17 ms·
Exploiting the TOR-Browser
- CiPHPerCoder 10y ago> In my experience, HTTPS makes you more distinct and trackable than plain HTTP. You lost me here. https://www.wired.com/2017/01/half-web-now-encrypted-makes-everyone-safer/ https://www.wired.com/2017/01/half-web-now-encrypted-makes-e...
- nom 10y agoTrue, almost every remotely important page uses HTTPS now so the TOR traffic doesn't really stand out as much as it did a couple of years ago, but it still might look suspicious once you look at the overall bandwidth.
- irl_ 10y agoAlso me, so I wondered what experience he could have had to lead him to this conclusion. I found this: > His research focus on anti-anonymity technologies combines fields as vast as ergonomics and child development to artificial intelligence and theoretical biophysics. (http://www.hackerfactor.com/about.php http://www.hackerfactor.com/about.php)
- djsumdog 10y agoI suspect it was because the author thought the key used to connect could uniquely identify that browser, or that keys are somehow reused across sites?
- apeace 10y agoThe author is correct. HTTPS adds more vectors which can be used to form a fingerprint, such as the TLS version or the preferred cipher suites of the browser. For example: https://www.ssllabs.com/projects/client-fingerprinting/ https://www.ssllabs.com/projects/client-fingerprinting/ Anecdotally, I can tell you I have heard of ad tracking companies actively using this (for years now).
- acdha 10y agoThat's what you use when you don't have the richer information offered by HTTP sniffing. TLS versions tell you someone is one of a billion users of iOS version X; with HTTP they can piece together session cookies across every site and service you use, or with active attacks use things like the Verizon injected tracking code uniquely identifying you across devices.
- apeace 10y agoThat's true. If you're talking about your ISP sniffing your traffic, HTTPS is a win. But since the author was talking about using Tor, I figured he was focusing on fingerprinting by the websites themselves, where HTTPS is easier for them to fingerprint than HTTP.
- CiPHPerCoder 10y agoI don't doubt that HTTPS fingerprinting can be useful, but you can see the contents of their communications with HTTP. That seems much more useful for getting intelligence about Tor users.
- acdha 10y ago> fingerprinting by the websites themselves, where HTTPS is easier for them to fingerprint than HTTP. Could you explain your reasoning on that? If they're using the Tor browser every user is going to be very similar on crypto suites, user-agent, etc. — it's a rebadged Firefox distributable so it's going to be using their HTTPS implementation and you won't even get the OS version variations unless someone at the Tor project massively screws up. The bigger problem is that if you are being targeted by the website, there are far more interesting attacks they can try – convince the user to turn on JavaScript and do all of that profiling for WebGL/canvas rendering, local fonts, network resource timing to look for cached content from other sites, etc.
- apeace 10y agoYes, great point. But I said _easier_, not _easy_. Using HTTPS, a user may have a more outdated version of the Tor browser with different cipher suites than everyone else. Using plain HTTP, that can't happen. > unless someone at the Tor project massively screws up And that is what the author of the article is claiming. My comments here aren't in agreement with the author of the article, and I'm not claiming "HTTPS is bad" or anything like that. It's simply a categorical fact that HTTPS has more vectors to be fingerprinted than HTTP. But of course, as you mentioned, features enabled by Javascript are the bigger problem, which is why users who wish to be anonymous should completely disable it!
- irl_ 10y agoBrowser fingerprinting is not new. See also: https://panopticlick.eff.org/ https://panopticlick.eff.org/ "Panopticlick will analyze how well your browser and add-ons protect you against online tracking techniques. We’ll also see if your system is uniquely configured—and thus identifiable—even if you are using privacy-protective software." Tor bug #6119 (https://trac.torproject.org/projects/tor/ticket/6119 https://trac.torproject.org/projects/tor/ticket/6119) talking about using this tool specifically for Tor browser. There are also continuous efforts in Tor Browser to remove fingerprintability (e.g. #22127 - https://trac.torproject.org/projects/tor/ticket/22127 https://trac.torproject.org/projects/tor/ticket/22127).
- nom 10y agoAll in all not a really in-depth article, but the author has some valid points. All parameters exposed by the browser should be variated, especially the scroll bar size which seems to be the real offender here. Not sure how the Tails [0] distribution handles it, but IIRC it notified me of the screen size / view port size problem as I maximize the browser. 0: https://tails.boum.org/ https://tails.boum.org/
- SadWebDeveloper 10y agoJust disable JS by default and it will be good for 99.99% of the cases you don't allow explicitly allow it.
- mschuster91 10y agoYou can still target for the screen size using CSS - you can even track changes by creating a css file with literally thousands of thousands of media queries, where each media query sets e.g. the background-image property of a hidden div. Thanks to gzip compression, this shouldn't even take much data to transfer. Oh, and as I think of it, would this here still work? <a href="http://reddit.com"><span class="tracker" /></a> a#mylink span.tracker { background-image: url(http://myservice.onion/track.php?uid=xxx&trackedsite=reddit.com); }
- SadWebDeveloper 10y agoOf course but that will require to also accommodate for the fact that after N queries the circuit/endpoints changes and unless you have a unique tracking system per every "attacked" user (like an random generated ID per CSS served) or a way to store persistent across sessions, Screen Size alone won't be able to identify everyone on the TOR network, and that's my point if you disable JS (raise the security level to the max for the case of the tor browser) you will be good for the most common attacks for "APT's" you pretty much don't stand a chance unless you go "outside the grid" aka don't use the integrated browser.
- 10y ago
- wyager 10y ago> Seriously: if a TOR hidden service offers hard-core drugs or human trafficking or fake IDs, then they should be shut down. If it were possible to do this, TOR would lose any shred of value it has for people using it to fight oppression. Ok, let's say we put technology in place to "shut down" sites that sell fake IDs to teenagers (god forbid!). Well now, Mr. Lawman from the U.K. or China is going to come in and say "hey, wait a minute, you can shut down websites that illegally peddle fake IDs, so you obviously have the ability to shut down websites that peddle illegal extremism (meaning falun gong, anti-government groups, etc.)." The only defense against the TOR project and its supporters being forced to do this is that it's not technically feasible. It's really bad that this isn't manifestly obvious to someone who is apparently involved with the TOR project to a substantial degree.
- mschuster91 10y ago> If it were possible to do this, TOR would lose any shred of value it has for people using it to fight oppression. Most people in that field mess up their opsec sufficiently often that this is very well possible, see SilkRoad and its successors. When it comes to the kiddyfuckers, I'm a bit torn myself when I ask myself if child pornography (and apparently people even shared videos of raped toddlers) is an excuse for hacking and exposing actually innocent TOR users. It's the classic 4chan/reddit dilemma: what kind of content justifies which measures, and when is it worth to limit the right to free speech? For the record, I support anything done to bring child porn offenders to justice, but I also recognize that this opens dangerous doors - from the issue of "now it's an excuse for the Chinese/Russians/Iran/Saudi-Arabians to crack down on legitimate activities" to "people are actually already planting fake child-porn evidence, including in scareware/ransomware".
- Izmaki 10y agoThe thing is, a person wearing a mask is only hidden in a crowd, if the crowd of people wearing masks exist in the first place. By removing all evil from tor, you expose the good, leaving it vulnerable. That defeats the purpose, I suppose.
- 10y ago
- SadWebDeveloper 10y agoA little condescending and obnoxious for my taste but mostly everything here is well-known and while the TOR-Browser devs could implement everything this guy wants it, and it will end in a moral dilemma of what could be considerable "malicious". IMHO the Tor Browser is not suitable for the truly paranoid but usually this wont matter because the truly paranoid is not using the TOR network as-is (with the integrated browser) and those who aren't truly paranoid can live with those risk.
- symlinkk 10y agowhat are the truly paranoid using?
- 0xdeadbeefbabe 10y agohttps://www.drugs.com/condition/paranoid-disorder.html https://www.drugs.com/condition/paranoid-disorder.html
- thraway2016 10y agoi2p, freenet, or forgoing websites altogether. for asynchronous messaging, agl had something really promising with pond, but for "reasons" decided to abandon it, and nobody bothered to continue its development.
- djsumdog 10y agoI remember learning about Pond at a conference. It did look promising.
- __s 10y agohttps://stallman.org/stallman-computing.html https://stallman.org/stallman-computing.html
- linkregister 10y agoSo IceCat over Tor. Actually pretty sensible.
- throwaway322242 10y agoA number of people may consider drug markets as fighting oppression. [1] Ross Ulbritch certainly did. Law and morality evolves. [1] Psychedelics and cognitive liberty: Reimagining drug policy through the prism of human rights
- apeace 10y ago> The things that makes TOR useful for people avoiding prosecution also makes it useful for people involved in malicious and criminal activities ... Everything from spam and network attacks to trafficking people and contraband. > Although the Tor Project could promote options to restrict these malicious actions, they choose to do nothing. Seriously: if a TOR hidden service offers hard-core drugs or human trafficking or fake IDs, then they should be shut down. I hope I can convince some folks here to be skeptical of this kind of thinking. Think about it: If the Tor project came up with some clever way to take down bad hidden services, then what would be stopping a government from forcing them to take down legitimate hidden services too? And meanwhile, the criminals would move on to some other Tor-like service, and keep doing their thing. In short, you're not going to stop criminals, who will always find a way to keep doing what they're doing. You will, on the other hand, impede the free speech of honest users. The Tor project should focus on making it impossible for hidden services to be taken down--even by the Tor project itself! And they do :)
- mhuffman 10y ago> The things that makes TOR useful for people avoiding prosecution also makes it useful for people involved in malicious and criminal activities ... Everything from spam and network attacks to trafficking people and contraband. It is ok if someone that doesn't understand it says those sorts of things, but when an organization like cloudflare[1] jumps on the goof-troop bandwagon, it really does make a difference. [1] https://blog.torproject.org/blog/trouble-cloudflare https://blog.torproject.org/blog/trouble-cloudflare
- Confiks 10y agoI'm not too sure what "jumping on the goof-troop bandwagon" means to you, or what difference you are referring to. Cloudfare /did/ invest a lot of time communicating and trying to remedy the situations with the DDoS. The is evident in the amount of communication that can be found in the bugtracker.
- mhuffman 10y ago
- theprop 10y agoYou may prefer the Epic Privacy Browser.
- tptacek 10y agoDon't use Tor Browser. It's probably the least safe browser on the Internet. https://news.ycombinator.com/item?id=13623735 https://news.ycombinator.com/item?id=13623735 (For people unfamiliar: Tor and Tor Browser are not the same thing!)
- pdexter 10y agoWhat to use instead?
- tptacek 10y agoLiterally any other mainstream browser.
- Dylan16807 10y agoAs far as using a mainstream browser goes, you'd want to disable a smattering of features to get the most security/anonymity, like plugins and webgl. Any recommendations for a well-thought-out list? And while I understand the motivation to avoid an exploit magnet, what do you mean by "inferior security design"?
- middleclick 10y agoHardly good advice. Tor Browser is specifically built with privacy and security in mind. Using any "mainstream browser" and then expecting to do all those tweaks is not practical advice nor feasible.
- tptacek 10y agoRead the link upthread. I didn't explain the argument here because it's explained in depth there. Never, ever use Tor Browser.
- janwillemb 10y ago> Since this exploit is one of the minor ones, I've decided to not try to sell it. He would try and sell larger vulnerabilities? It only proves the point, but I still consider this a little bit disturbing.
- FiloSottile 10y agoThis is little more than an opinion piece. AFAICT, the only "vulnerability" is that with JS on, it can detect the Operating System. At some point it claims it can also detect screen size > However, there are not too many people using the same OS and same screen size and visiting the same sites at around the same time. You will likely stand out. but both my tests and themselves contradict that: > On a normal desktop browser, the Window Size is smaller than the Screen Size. (Mobile devices may show a Windows Size that is larger than the Screen Size.) To prevent screen profiling, the TOR-Browser sets them to be the same size. Note that detecting Tor Browser is doable from the User-Agent, so there's no point in setting Window Size = Screen Size. Definitely not "exploiting", and I suspect that's why it couldn't get a reply from security MLs, which see a lot of these. Flagged.
- travbrack 10y agoSo, make a browser extension that gives you a different fingerprint every time you use it.
- eeZah7Ux 10y agoComplaints do not help. Contributions and donations do. Tor is spelled Tor, not TOR.
- linkregister 10y agoTOR is the legacy name, an acronym for The Onion Router. The modern spelling is preferred, but it isn't incorrect to call the project TOR. https://en.wikipedia.org/wiki/Tor_(anonymity_network) https://en.wikipedia.org/wiki/Tor_(anonymity_network)
- mirimir 10y agoWell, Paul Syverson says that it's Tor, not TOR, and has never been an acronym. https://www.acsac.org/2011/program/keynotes/syverson.pdf https://www.acsac.org/2011/program/keynotes/syverson.pdf
- Dylan16807 10y ago> He would respond that it was the onion routing, the original program of projects from NRL. It was Rachel Greenstadt who noted to him that this was a nice acronym and gave Tor its name. Roger then observed that it also works well as a recursive acronym, ‘Tor’s onion routing’. It was also his decision that it should be written ‘Tor’ not ‘TOR’. Making it more of an ordinary word in this way also emphasizes the overlap of meaning with the German word ‘Tor’, which is gate (as in a city gate). To sum up, “Tor: The Second-Generation Onion Router” is about the design of onion-routing systems, not just onion routers themselves. Tor is the third generation of onion rout- ing, not the second. And the ‘r’ in ‘Tor’ represents ‘routing’ not ‘router’. In hindsight we probably should have spent a bit more time on the paper title. You have a significantly different definition of "not an acronym" than I do.
- mirimir 10y agoSorry, I misspoke. It's not an acronym for "the onion router", but rather for "the onion routing".
- sanbor 10y agoLet's say X event happens and Tor shuts down. What will happen with all that horrible people using the Tor network? Will they stop doing horrible activities? Probably not. Maybe they'll have more difficulties in their activities since they'll be geographically isolated. Tor it's just a channel that horrible people uses, but the horrible stuff that they do happens in real life. There is one approach that for sure it's going to solve the horrible activities that people do. Put a camera in every house. Put a camera in every corner. Then you can monitor every person and check if they're doing horrible things. Would be worth to live in a world like that?
- angry-hacker 10y agoDo you also think the same say about gun control? Hate speech?
- mirimir 10y agoThe title is clickbait. There are no exploits involved. He's not dropping NITs on users, for example. Fingerprinting is not a huge issue. The main defense is preventing adversaries from learning one's ISP-assigned IP address. Maybe Tor Project does encourage too much confidence in the "all users look alike" feature. They certainly do, in my opinion, regarding the security of Tor browser in Windows, with no protection against exploits and Tor bypass.
- smoyer 10y agoI have a habit of browsing with random window sizes (usually shrunk to just fit what I want to see. I guess if I ever need to use the TOR browser, I'll need to get out of that habit! This researcher disclosed his simplest approach to fingerprinting TOR browsers but if he really has 12 factors, you'll only be safe browsing sites with huge amounts of traffic.