeping things simple, so more people will use Tor.

Damn.

Edit: They've plugged this leak, but the fundamental weakness remains. Tor Browser doesn't even block non-Tor connectivity with firewall rules. Even VPN clients block non-VPN connectivity.

Re: Critical Tor flaw leaks users’ real IP address

#13

Post by dang »

fulafel wrote: post #10

Interesting that this has been posted 5 times in the past few days without receiving votes.

That's the randomness of what gets attention here. Many good stories fall through the cracks or need multiple submissions before they catch.

We try to mitigate this by looking through the stories that didn't get attention and re-upping the good ones (described at https://news.ycombinator.com/item?id=11662380 and links back from there) and/or inviting reposts.

Re: Critical Tor flaw leaks users’ real IP address

#14

Post by dang »

danjoc wrote: post #7

How long has the exploit existed? Did it magically appear after Appelbaum was run out of town on vague allegations of sexual harrassment?

Please don't post flamewar comments to HN. We ban accounts that do this repeatedly (and have had to ask you this before), so would you please re-read https://news.ycombinator.com/newsguidelines.html and follow it from now on?

Re: Critical Tor flaw leaks users’ real IP address

#15

Post by saurik »

"Critical Tor flaw leaks users’ real IP address"

This is not a problem with Tor: this is a problem with the Tor Browser (and even then, only on macOS and Linux: users on Windows are not affected)... I'd recommend changing the title as this otherwise sounds like some extremely concerning flaw in the platform itself, which this attack is not targeting.

Re: Critical Tor flaw leaks users’ real IP address

#16

Post by sillysaurus3 »

If anyone is wondering how the attack works, here's a guess:

file://../../dev/tcp/74.125.225.19/80

That would also explain why it works on 'nix but not windows.

(This is probably mistaken, but the attack might be something along those lines.)

Hmm... Anyone have a link to the hotfix diff? We could just look rather than guess.

Re: Critical Tor flaw leaks users’ real IP address

#17

Post by mirimir »

saurik wrote: post #15

"Critical Tor flaw leaks users’ real IP address" This is not a problem with Tor: this is a problem with the Tor Browser (and even then, only on macOS and Linux: users on Windows are not affected)... I'd recommend changing the title as this otherwise sounds like some extremely concerning flaw in the platform itself, which this attack is not targeting.

That's a good point, and the title ought to be "... Tor browser ...".

Still, for the vast majority of Tor users, Tor is Tor browser. However, most of them use Windows, and weren't affected. So maybe "... OSX/Linux Tor browser ...".

Re: Critical Tor flaw leaks users’ real IP address

#18

Post by JoshTriplett »

sillysaurus3 wrote: post #16

If anyone is wondering how the attack works, here's a guess: file://../../dev/tcp/74.125.225.19/80 That would also explain why it works on 'nix but not windows. (This is probably mistaken, but the attack might be something along those lines.) Hmm... Anyone have a link to the hotfix diff? We could just look rather than guess.

/dev/tcp doesn't exist on the filesystem, only in bash, and only if enabled; some distributions like Debian disable it.

Re: Critical Tor flaw leaks users’ real IP address

#19

Post by gnu8 »

JoshTriplett wrote: post #18
sillysaurus3 wrote: post #16

If anyone is wondering how the attack works, here's a guess: file://../../dev/tcp/74.125.225.19/80 That would also explain why it works on 'nix but not windows. (This is probably mistaken, but the attack might be something along those lines.) Hmm... Anyone have a link to the hotfix diff? We could just look rather than guess.

/dev/tcp doesn't exist on the filesystem, only in bash, and only if enabled; some distributions like Debian disable it.

I can imagine why that would be useful, but that seems like a fundamentally misguided feature. The shell is a key partner in the Unix philosophy of small programs that do a particular thing. The maintainers of bash should have known better than to add this. What does /dev/tcp add to bash, other than security vulnerabilities, that couldn't be better accomplished with wget, curl, netcat, or similar programs external to bash?

Re: Critical Tor flaw leaks users’ real IP address

#20

Post by captainmuon »

And this is why I usually run Tor as a transparent proxy, and put the browser in a VM. All traffic from the VM is forced through Tor via iptables.

One downside is that you no longer look like all the other users that are using TorBrowser. But I value non-identifiability (that they can't get to my real identity) more than non-trackability.

Post reply on HN