21 ms·

If TBB leads want to run Firefox with JavaScript "default on", then Tor Browser Bundle needs to be messaged as insecure. Either that or turn on NoScript and inf

If TBB leads want to run Firefox with JavaScript "default on", then Tor Browser Bundle needs to be messaged as insecure. Either that or turn on NoScript and inform people what bad shit can happen when their browser is interpreting arbitrary code in a not-so-sandboxed manner. TBB is not a solution against targeted deanonymization attacks. This is neither the first nor is the last 0day in Firefox that will affect TBB. IMO the best practical mitigation against these attacks is sandboxing with an amnesic system like Tails, as even as a VM it will leak a lot less information about the machine it is running on and requires burning both a Firefox 0day and a VM escape to get any real information outside of the real IP address of the user and some basic things out of /proc (although Tails may protect against the latter now). Also, as the whole VM goes away when it's closed, you're not getting persistence on that machine if you just pop the browser. A 30 second glance at the source code makes it looks like this exploit pivots to attacker-controlled memory on the heap, and spawns a thread using kernel32.dll. As EMET has hardening against attacks like this, I am curious if this exploit works at all on EMET-enabled Windows systems.

vilhelm_s 10y ago
I've never understood the Tails threat model, and this comment does not really help. You say that it will prevent the attackers from learning any information, except the real IP address of the user. But hiding the IP address of the user is the whole point of Tor. If you give that up, then what's even the point? The state can simply drive a black van to your house and get the rest of your information at their leisure.
- micaksica 10y ago
  Fine. Replace Tails with Whonix-Workstation and Whonix-Gateway, if you need to worry about leaking the IP address.
  - vilhelm_s 10y ago
    "If"? Are there any Tor users who don't need to worry about leaking their IP address? Then why do they use Tor in the first place? The Tor project itself seems to promote Tails much more than Whonix, which seems very odd to me.
    - micaksica 10y ago
      After thinking about this, I agree with your point, but it's past me being able to edit my original comment to address this issue there. OK, now you have an IP. Now what? You get a warrant and search the place. What do you find? A computer, maybe an amnesic virtual machine. No actual access to the website/onion in question. IMO Tails promotes better opsec when using Tor - you don't leave any traces behind of your browsing activity, and you can't gain persistence on the victim without a sandbox escape, since the Tails VM wipes itself. It is still a defense, but maybe not a good enough one.
      - haylem 10y ago
        You look at this from the privacy perspective of someone who wants to hide something within the constraints and confines of a working - and at least somewhat ethical - legal and judiciary framework. The original use case for Tor is for people who actually need to be able to use the net and hide. If their location and they get it with the equivalent of their local government's "search warrant", it's more likely a raid, interrogation, threats, harassment, censorship, and possibly torture and death. It's a whole different ball-game.
        micaksica 10y ago
        TL;DR: A plurality of Tor users are from Western countries with arguably decent judicial frameworks. Those that have life-or-death consequences to network anonymity will need a lot, lot more than the Tor Browser Bundle or Tor itself. > If their location and they get it with the equivalent of their local government's "search warrant", it's more likely a raid, interrogation, threats, harassment, censorship, and possibly torture and death. This is not who is primarily using Tor. 1/5 directly connecting users of Tor are in the United States. See: https://metrics.torproject.org/userstats-relay-table.html https://metrics.torproject.org/userstats-relay-table.html This doesn't change even for bridge users: https://metrics.torproject.org/userstats-bridge-table.html https://metrics.torproject.org/userstats-bridge-table.html So, the majority of Tor users are in places I think we'd consider have somewhat working judiciary frameworks. And I'm highly skeptical of even the American judiciary framework, if you read some of my past posts. You are correct, my original threat model was those Tor users and their use cases; if they are in FVEY territory they are probably already lost as Tor does not protect against "passive global adversaries" that FVEY IC has proven to be and may be able to be probabilistically deanonymized as was shown in the Snowden slides. [1] Yes, I admit I should have been thinking more deeply, and my original advice isn't good enough. I have a tendency to not think things through fully before posting here, and then I edit/evolve my thoughts as time goes on, as one does in a verbal discussion. Like you stated, clearly there are situations in which users rely on Tor for more than simple anonymity. They are already misguided in using the Tor Browser Bundle for this purpose. Use Qubes or Whonix on dedicated hardware, follow the grugq's "Opsec for Hackers" [1]. If the threat of information is torture and death, Tor alone is not going to save you from your adversary. Your threat model requires a hell of a lot more precautions than anonymity over the wire. You need to assume your tools are compromised and defend in depth as much as possible to make yourself a lot, lot harder to track. If you are using Tor Browser Bundle on Windows, you fucked up already. If you are only using Tor Browser Bundle, you fucked up too. If you are using Tor on your home connection, nope. If your device leaks identifying information to your access points (MAC addresses, hostnames), negative. If you are not using FDE on the device when they come for you, you are toast, etc etc. If your adversary is a powerful nation state or an organization with the ability to purchase exploits to use against you and they are willing to fuck you up physically, you have a big problem and you need bigger solutions. No anonymity project will be enough. You need to frustrate your adversary as much as possible and realize that your security comes from making you very expensive to track down, and hope they don't care enough. You are playing the game where you are angering the bear and attempting to be faster than the other guy, so that the other guy who didn't care as much is the one that is eaten. If they do care enough to come for you, and they have the resources to break a lot of layers to get to you, and you do not have any meatspace power to fight or flee, you are highly unlikely to win. If that's the "whole different ball game" you are playing and are just using TBB, you will lose. If your adversary is that strong or you have your life to lose, and you are likely being targeted, it is clear at this point that Tor Browser Bundle should be considered harmful without a better strategy of defense in depth. [1] https://www.theguardian.com/world/interactive/2013/oct/04/tor-stinks-nsa-presentation-document https://www.theguardian.com/world/interactive/2013/oct/04/to... [2] https://www.youtube.com/watch?v=9XaYdCdwiWU https://www.youtube.com/watch?v=9XaYdCdwiWU
- michaelt 10y ago
  If you're using Tor from a coffee shop, so an IP address alone isn't enough to identify you. Or if you're in a country oppressive enough that they'll raid your house for using Tor, but free enough that they'll let you off if they don't find evidence you were doing something illegal over Tor, and they didn't compromise the site you were visiting just asked your ISP to look for Tor users.
  - CmdrSprinkles 10y ago
    Definitely ignorant on the subject, but are there ANY nations that would meet that requirement? I would assume any that are savvy enough to detect tor AND care about it would probably not just say "Oh you crazy kids. Be more careful next time"
secfirstmd 10y ago
Unfortunately based on my experience training activists/journalists all over the world, the average user at risk in the field struggles to use TAILS.
- micaksica 10y ago
  What's their biggest struggle with it? PS, if you're ever on the US West Coast or in Singapore, drop me a DM. I'll buy you a drink someplace.
  - secfirstmd 10y ago
    Honestly? Many things: -It's tricky for a non-technical user to setup -It disrupts their regular workflow -People get frustrated with speeds of Tor etc -People get frustrated with Captcha (Dam Cloudflare!) and other things caused by using Tor in a safe manner. -People get annoyed as it doesn't solve their problems and exposure on mobile -You have to restart to run it -They can't run their regular programs on it - MS Office, Outlook, Adobe, etc. -It's Linux based, so a big mental jump for most people coming from Windows (or most people not at the command line on OS X) -It's hard to access files on other drives -Documentation and TAILS is only available in certain languages -It often has driver problems - e.g Macbook Pro 2015 WIFI issues -In developing states, computer literacy is low, so anything other than the norm (Windows) is confusing -In developing states, hardware tends to be slow (often counterfeit) so running TAILS in RAM is slow -People lose the USB sticks they put TAILS on (also many counterfeits, so they often fail or have a false size) -TAILS often requires training, which not everyone has access to -Skills fade for digital security training with journalists/activists is often quite high, especially if they don't need it that often. -the list goes on............ Don't get me wrong, I think it's great (as is Qubes, Subgraph etc) but we need to be realistic about it's limitations for the majority of people. Especially if we want to be sensible and try to tailor advice, training and tools to their realistic threat models. P.S Definitely, I'm on the West Coast probably once a year. Ditto you if your ever in Dublin (Ireland, not that fake one in California :) or London!
    - micaksica 10y ago
splesjaz 10y ago
VMs are all nice and that but if the exploit can compromise the TBB it's too late already, sandboxing needs to happen in the browser on Linux you can use namespaces + strict seccomp rules but don't know what one would use for Windows. First priority would be to sandbox the browser and work your way down if you want to sandbox more stuff. For Windows EMET can help to prevent certain exploits I guess but yea a browser that can access anything on the filesystem & system calls is badstuff.
- micaksica 10y ago
  Working within an assumed breach scenario, the VM is defense in depth. Firefox has holes, and it will continue to be relatively easily exploitable as long as TBB allows for plugins and JavaScript by default. There is reticence from TBB team to disable JS by default even in the face of a few of these 0days, so you have to protect TBB users a level down from the browser and assume it'll be popped. There are Windows "sandboxes" like Bromium, and as stated, IIRC EMET will stop the stack pivot here.
  - splesjaz 10y ago
    Last time I checked they were working on a TBB sandbox [1] Let's hope it will be there soon, subgraph has oz[2] and can be used with any program really then there is firejail[3] but these 2 are only on Linux available. 1: https://blog.torproject.org/blog/q-and-yawning-angel https://blog.torproject.org/blog/q-and-yawning-angel 2: https://github.com/subgraph/oz https://github.com/subgraph/oz 3: https://github.com/netblue30/firejail https://github.com/netblue30/firejail
- gcp 10y ago
  VMs are all nice and that but if the exploit can compromise the TBB it's too late already, sandboxing needs to happen in the browser on Linux you can use namespaces + strict seccomp rules but don't know what one would use for Windows. You can take a look at the sandbox implementation of Firefox (shared with Chrome) to see. TBB uses ESR which predates all that, though.
ryuuchin 10y ago
> A 30 second glance at the source code makes it looks like this exploit pivots to attacker-controlled memory on the heap, and spawns a thread using kernel32.dll. As EMET has hardening against attacks like this, I am curious if this exploit works at all on EMET-enabled Windows systems. EMET can be bypassed so it's no guarantee that it would stop the exploit (but it would probably stop THIS exploit). I don't know if some modification would be able to bypass EMET or other mitigations. A better solution would be to run javascript in a sandbox (as is done in Chrome/Chromium based browser) which has a much higher barrier to exit.
- micaksica 10y ago
  > A better solution would be to run javascript in a sandbox (as is done in Chrome/Chromium based browser) which has a much higher barrier to exit. Sure, but we can't get TBB rewritten overnight to work instantly with Chromium, and I'm sure there'd be a lot of push back on that.
  - splesjaz 10y ago
    Well yea but this isn't something that we discovered today it's been years sadly :(
  - TD-Linux 10y ago
    An easier solution would be to enable e10s. It should be on by default in the next ESR, and I know TBB has been working to make their patches compatible with it.
    - gcp 10y ago
      Not just e10s, they also need to enable the sandboxing, i.e. it requires Firefox 50 at least. It should actually be easier for Tor to enable stricter sandboxing than in the default Firefox, though, as presumably they have to care less about compatibility.
- MikeHolman 10y ago
  I don't know much about EMET. How would they mitigate this? After all, it's obviously valid for a VM to call CreateThread.

vilhelm_s 10y ago

I've never understood the Tails threat model, and this comment does not really help. You say that it will prevent the attackers from learning any information, except the real IP address of the user. But hiding the IP address of the user is the whole point of Tor. If you give that up, then what's even the point? The state can simply drive a black van to your house and get the rest of your information at their leisure.

micaksica 10y ago
Fine. Replace Tails with Whonix-Workstation and Whonix-Gateway, if you need to worry about leaking the IP address.
- vilhelm_s 10y ago
  "If"? Are there any Tor users who don't need to worry about leaking their IP address? Then why do they use Tor in the first place? The Tor project itself seems to promote Tails much more than Whonix, which seems very odd to me.
  - micaksica 10y ago
    After thinking about this, I agree with your point, but it's past me being able to edit my original comment to address this issue there. OK, now you have an IP. Now what? You get a warrant and search the place. What do you find? A computer, maybe an amnesic virtual machine. No actual access to the website/onion in question. IMO Tails promotes better opsec when using Tor - you don't leave any traces behind of your browsing activity, and you can't gain persistence on the victim without a sandbox escape, since the Tails VM wipes itself. It is still a defense, but maybe not a good enough one.
    - haylem 10y ago
      You look at this from the privacy perspective of someone who wants to hide something within the constraints and confines of a working - and at least somewhat ethical - legal and judiciary framework. The original use case for Tor is for people who actually need to be able to use the net and hide. If their location and they get it with the equivalent of their local government's "search warrant", it's more likely a raid, interrogation, threats, harassment, censorship, and possibly torture and death. It's a whole different ball-game.
      - micaksica 10y ago
        TL;DR: A plurality of Tor users are from Western countries with arguably decent judicial frameworks. Those that have life-or-death consequences to network anonymity will need a lot, lot more than the Tor Browser Bundle or Tor itself. > If their location and they get it with the equivalent of their local government's "search warrant", it's more likely a raid, interrogation, threats, harassment, censorship, and possibly torture and death. This is not who is primarily using Tor. 1/5 directly connecting users of Tor are in the United States. See: https://metrics.torproject.org/userstats-relay-table.html https://metrics.torproject.org/userstats-relay-table.html This doesn't change even for bridge users: https://metrics.torproject.org/userstats-bridge-table.html https://metrics.torproject.org/userstats-bridge-table.html So, the majority of Tor users are in places I think we'd consider have somewhat working judiciary frameworks. And I'm highly skeptical of even the American judiciary framework, if you read some of my past posts. You are correct, my original threat model was those Tor users and their use cases; if they are in FVEY territory they are probably already lost as Tor does not protect against "passive global adversaries" that FVEY IC has proven to be and may be able to be probabilistically deanonymized as was shown in the Snowden slides. [1] Yes, I admit I should have been thinking more deeply, and my original advice isn't good enough. I have a tendency to not think things through fully before posting here, and then I edit/evolve my thoughts as time goes on, as one does in a verbal discussion. Like you stated, clearly there are situations in which users rely on Tor for more than simple anonymity. They are already misguided in using the Tor Browser Bundle for this purpose. Use Qubes or Whonix on dedicated hardware, follow the grugq's "Opsec for Hackers" [1]. If the threat of information is torture and death, Tor alone is not going to save you from your adversary. Your threat model requires a hell of a lot more precautions than anonymity over the wire. You need to assume your tools are compromised and defend in depth as much as possible to make yourself a lot, lot harder to track. If you are using Tor Browser Bundle on Windows, you fucked up already. If you are only using Tor Browser Bundle, you fucked up too. If you are using Tor on your home connection, nope. If your device leaks identifying information to your access points (MAC addresses, hostnames), negative. If you are not using FDE on the device when they come for you, you are toast, etc etc. If your adversary is a powerful nation state or an organization with the ability to purchase exploits to use against you and they are willing to fuck you up physically, you have a big problem and you need bigger solutions. No anonymity project will be enough. You need to frustrate your adversary as much as possible and realize that your security comes from making you very expensive to track down, and hope they don't care enough. You are playing the game where you are angering the bear and attempting to be faster than the other guy, so that the other guy who didn't care as much is the one that is eaten. If they do care enough to come for you, and they have the resources to break a lot of layers to get to you, and you do not have any meatspace power to fight or flee, you are highly unlikely to win. If that's the "whole different ball game" you are playing and are just using TBB, you will lose. If your adversary is that strong or you have your life to lose, and you are likely being targeted, it is clear at this point that Tor Browser Bundle should be considered harmful without a better strategy of defense in depth. [1] https://www.theguardian.com/world/interactive/2013/oct/04/tor-stinks-nsa-presentation-document https://www.theguardian.com/world/interactive/2013/oct/04/to... [2] https://www.youtube.com/watch?v=9XaYdCdwiWU https://www.youtube.com/watch?v=9XaYdCdwiWU
michaelt 10y ago
If you're using Tor from a coffee shop, so an IP address alone isn't enough to identify you. Or if you're in a country oppressive enough that they'll raid your house for using Tor, but free enough that they'll let you off if they don't find evidence you were doing something illegal over Tor, and they didn't compromise the site you were visiting just asked your ISP to look for Tor users.
- CmdrSprinkles 10y ago
  Definitely ignorant on the subject, but are there ANY nations that would meet that requirement? I would assume any that are savvy enough to detect tor AND care about it would probably not just say "Oh you crazy kids. Be more careful next time"

secfirstmd 10y ago

Unfortunately based on my experience training activists/journalists all over the world, the average user at risk in the field struggles to use TAILS.

micaksica 10y ago
What's their biggest struggle with it? PS, if you're ever on the US West Coast or in Singapore, drop me a DM. I'll buy you a drink someplace.
- secfirstmd 10y ago
  Honestly? Many things: -It's tricky for a non-technical user to setup -It disrupts their regular workflow -People get frustrated with speeds of Tor etc -People get frustrated with Captcha (Dam Cloudflare!) and other things caused by using Tor in a safe manner. -People get annoyed as it doesn't solve their problems and exposure on mobile -You have to restart to run it -They can't run their regular programs on it - MS Office, Outlook, Adobe, etc. -It's Linux based, so a big mental jump for most people coming from Windows (or most people not at the command line on OS X) -It's hard to access files on other drives -Documentation and TAILS is only available in certain languages -It often has driver problems - e.g Macbook Pro 2015 WIFI issues -In developing states, computer literacy is low, so anything other than the norm (Windows) is confusing -In developing states, hardware tends to be slow (often counterfeit) so running TAILS in RAM is slow -People lose the USB sticks they put TAILS on (also many counterfeits, so they often fail or have a false size) -TAILS often requires training, which not everyone has access to -Skills fade for digital security training with journalists/activists is often quite high, especially if they don't need it that often. -the list goes on............ Don't get me wrong, I think it's great (as is Qubes, Subgraph etc) but we need to be realistic about it's limitations for the majority of people. Especially if we want to be sensible and try to tailor advice, training and tools to their realistic threat models. P.S Definitely, I'm on the West Coast probably once a year. Ditto you if your ever in Dublin (Ireland, not that fake one in California :) or London!
  - micaksica 10y ago

splesjaz 10y ago

VMs are all nice and that but if the exploit can compromise the TBB it's too late already, sandboxing needs to happen in the browser on Linux you can use namespaces + strict seccomp rules but don't know what one would use for Windows. First priority would be to sandbox the browser and work your way down if you want to sandbox more stuff. For Windows EMET can help to prevent certain exploits I guess but yea a browser that can access anything on the filesystem & system calls is badstuff.

micaksica 10y ago
Working within an assumed breach scenario, the VM is defense in depth. Firefox has holes, and it will continue to be relatively easily exploitable as long as TBB allows for plugins and JavaScript by default. There is reticence from TBB team to disable JS by default even in the face of a few of these 0days, so you have to protect TBB users a level down from the browser and assume it'll be popped. There are Windows "sandboxes" like Bromium, and as stated, IIRC EMET will stop the stack pivot here.
- splesjaz 10y ago
  Last time I checked they were working on a TBB sandbox [1] Let's hope it will be there soon, subgraph has oz[2] and can be used with any program really then there is firejail[3] but these 2 are only on Linux available. 1: https://blog.torproject.org/blog/q-and-yawning-angel https://blog.torproject.org/blog/q-and-yawning-angel 2: https://github.com/subgraph/oz https://github.com/subgraph/oz 3: https://github.com/netblue30/firejail https://github.com/netblue30/firejail
gcp 10y ago
VMs are all nice and that but if the exploit can compromise the TBB it's too late already, sandboxing needs to happen in the browser on Linux you can use namespaces + strict seccomp rules but don't know what one would use for Windows. You can take a look at the sandbox implementation of Firefox (shared with Chrome) to see. TBB uses ESR which predates all that, though.

ryuuchin 10y ago

> A 30 second glance at the source code makes it looks like this exploit pivots to attacker-controlled memory on the heap, and spawns a thread using kernel32.dll. As EMET has hardening against attacks like this, I am curious if this exploit works at all on EMET-enabled Windows systems. EMET can be bypassed so it's no guarantee that it would stop the exploit (but it would probably stop THIS exploit). I don't know if some modification would be able to bypass EMET or other mitigations. A better solution would be to run javascript in a sandbox (as is done in Chrome/Chromium based browser) which has a much higher barrier to exit.

micaksica 10y ago
> A better solution would be to run javascript in a sandbox (as is done in Chrome/Chromium based browser) which has a much higher barrier to exit. Sure, but we can't get TBB rewritten overnight to work instantly with Chromium, and I'm sure there'd be a lot of push back on that.
- splesjaz 10y ago
  Well yea but this isn't something that we discovered today it's been years sadly :(
- TD-Linux 10y ago
  An easier solution would be to enable e10s. It should be on by default in the next ESR, and I know TBB has been working to make their patches compatible with it.
  - gcp 10y ago
    Not just e10s, they also need to enable the sandboxing, i.e. it requires Firefox 50 at least. It should actually be easier for Tor to enable stricter sandboxing than in the default Firefox, though, as presumably they have to care less about compatibility.
MikeHolman 10y ago
I don't know much about EMET. How would they mitigate this? After all, it's obviously valid for a VM to call CreateThread.