Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tor 0day: Stopping Tor Connections

hackerfactor.com

Post reply on HN
Print view View original

41–50 of 92 posts

Re: Tor 0day: Stopping Tor Connections

#41

Post by cortesoft »

slashink wrote: post #38
strbean wrote: post #30

Earlier quoted context omitted.

I don't understand this bit: > But there's a third issue: websites can easily determine whether you have allowed JavaScript for them, and if you disable JavaScript by default but then allow a few websites to run scripts (the way most people use NoScript), then your choice of whitelisted websites acts as a sort of cookie that makes you recognizable (and distinguishable), thus harming your anonymity. How would this wor…

You just let the javascript send a heartbeat ping. If you don't receive the ping but served the page you can determine that the user agent did not execute the javascript.

Sure, but the comment mentions that you would use the 'set of websites that are whitelisted' as an identifier... your method can only check the site you are currently on, it doesn't give you information on if other websites have been whitelisted or not.

Re: Tor 0day: Stopping Tor Connections

#42

Post by rendx »

I can't see how this is a "0day".

This post talks about how you can identify a running Tor when you connect to the (operator-assigned, public) relay port. You can only "see" these TLS certificate details when you are connecting to the relay yourself. This means this does not allow network operators to detect traffic going to Tor nodes, or in-between nodes, let alone identify users or deanonymize anyone: To external observers, such traffic looks like typical browser TLS traffic.

So, what this does is allow you to identify Tor nodes, which is by definition not a problem for all Tor relays except bridges, which should not be as easily discoverable by a network scan. The problem has been known before, and work as been done so you can now run a Tor bridge without this problem. As this problem has been publicly discussed and outlined in the very first design documents, it cannot be called a "0day", even if it was more problematic than it actually is.

Tor came up with the concept of "pluggable transports" to address this very successfully, which allows clients and entry bridges to basically make Tor traffic look like anything you want.

Re: Tor 0day: Stopping Tor Connections

#43

Post by throwaway89201 »

The author of this blog strongly comes across as a person who understands a good deal about finding vulnerabilities, but doesn't really understand the tradeoffs being made in maintaining usable anonymity software such as the Tor browser.

The reported scroll bar width vulnerability is his strongest case. He rightly got a bounty for it. But it's relatively hard to fix, and until recently, the Tor browser also just leaked your window size via Javascript. But they're getting there, slowly.

However, the story about public bridge certificates is pretty unjustified. The response he got from the Tor Project is completely clear, and his proposed solution in trying to impersonate traditional PKI simply won't work against even mediocre attackers. Furthermore, bridge enumeration as a systemic attack might be a problem against censorship systems, but can't rightly be called a '0day'. Private bridges (https://bridges.torproject.org) also solve a lot of the problem.

In the linked ticket, you clearly see that they are trying pretty hard to find a sponsor willing to fund the solution.

Re: Tor 0day: Stopping Tor Connections

#44

Post by mirashii »

sanqui wrote: post #7

As a person who has, over the years, been recommending Tor and defending it against people claiming it's backdoored and useless, I'm disappointed. Can anybody here on HN give information on how some Tor alternatives and projects with similar goals are holding up?

There's really no reason to be disappointed. The post above both isn't about any real vulnerabilities in the service, and does not have any real solutions to the problems posed.

Re: Tor 0day: Stopping Tor Connections

#45

Post by thaumaturgy »

EE84M3i wrote: post #26
thaumaturgy wrote: post #5

Earlier quoted context omitted.

The packet signature thing is maybe sort of interesting, but it's not hard to block Tor exit nodes; Tor themselves makes this easy: #!/bin/bash addresses=$(curl -s https://check.torproject.org/torbulkexitlist?ip= | sed '/^#/d') if [ -n "$addresses" ]; then /sbin/ipset flush tor echo "$addresses" | while read address; do /sbin/ipset -q -A tor "$address" done fi Add that to a cron job and your form abuse traffic falls…

If you feel it necessary to block Tor nodes in some way, I think it's better to only block non-safe methods. Personally, I don't do it, but I understand why it's appealing. I see it as a personal decision (its your website after all) and not morally wrong as some see it. I once talked to someone working security for a Canadian government agency. They considered it against their charter and/or illegal to block tor nod…

Yeah. I'm sympathetic towards the Tor project in general, but it's also a huge source of nuisances and almost 0% legitimate traffic (in my case). As a beleaguered one-man sysadmin who also wears a full-time dev hat, I just don't have the resources available to build out a more clever rule-based filter for Tor traffic. This approach took me all of about 10 minutes to figure out and deploy across my little network of servers, and it made an entire stream of daily emails disappear immediately.

If I were fortunate enough to be part of a larger team, I'd advocate for exactly what you're suggesting.

Re: Tor 0day: Stopping Tor Connections

#46

Post by WookieRushing »

flotzam wrote: post #33

Both of these vulnerabilities are bogus. 1. "using JavaScript, you can identify the scrollbar width [...] so an attacker can identify the underlying operating system" Using JavaScript, you can simply ask Tor Browser what platform it's on using navigator.userAgent, and it will tell you the truth because lying breaks e.g. websites' custom key combinations. Tor Browser will however attempt to anonymize the platform in p…

Yeah I totally agree, especially with the blocking entry nodes part.

There are many other ways to detect TOR connections or nodes and block them. Theres enough that there are a whole set of ways of obfuscating traffic called pluggable transports: https://trac.torproject.org/projects/tor/wiki/doc/AChildsGar...

Re: Tor 0day: Stopping Tor Connections

#47

Post by gpm »

EE84M3i wrote: post #26
thaumaturgy wrote: post #5

Earlier quoted context omitted.

The packet signature thing is maybe sort of interesting, but it's not hard to block Tor exit nodes; Tor themselves makes this easy: #!/bin/bash addresses=$(curl -s https://check.torproject.org/torbulkexitlist?ip= | sed '/^#/d') if [ -n "$addresses" ]; then /sbin/ipset flush tor echo "$addresses" | while read address; do /sbin/ipset -q -A tor "$address" done fi Add that to a cron job and your form abuse traffic falls…

If you feel it necessary to block Tor nodes in some way, I think it's better to only block non-safe methods. Personally, I don't do it, but I understand why it's appealing. I see it as a personal decision (its your website after all) and not morally wrong as some see it. I once talked to someone working security for a Canadian government agency. They considered it against their charter and/or illegal to block tor nod…

I think there are also some Canadian court cases protecting the right to speak anonymously over the internet. It's an area where I think our government is going a pretty decent job (as governments interacting with new fangled technologies go)

Re: Tor 0day: Stopping Tor Connections

#48

Post by wolco »

syrrim wrote: post #39
staticassertion wrote: post #18

> (Many users think that Tor makes them anonymous. But Tor users can be tracked online; they are not anonymous.) Being tracked and anonymous feel like two distinct issues. If you were to only see a hash of my username, you could track me, but you couldn't identify me with it. Definitely something you'd want TOR to stop, but I think that's pretty important. The other vulnerability is that websites can identify that a…

Suppose you visit facebook via tor and log in. If you can be traced across the web, then your real name can now be attached to all your activity.

Wait.. you are logging into facebook and using your real name?

Step 1: Log into tor.

Step 2: Create facebook account using a fake name

Step 3: Don't add anyone you know in real life as a friend. Best not to search for friends.

Facebook will not connect you now.

Re: Tor 0day: Stopping Tor Connections

#49

Post by flotzam »

cortesoft wrote: post #41
slashink wrote: post #38

Earlier quoted context omitted.

You just let the javascript send a heartbeat ping. If you don't receive the ping but served the page you can determine that the user agent did not execute the javascript.

Sure, but the comment mentions that you would use the 'set of websites that are whitelisted' as an identifier... your method can only check the site you are currently on, it doesn't give you information on if other websites have been whitelisted or not.

AFAIK NoScript whitelists don't respect first-party isolation (so a JS-enabled website can be included in a JS-disabled website), which makes it a relatively simple coordination problem between website A and B (possibly automated by a third-party tracker included in both A and B).

In any case, first-party isolation can be subverted: https://news.ycombinator.com/item?id=17947605

Re: Tor 0day: Stopping Tor Connections

#50

Post by lucb1e »

strbean wrote: post #36
lucb1e wrote: post #31

Earlier quoted context omitted.

To add to this, when reporting bugs (security or otherwise) I regularly feel like it's not worth my time to fix them because it takes me 2 hours to try to get the code to compile in the first place, sometimes you need to sign legalese to be allowed to help them, then I still need to figure out what the project's structure is and decide on how to best fix it (perhaps discuss it with the maintainer(s)), and then I have…

> it takes me 2 hours to try to get the code to compile in the first place And then the tests won't pass on master!

Tell me about it. Instructions working on the first attempt on a standard Debian system is quite rare. Bigger projects with more contributors put more work into making it work, but also have more complex processes, so the result is that it's almost always trouble. Or they're simply more complex than necessary: no I don't want to download 12GB of IDE, SDK/compiler, emulated operating systems, and custom versions of dependencies installed system-wide in order to compile and run this project, I just want the code and dependencies in the local folder and apt install a compiler so I can simply build the apk and adb install it on my phone without screwing up my system or having to setup a new container/VM for the purpose.
Post reply on HN