Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tor 0day: Stopping Tor Connections

hackerfactor.com

Post reply on HN
Print view View original

21–30 of 92 posts

Re: Tor 0day: Stopping Tor Connections

#21

Post by bredren »

eat_veggies wrote: post #6
leksak wrote: post #4

Could someone in the know inform me as to whether or not my knee jerk reaction of "couldn't this individual possibly contribute to the Tor project instead?" is warranted?

They are contributing to the Tor project by sending detailed vulnerability reports. As for demanding that they fix/upstream changes themselves, then yes, that's likely too big of an ask, as even these reports are a gift. Tor has paid employees. "PRs welcome, wontfix" is not acceptable for security vulnerabilities in a security product.

This sort of reminds me of Burning Man Project. There is money, full time staff and a lot of attention paid to the main product. But a lack of excellent results.

I generally chalk this up to leadership issues.

Re: Tor 0day: Stopping Tor Connections

#23

Post by lucb1e »

staticassertion wrote: post #18

> (Many users think that Tor makes them anonymous. But Tor users can be tracked online; they are not anonymous.) Being tracked and anonymous feel like two distinct issues. If you were to only see a hash of my username, you could track me, but you couldn't identify me with it. Definitely something you'd want TOR to stop, but I think that's pretty important. The other vulnerability is that websites can identify that a…

> If you were to only see a hash of my username, you could track me, but you couldn't identify me with it.

Pseudonymous is the word for that sort of "tracking". Tracking just means being tracked, no matter if they use the real name or a hash of it or fingerprinting/metadata like IP + user agent string + installed fonts.

Re: Tor 0day: Stopping Tor Connections

#24

Post by heinrich5991 »

r3trohack3r wrote: post #3
kyboren wrote: post #2

Browsing over Tor, I cannot read the article. Instead the entire page source is: Banned ...

I believe they are demonstrating one of their 0days. Easily identifying tor traffic based on the packet. 0Day #1: Blocking Tor Connections the Smart Way There are two problems with the "block them all" approach. First, there are thousands of Tor nodes. Checking every network connection against every possible Tor node takes time. This is fine if you have a slow network or low traffic volume, but it doesn't scale well…

That sounds like it's only able to detect traffic clienttor node or tor nodetor node. exit nodeserver doesn't have that generated certificate.

Re: Tor 0day: Stopping Tor Connections

#25

Post by lucb1e »

ed25519FUUU wrote: post #11

> Unfortunately, sometimes companies are non-responsive. At that point, I have a few options. I can sell the vulnerability to someone else who will certainly exploit it. I can just let it sit -- maybe the bug will be fixed by coincidence or become obsolete, or maybe I'll find another use for it later. (I have a large collection of sitting vulnerabilities, some dating back decades.) This sounds so interesting to me to…

Sitting on bugs is just being an asshole, not a great adventure. In most cases there really isn't that much to tell anyway: you find a bug, either on your own or in a customer project, and for some reason it doesn't get fixed. Perhaps management accepts the risk and you're bound by an NDA. Perhaps you plan to make a patch so people can also update when you publish but you haven't found the time for the patch and so it continues (I know of a denial of service in nextcloud like this: it's trivial to find (go ahead) and out of scope for their security program so nextcloud tells us it's a wontfix; we're still meaning to release a patch but it has been two months now, though it's only denial of service anyway). If the bug just so happens to be useful in the future, it's like using a public bug except you're the only one knowing it and you can feel real proud of yourself for putting everyone at risk during that time.

Re: Tor 0day: Stopping Tor Connections

#26

Post by EE84M3i »

thaumaturgy wrote: post #5
r3trohack3r wrote: post #3

Earlier quoted context omitted.

I believe they are demonstrating one of their 0days. Easily identifying tor traffic based on the packet. 0Day #1: Blocking Tor Connections the Smart Way There are two problems with the "block them all" approach. First, there are thousands of Tor nodes. Checking every network connection against every possible Tor node takes time. This is fine if you have a slow network or low traffic volume, but it doesn't scale well…

The packet signature thing is maybe sort of interesting, but it's not hard to block Tor exit nodes; Tor themselves makes this easy: #!/bin/bash addresses=$(curl -s https://check.torproject.org/torbulkexitlist?ip= | sed '/^#/d') if [ -n "$addresses" ]; then /sbin/ipset flush tor echo "$addresses" | while read address; do /sbin/ipset -q -A tor "$address" done fi Add that to a cron job and your form abuse traffic falls…

If you feel it necessary to block Tor nodes in some way, I think it's better to only block non-safe methods.

Personally, I don't do it, but I understand why it's appealing. I see it as a personal decision (its your website after all) and not morally wrong as some see it.

I once talked to someone working security for a Canadian government agency. They considered it against their charter and/or illegal to block tor nodes, because it could be blocking legitimate access for Canadian citizens potentially in distress, much to the chagrin of their downstream customers (other agencies). I thought that was pretty interesting.

Re: Tor 0day: Stopping Tor Connections

#27

Post by staticassertion »

lucb1e wrote: post #23
staticassertion wrote: post #18

> (Many users think that Tor makes them anonymous. But Tor users can be tracked online; they are not anonymous.) Being tracked and anonymous feel like two distinct issues. If you were to only see a hash of my username, you could track me, but you couldn't identify me with it. Definitely something you'd want TOR to stop, but I think that's pretty important. The other vulnerability is that websites can identify that a…

> If you were to only see a hash of my username, you could track me, but you couldn't identify me with it. Pseudonymous is the word for that sort of "tracking". Tracking just means being tracked, no matter if they use the real name or a hash of it or fingerprinting/metadata like IP + user agent string + installed fonts.

Yeah, that's my point. Anonymity to me implies that you can not determine my true identity. That property still holds here. What doesn't hold is that you can not determine that I am the same person in multiple locations - a very significant issue, but a much less serious one.

Re: Tor 0day: Stopping Tor Connections

#29

Post by terminalcommand »

gonehome wrote: post #20

> "After a lot of back-and-forth technical discussions, the Tor Project's representative wrote, "I'm a bit lost with all this info in this ticket. I feel like lots of the discussion here is fruitful but they are more brainstormy and researchy and less fitting to a bug bounty ticket." They concluded with: "Is there a particular bug you want to submit for bug bounty?" In my opinion, describing a vulnerability and mitig…

I think the author’s problem is that he finds vulnerabilities thinking outside the box. Traditionaly vulnerabilities exist when you can inject payloads, get access to somewhere you don’t have access to.

His points are valid, and these are vulnerabilities. However they seem like feature requests, rather than being focused on a technical vulnerability (for example use after free).

Re: Tor 0day: Stopping Tor Connections

#30

Post by strbean »

flotzam wrote: post #14
piaste wrote: post #8

> The bug is simple enough: using JavaScript, you can identify the scrollbar width. I thought it was accepted and strongly emphasized that running JavaScript in a Tor environment was insecure and could leak information in all sorts of ways, which is why Tor Browser came with NoScript enabled by default. Is that no longer the case? Is there now an expectation that you should be able to safely run JS in Tor Browser wit…

https://2019.www.torproject.org/docs/faq.html.en#TBBJavaScri...

I don't understand this bit:

> But there's a third issue: websites can easily determine whether you have allowed JavaScript for them, and if you disable JavaScript by default but then allow a few websites to run scripts (the way most people use NoScript), then your choice of whitelisted websites acts as a sort of cookie that makes you recognizable (and distinguishable), thus harming your anonymity.

How would this work exactly? And if it did work, wouldn't it at the very worst only work on sites for which you had enabled JS? I.e. sites that you had already essentially conceded your anonymity on by choice?

I don't see this as a worthy argument for enabling JS by default and destroying users' anonymity without custom configuration.

Post reply on HN