Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Javascript exploit actively used against TorBrowser

lists.torproject.org

Post reply on HN
Print view View original

121–130 of 138 posts

Re: Javascript exploit actively used against TorBrowser

#121

Post by 4ad »

easychewie wrote: post #120
4ad wrote: post #99

Earlier quoted context omitted.

How does this work? I would expect a generic resolution like 1920x1080 to convey much less identifiable information that some random 1583x1176 that the user might resize tor browser window to.

The idea is to not change the window size at all from the default. If this advice is followed, you minimize the possible information leak. In your example, 1583x1176 tells us that your system is capable of rendering at least that size. Given the unusual numbers, we further suspect you're not maximized on a system capable of an 1176px tall browser (much fewer of those than 1920x1080). While not uniquely identifying, i…

A better idea would be to simply not leak any of this information at all, or if it must, return some generic 1080p regardless of the actual size. It's a terrible UX to restrict yourself to the default window size (and depending on the window manager, the default window size might not even be respected). Plus, it's so easy to accidentally change the browser window size.

Re: Javascript exploit actively used against TorBrowser

#122

Post by mmaunder »

micaksica wrote: post #42
mmaunder wrote: post #38

Earlier quoted context omitted.

Background for the uninitiated: https://www.eff.org/deeplinks/2016/09/playpen-story-fbis-unp...

Unrelated, but kudos on the arbitrary hash use on the Wordpress auto updater last week.

Thanks. That was all Matt Barry. I just prettied it up. He literally did that in his spare time and one day showed up at work and after some smalltalk he was like "Oh, yeah by the way..." and my jaw hit the floor.

That was a few months ago. We had to go through the disclosure process via HackerOne etc.

I'm really lucky to be working with people like Matt and others on the team.

Re: Javascript exploit actively used against TorBrowser

#123

Post by torrio888 »

dispose13432 wrote: post #79
Buge wrote: post #72

Earlier quoted context omitted.

Exit nodes will also steal any unencrypted passwords and put malware in any binaries you download. It's been happening for years. In China the "regular internet" intercepts http and inserts javascript malware to create a DDOS botnet.

Yes, but I'm not talking about downloading exes or logging onto gmail (and definitely not putting credentials on a site using HTTP) or anything. I'm talking about going anywhere on Tor can infect you.

No, Tor Project scans exit nodes for misbehavior and those that do bad stuff are flagged as bad exit nodes and are not used as exit nodes. https://trac.torproject.org/projects/tor/wiki/doc/badRelays

Re: Javascript exploit actively used against TorBrowser

#124

Post by schoen »

NinjaTrappeur wrote: post #87
dispose13432 wrote: post #80

Earlier quoted context omitted.

But its worse on Tor. Regular internet has a few protections: 1. Google safe browsing 2. AdBlocking 3. Websites try to keep their reputation. Tor exit nodes, on the other hand, have no reputation (and if one gets sullied, spin up another) and costs money.

I have one question: the list of exit nodes is public, we can know at any time the circuit's complete list of servers. Does something prevents us from rating tor exit nodes according to their "transparency" and add this rating in the consensus file? Does anybody already worked on that? I cannot find anything on the internet…

There are projects that scan exit nodes for various heuristics; if they find very bad behavior, they report it to the Tor Project to request a BadExit flag. However, there's no kind of continuum of rankings, just BadExit or not.

My impression from talking to people working on this a few years ago was that they wanted to be a little bit secretive about exactly what they scan for, in order to make it harder for malicious exit operators to anticipate the scans or to distinguish the scans from end-user traffic. There was a suggestion this is an activity that anybody can engage in: if you can think of an attack against Tor users that you know how to detect, you can write your own client that tests for that thing (modifying the path selection algorithm to ensure that you test every exit node!) and then start running your tests. People will be interested in your results.

Re: Javascript exploit actively used against TorBrowser

#125

Post by torrio888 »

dispose13432 wrote: post #79
Buge wrote: post #72

Earlier quoted context omitted.

Exit nodes will also steal any unencrypted passwords and put malware in any binaries you download. It's been happening for years. In China the "regular internet" intercepts http and inserts javascript malware to create a DDOS botnet.

Yes, but I'm not talking about downloading exes or logging onto gmail (and definitely not putting credentials on a site using HTTP) or anything. I'm talking about going anywhere on Tor can infect you.

https://blog.torproject.org/blog/how-report-bad-relays

Re: Javascript exploit actively used against TorBrowser

#126

Post by lorenzofb »

random234528 wrote: post #37
micaksica wrote: post #8

Earlier quoted context omitted.

This likely points to this being an FBI "network investigative technique".* I'm really curious where this attack was injected, as that also means that that .onion is also compromised. My guess? Some darknet market. * Sure, this could be some type of awkward false flag, but it seems unlikely to my gut.

It's on a CP site (giftbox). The exploit got loaded on the confirmation page after logging in.

Hey! Motherboard reporter here. Can you provide some evidence of this? You can contact me (anonymously) via OTR lorenzofb@jabber.ccc.de or ricochet:p5mbxsckf3qbmobc Also via email (PGP: https://keybase.io/lorenzofb/key.asc)

Re: Javascript exploit actively used against TorBrowser

#127

Post by schoen »

ns8sl wrote: post #74

I've quit using TOR. It seems to have been targeted by law enforcement and now this.

This was an upstream Firefox bug, so you should probably quit using Firefox if you're concerned about bugs like this.

(Using Tor does change who can attempt to attack you with such bugs -- and maybe who is motivated to.)

Re: Javascript exploit actively used against TorBrowser

#128

Post by [deleted] »

random234528 wrote: post #37
micaksica wrote: post #8

Earlier quoted context omitted.

This likely points to this being an FBI "network investigative technique".* I'm really curious where this attack was injected, as that also means that that .onion is also compromised. My guess? Some darknet market. * Sure, this could be some type of awkward false flag, but it seems unlikely to my gut.

It's on a CP site (giftbox). The exploit got loaded on the confirmation page after logging in.

[deleted]

Re: Javascript exploit actively used against TorBrowser

#130

Post by tdullien »

Strom wrote: post #115
tdullien wrote: post #110

Earlier quoted context omitted.

Also, it is safe to say that ChakraCore (the JS interpreter inside Edge) is much more broken / easier to find bugs in than Firefox, at least at the moment.

Why is that safe to say?

I looked at both.
Post reply on HN