Using Brave's “Private Window with Tor” could get you fired • Hacker News Board

Re: Using Brave's “Private Window with Tor” could get you fired

#21

Post by 8organicbits » Fri, Dec 31, 2021, 6:18 PM UTC

Lordarminius wrote: post #2

I skimmed through the reddit thread but couldn't find an answer. Why do companies not want you using Tor ?

In my brush with a similar issue, the intrusion detection system flagged Tor traffic as potential malicious traffic. The IDS can't tell if this is malware calling back to a command and control node via Tor.

We allow developers to install their own software, so there isn't a good way to enforce browser policies. We ended up letting the developers know that connections to Tor generate alerts, and that these tie up security resources. That was enough that we haven't seen the issue again.

In our case the developer was using Brave and had opened the private window with Tor. That gave us a plausible explanation that didn't include malware, so we closed the ticket.

I'd say that there are very few legitimate reasons a Tor connection would come from a corporate network. So we'd like to keep the alert on, but any false positives tie up resources. Developers sometimes accidentally install malware, so we need to be vigilant about detecting and remediating that.

Re: Using Brave's “Private Window with Tor” could get you fired

#22

Post by benttoothpaste » Fri, Dec 31, 2021, 6:19 PM UTC

donatj wrote: post #20

My company blocks so much inane crap it’s ridiculous. Any site not explicitly reviewed by the firewall company? Blocked. Want to Google restaurants for lunch? Half the restaurants websites are blocked under the firewall rule against “alcohol and bars”. So much more. Trying to talk to IT about it is painful. I had to go through three levels of support over a week just to get a single site unblocked. Before Work-from-H…

I used to work for a financial company that used such extensive blocking. One day I had to download a particular version of boost libraries (the C++ ones). Of course all official sites to download from were blocked. So I searched for the specific file name (a tar.gz archive). And eventually I found something that was not blocked: a misconfigured server somewhere in Russia. Misconfigured because it served entire contents of its hard disk - and Google indexed it all. And there it was - my coveted boost archive which I promptly downloaded.

Re: Using Brave's “Private Window with Tor” could get you fired

#23

Post by gruez » Fri, Dec 31, 2021, 6:20 PM UTC

benttoothpaste wrote: post #22

donatj wrote: post #20

My company blocks so much inane crap it’s ridiculous. Any site not explicitly reviewed by the firewall company? Blocked. Want to Google restaurants for lunch? Half the restaurants websites are blocked under the firewall rule against “alcohol and bars”. So much more. Trying to talk to IT about it is painful. I had to go through three levels of support over a week just to get a single site unblocked. Before Work-from-H…

I used to work for a financial company that used such extensive blocking. One day I had to download a particular version of boost libraries (the C++ ones). Of course all official sites to download from were blocked. So I searched for the specific file name (a tar.gz archive). And eventually I found something that was not blocked: a misconfigured server somewhere in Russia. Misconfigured because it served entire conte…

That seems super risky. How did you know the file was authentic? What if the archive contains backdoored code?

Re: Using Brave's “Private Window with Tor” could get you fired

#24

Post by donatj » Fri, Dec 31, 2021, 6:25 PM UTC

gruez wrote: post #23

benttoothpaste wrote: post #22

Earlier quoted context omitted.

I used to work for a financial company that used such extensive blocking. One day I had to download a particular version of boost libraries (the C++ ones). Of course all official sites to download from were blocked. So I searched for the specific file name (a tar.gz archive). And eventually I found something that was not blocked: a misconfigured server somewhere in Russia. Misconfigured because it served entire conte…

That seems super risky. How did you know the file was authentic? What if the archive contains backdoored code?

Seems like an odd proposition for an attack vector. Maybe, just maybe if I make this look like a misconfigured server, maybe, just maybe, someone will grab the boost files from the server and compile them? I can’t imagine.

Re: Using Brave's “Private Window with Tor” could get you fired

#25

Post by benttoothpaste » Fri, Dec 31, 2021, 6:30 PM UTC

gruez wrote: post #23

benttoothpaste wrote: post #22

Earlier quoted context omitted.

I used to work for a financial company that used such extensive blocking. One day I had to download a particular version of boost libraries (the C++ ones). Of course all official sites to download from were blocked. So I searched for the specific file name (a tar.gz archive). And eventually I found something that was not blocked: a misconfigured server somewhere in Russia. Misconfigured because it served entire conte…

That seems super risky. How did you know the file was authentic? What if the archive contains backdoored code?

Yeah it was risky. It is quite common for excessive security practices to actually decrease security and that particular example was not nearly the most egregious one in that company.

Re: Using Brave's “Private Window with Tor” could get you fired

#26

Post by btdmaster » Fri, Dec 31, 2021, 6:35 PM UTC

judge2020 wrote: post #7

JohnTHaller wrote: post #5

Earlier quoted context omitted.

Tor enables content that work can't monitor or block. And it's associated with child porn, dark web drug networks, sex trafficking, and similar. In reality, it's a small part of Tor. In the media, that's all it's used for.

The biggest use statistically is bot and malicious traffic. > Based on data across the CloudFlare network, 94% of requests that we see across the Tor network are per se malicious. https://blog.cloudflare.com/the-trouble-with-tor/#:~:text=Ba... .

This needs to be compared to clearnet for it to paint an accurate picture, which has reached 64% recently[1]. Though this figure comes from summing "good bots" with "bad bots", Cloudflare seems to have done the same ("automated requests", "content scraping").

[1] https://www.digit.fyi/two-thirds-of-internet-traffic-is-now-...

Re: Using Brave's “Private Window with Tor” could get you fired

#27

Post by renewiltord » Fri, Dec 31, 2021, 6:40 PM UTC

Well, it appears to be over zealous management. One might as well say “eating at your desk can get you fired”. The problem isn’t the eating. It’s the management.

Re: Using Brave's “Private Window with Tor” could get you fired

#28

Post by b3morales » Fri, Dec 31, 2021, 6:42 PM UTC

donatj wrote: post #24

gruez wrote: post #23

Earlier quoted context omitted.

That seems super risky. How did you know the file was authentic? What if the archive contains backdoored code?

Seems like an odd proposition for an attack vector. Maybe, just maybe if I make this look like a misconfigured server, maybe, just maybe, someone will grab the boost files from the server and compile them? I can’t imagine.

The open server does not have to be a deliberate attack setup. It could be compromised itself, or someone could have downloaded a bad artifact to it unknowingly. It could be someone's malware research storage (admittedly this is pretty unlikely). It's the simple fact that the provenance is unknown.

Re: Using Brave's “Private Window with Tor” could get you fired

#29

Post by wolverine876 » Fri, Dec 31, 2021, 6:45 PM UTC

donatj wrote: post #20

My company blocks so much inane crap it’s ridiculous. Any site not explicitly reviewed by the firewall company? Blocked. Want to Google restaurants for lunch? Half the restaurants websites are blocked under the firewall rule against “alcohol and bars”. So much more. Trying to talk to IT about it is painful. I had to go through three levels of support over a week just to get a single site unblocked. Before Work-from-H…

From another perspective (perhaps not popular here): How does allowing access to restaurant websites help the bottom line? What is the risk? One malware outbreak can be enormously damaging.

How much time should IT employees spend unblocking restaurant websites instead of, for example, developing new applications that increase productivity? Arguably, an IT employee who is spending time unblocking restaurant websites might be viewed as negative ROI for their salary.

And users have phones, so there is an easy workaround.

Re: Using Brave's “Private Window with Tor” could get you fired

#30

Post by yokoprime » Fri, Dec 31, 2021, 6:45 PM UTC

I can fully understand why a company doesn't want Tor traffic coming from inside the firewall. But this case, if the sort description is accurate, should have been cleared up with a conversation with the employee possibly resulting in temporarily banning Brave until they can actually deploy it in a configuration that works with company policy.

Again, IF the description is accurate, the employee was using a browser allowed by IT and did not have any ill intentions.