Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tor 0day: Stopping Tor Connections

hackerfactor.com

Post reply on HN
Print view View original

31–40 of 92 posts

Re: Tor 0day: Stopping Tor Connections

#31

Post by lucb1e »

eat_veggies wrote: post #6
leksak wrote: post #4

Could someone in the know inform me as to whether or not my knee jerk reaction of "couldn't this individual possibly contribute to the Tor project instead?" is warranted?

They are contributing to the Tor project by sending detailed vulnerability reports. As for demanding that they fix/upstream changes themselves, then yes, that's likely too big of an ask, as even these reports are a gift. Tor has paid employees. "PRs welcome, wontfix" is not acceptable for security vulnerabilities in a security product.

To add to this, when reporting bugs (security or otherwise) I regularly feel like it's not worth my time to fix them because it takes me 2 hours to try to get the code to compile in the first place, sometimes you need to sign legalese to be allowed to help them, then I still need to figure out what the project's structure is and decide on how to best fix it (perhaps discuss it with the maintainer(s)), and then I haven't even started writing code yet. Meanwhile, I know that when maintaining my own software, it takes me 30 seconds to open up the project and I'll be literally 5 times faster working on a fix with all the context that is in my head and usually don't need to consult with others.

It's like if you kept trying to fix other people's cars when you know only the principles of a combustion engine, own an electric motorcycle yourself, and those cars would be very different from each other: I'd much rather someone does it who actually knows what they're doing, it would save all parties a lot of trouble. Diagnosing problems very specifically should already help them a lot of the time they would otherwise have to put in.

Re: Tor 0day: Stopping Tor Connections

#32

Post by camdenlock »

smooth_remmy wrote: post #28

I have gotten the impression over the last few years that the Tor Project has embraced social justice and diversity to the detriment of their software.

This is led some credence by the fact that the Tails website links to riseup.net, which hosts Rose City Antifa.

Re: Tor 0day: Stopping Tor Connections

#33

Post by flotzam »

Both of these vulnerabilities are bogus.

1. "using JavaScript, you can identify the scrollbar width [...] so an attacker can identify the underlying operating system"

Using JavaScript, you can simply ask Tor Browser what platform it's on using navigator.userAgent, and it will tell you the truth because lying breaks e.g. websites' custom key combinations. Tor Browser will however attempt to anonymize the platform in passive indicators, i.e. HTTP User-Agent: https://blog.torproject.org/new-release-tor-browser-801 (search for "User Agent")

(EDIT) This was too dismissive, because scrollbar width differences are more fine-grained than platform differences: https://bugzilla.mozilla.org/show_bug.cgi?id=1397996#c5

2. Blocking entry node connections:

"Checking every network connection against every possible Tor node takes time. This is fine if you have a slow network or low traffic volume, but it doesn't scale well for high-volume networks."

If you can muck around in TLS cert fields in real time, you can look up an IP address in a hash table...

"Second, the list of nodes changes often. This creates a race condition, where there may be a new Tor node that is seen by Tor users but isn't in your block list yet."

Oh no! (clutches pearls)

Not to say that it isn't worthwhile to tidy up the TLS fields some more, but hyping this as a zeroday is absurd.

Re: Tor 0day: Stopping Tor Connections

#34

Post by strbean »

staticassertion wrote: post #27
lucb1e wrote: post #23

Earlier quoted context omitted.

> If you were to only see a hash of my username, you could track me, but you couldn't identify me with it. Pseudonymous is the word for that sort of "tracking". Tracking just means being tracked, no matter if they use the real name or a hash of it or fingerprinting/metadata like IP + user agent string + installed fonts.

Yeah, that's my point. Anonymity to me implies that you can not determine my true identity. That property still holds here. What doesn't hold is that you can not determine that I am the same person in multiple locations - a very significant issue, but a much less serious one.

One feeds into the other strongly, though. The odds of an adversary de-anonymizing you go up the more activity the adversary can see. Also, we should look at your anonymity on a per-site/session basis, and if de-anonymization on one site breaks your anonymity on other sites, that is bad.

Re: Tor 0day: Stopping Tor Connections

#35

Post by Moru »

sanqui wrote: post #7

As a person who has, over the years, been recommending Tor and defending it against people claiming it's backdoored and useless, I'm disappointed. Can anybody here on HN give information on how some Tor alternatives and projects with similar goals are holding up?

I'm not realy using it much but i2p[0] has been around for a while. It's Java though as all other projects like this in case you have anything against it.

[0] https://geti2p.net/en/

Re: Tor 0day: Stopping Tor Connections

#36

Post by strbean »

lucb1e wrote: post #31
eat_veggies wrote: post #6

Earlier quoted context omitted.

They are contributing to the Tor project by sending detailed vulnerability reports. As for demanding that they fix/upstream changes themselves, then yes, that's likely too big of an ask, as even these reports are a gift. Tor has paid employees. "PRs welcome, wontfix" is not acceptable for security vulnerabilities in a security product.

To add to this, when reporting bugs (security or otherwise) I regularly feel like it's not worth my time to fix them because it takes me 2 hours to try to get the code to compile in the first place, sometimes you need to sign legalese to be allowed to help them, then I still need to figure out what the project's structure is and decide on how to best fix it (perhaps discuss it with the maintainer(s)), and then I have…

> it takes me 2 hours to try to get the code to compile in the first place

And then the tests won't pass on master!

Re: Tor 0day: Stopping Tor Connections

#37

Post by thaumaturgy »

ColanR wrote: post #10
thaumaturgy wrote: post #5

Earlier quoted context omitted.

The packet signature thing is maybe sort of interesting, but it's not hard to block Tor exit nodes; Tor themselves makes this easy: #!/bin/bash addresses=$(curl -s https://check.torproject.org/torbulkexitlist?ip= | sed '/^#/d') if [ -n "$addresses" ]; then /sbin/ipset flush tor echo "$addresses" | while read address; do /sbin/ipset -q -A tor "$address" done fi Add that to a cron job and your form abuse traffic falls…

I believe the article mentions that, but also notes your method works for low-traffic situations. The 0day is a high-performance alternative.

ipset is very fast (http://web.archive.org/web/20160514091316/http://daemonkeepe...).

The author's approach requires examining a certificate to see if it matches a pattern that may or may not change in the future.

Re: Tor 0day: Stopping Tor Connections

#38

Post by slashink »

strbean wrote: post #30
flotzam wrote: post #14

Earlier quoted context omitted.

https://2019.www.torproject.org/docs/faq.html.en#TBBJavaScri...

I don't understand this bit: > But there's a third issue: websites can easily determine whether you have allowed JavaScript for them, and if you disable JavaScript by default but then allow a few websites to run scripts (the way most people use NoScript), then your choice of whitelisted websites acts as a sort of cookie that makes you recognizable (and distinguishable), thus harming your anonymity. How would this wor…

You just let the javascript send a heartbeat ping. If you don't receive the ping but served the page you can determine that the user agent did not execute the javascript.

Re: Tor 0day: Stopping Tor Connections

#39

Post by syrrim »

staticassertion wrote: post #18

> (Many users think that Tor makes them anonymous. But Tor users can be tracked online; they are not anonymous.) Being tracked and anonymous feel like two distinct issues. If you were to only see a hash of my username, you could track me, but you couldn't identify me with it. Definitely something you'd want TOR to stop, but I think that's pretty important. The other vulnerability is that websites can identify that a…

Suppose you visit facebook via tor and log in. If you can be traced across the web, then your real name can now be attached to all your activity.
Post reply on HN