81–90 of 91 posts
> TorMoil, as the flaw has been dubbed by its discoverer, is triggered when users click on links that begin with file:// rather than the more common https:// and http:// address prefixes. When the Tor browser for macOS and Linux is in the process of opening such an address, "the operating system may directly connect to the remote host, bypassing Tor Browser," according to a brief blog post published Tuesday by We Are…
"Well, in any sort of secure Tor implementation, such a thing should be impossible. The Tor client should be running in a router or gateway VM, and the machine used for browsing should not even have a public IP address. That's easy to manage with Whonix." I would go even further and suggest that a mission critical proxy should not live on a system configured with a real (routable) IP address. As we can see in this in…
Me, I just have a perimeter router.
> TorMoil, as the flaw has been dubbed by its discoverer, is triggered when users click on links that begin with file:// rather than the more common https:// and http:// address prefixes. When the Tor browser for macOS and Linux is in the process of opening such an address, "the operating system may directly connect to the remote host, bypassing Tor Browser," according to a brief blog post published Tuesday by We Are…
This is nothing at all like the FBI exploit, which was an RCE vulnerability against firefox. The reason they have been ignoring you about requiring a vm is likely because it is out of scope and doesn't make practical sense. They don't control the parent operating system.
Isn't clear by now that reliable "anonymity" systems are impossible without control over the parent OS? Or at least, control over network access?
Earlier quoted context omitted.
I wonder how hard it would be to ship tor as a bundle with qemu and a very thin Linux image that provided just enough functionality to run it, then when you click on the start icon, it opens the emulator, which opens up the browser in a environment that's thin enough you don't even really need to pay attention to it because you've just got a window containing window containing your browser. With the right wm inside,…
Check out tails: https://tails.boum.org/about/index.en.html Pretty much that. Forward some X11?
Earlier quoted context omitted.
Lots of online services are vulnerable to this kind of attack. I've seen numerous forms that do things like check security headers, scan your HTML, or do benchmarking. You're supposed to enter a site like: * https://example.com/ But instead you can access local files via file:////etc/passwd
The remote site does not get the contents of your /etc/passwd if you do that, due to same origin policy. And you cannot see the /etc/passwd of the remote site. If you want to see your own, you can also open your /etc/passwd in vim. So, there is no vulnerability there.
Earlier quoted context omitted.
You can always start two VMs with very thin OSs on them. The Tor proxy could even be a unikernel with no functionality beyond being a Tor proxy.
I've played some with that. Whonix uses a full Debian install for the gateway, and that uses lots of disk. I used OpenWRT VMs for a while, but Tor releases in their repo got way out of data, and I never managed a build. If someone can point to a distro that works for this, many of us would be very happy.
Earlier quoted context omitted.
The remote site does not get the contents of your /etc/passwd if you do that, due to same origin policy. And you cannot see the /etc/passwd of the remote site. If you want to see your own, you can also open your /etc/passwd in vim. So, there is no vulnerability there.
No. You can get the remote server's /etc/passwd in some cases. Most OS's would block a file that obvious from a non-privileged app but maybe /tmp/session.32eg3g3.txt is readable. There are sensitive local files that are readable by your web app so you must take precautions. This is in fact a common security hole caused by careless developers.
Earlier quoted context omitted.
Lots of online services are vulnerable to this kind of attack. I've seen numerous forms that do things like check security headers, scan your HTML, or do benchmarking. You're supposed to enter a site like: * https://example.com/ But instead you can access local files via file:////etc/passwd
The remote site does not get the contents of your /etc/passwd if you do that, due to same origin policy. And you cannot see the /etc/passwd of the remote site. If you want to see your own, you can also open your /etc/passwd in vim. So, there is no vulnerability there.
I certainly don't expect to see my own file, but it is very common for remote sites to show THEIR /etc/passwd file, because they've used PHPs fopen function, or a curl-wrapper which didn't disable file:// URIs.
> TorMoil, as the flaw has been dubbed by its discoverer, is triggered when users click on links that begin with file:// rather than the more common https:// and http:// address prefixes. When the Tor browser for macOS and Linux is in the process of opening such an address, "the operating system may directly connect to the remote host, bypassing Tor Browser," according to a brief blog post published Tuesday by We Are…
I wonder how hard it would be to ship tor as a bundle with qemu and a very thin Linux image that provided just enough functionality to run it, then when you click on the start icon, it opens the emulator, which opens up the browser in a environment that's thin enough you don't even really need to pay attention to it because you've just got a window containing window containing your browser. With the right wm inside,…
This will ensure all outgoing traffic is headed for the Tor network. This would prevent this vuln from being effective as it would drop the outbound packets.
Why does anyone rely on TOR for security? Obviously bugs happen, but it seems pretty easy to hack by any large organization....or government.
For instance, according to this page ( https://metrics.torproject.org/networksize.html ), there are less than 7,000 relays in the TOR network. To me, the US, British, Russian, or Chinese government could easily control most of those (i.e. running their own nodes) without anyone knowing, and use that to listen in (or at least infer) what TOR users are doing.
At that small of a scale, I’d bet a large corporation could even run a bunch of nodes.
How can that be protected against - or can it?
Am I missing something?