9 ms·
Critical Tor flaw leaks users’ real IP address
- MR4D 9y agoCan someone please explain something to me? I’ve had this question for a long time, and finally decided to ask it... Why does anyone rely on TOR for security? Obviously bugs happen, but it seems pretty easy to hack by any large organization....or government. For instance, according to this page ( https://metrics.torproject.org/networksize.html https://metrics.torproject.org/networksize.html ), there are less than 7,000 relays in the TOR network. To me, the US, British, Russian, or Chinese government could easily control most of those (i.e. running their own nodes) without anyone knowing, and use that to listen in (or at least infer) what TOR users are doing. At that small of a scale, I’d bet a large corporation could even run a bunch of nodes. How can that be protected against - or can it? Am I missing something?
- linkmotif 9y agoJust the other day I saw some file://-based exploit. Didn’t read the specifics of this, but not validating a URL’s scheme must be a very common source of problems. It’s so easy to overlook the scheme when everything is https?:// all the time. But alas, file://, it’s real, browsers attempt to work with it. Another edge to be aware of!!
- KGIII 9y agoThis is the same exploit, it's from Friday.
- stevekemp 9y agoLots of online services are vulnerable to this kind of attack. I've seen numerous forms that do things like check security headers, scan your HTML, or do benchmarking. You're supposed to enter a site like: * https://example.com/ https://example.com/ But instead you can access local files via file:////etc/passwd
- lawnchair_larry 9y agoThe remote site does not get the contents of your /etc/passwd if you do that, due to same origin policy. And you cannot see the /etc/passwd of the remote site. If you want to see your own, you can also open your /etc/passwd in vim. So, there is no vulnerability there.
- singlow 9y agoNo. You can get the remote server's /etc/passwd in some cases. Most OS's would block a file that obvious from a non-privileged app but maybe /tmp/session.32eg3g3.txt is readable. There are sensitive local files that are readable by your web app so you must take precautions. This is in fact a common security hole caused by careless developers.
- lawnchair_larry 9y agoWith a file:// URI? No you can't. That isn't how that works. You're confusing this with remote file disclosure attacks, which are totally different.
- stevekemp 9y agoThe code I'm talking about typically calls `curl`, or similar, to download a remote URL, and show "stuff" about the contents. I certainly don't expect to see my own file, but it is very common for remote sites to show THEIR /etc/passwd file, because they've used PHPs fopen function, or a curl-wrapper which didn't disable file:// URIs.
- dingaling 9y agoOne risk mitigation for that is to sandbox the browser with something like firejail and whitelist access to only the profile directory and /tmp
- deleted 9y ago[deleted]
- forapurpose 9y agoIf an attacker learned a Tor Browser user's real IP address yesterday, and the leak gets fixed today, can the attacker still somehow identify that user's traffic tomorrow? Browser fingerprinting comes to mind, but is there another method?
- deleted 9y ago[deleted]
- cjbprime 9y agoDepends on the attacker -- if they're able to surveil the network upstream of the IP address they just learned, they could use timing analysis. i.e. if the attacker is the FBI and they're trying to unmask visitors to an onion service, and they learned your IP address (and hence real life name) through this method, they can also confirm that you're visiting the site they're surveiling through correlating packet times leaving your interface and arriving at the surveiled server's. Maybe there's a less dramatic way to do it too?
- kakarot 9y agoIt's my understanding that this exploit wouldn't work with a hidden service because there is no way for your machine to know how to connect to it directly and the connection must be established through the Tor network, unlike a regular website. Is this not the case?
- yeukhon 9y agoI think most importantly, most people's IP address given by ISP is "fixed" for a long period of time.
- Buge 9y agoIf they saw the person's username, then they can keep tracking that username. Same with any type of cookies. Https obviously makes it harder to do on sites they don't own, but it still works on http sites and https sites they own.
- 3pt14159 9y ago
- danjoc 9y agoHow long has the exploit existed? Did it magically appear after Appelbaum was run out of town on vague allegations of sexual harrassment?
- dang 9y agoPlease don't post flamewar comments to HN. We ban accounts that do this repeatedly (and have had to ask you this before), so would you please re-read https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and follow it from now on?
- fulafel 9y agoInteresting that this has been posted 5 times in the past few days without receiving votes.
- dang 9y agoThat's the randomness of what gets attention here. Many good stories fall through the cracks or need multiple submissions before they catch. We try to mitigate this by looking through the stories that didn't get attention and re-upping the good ones (described at https://news.ycombinator.com/item?id=11662380 https://news.ycombinator.com/item?id=11662380 and links back from there) and/or inviting reposts.
- mirimir 9y ago> TorMoil, as the flaw has been dubbed by its discoverer, is triggered when users click on links that begin with file:// rather than the more common https:// https:// and http:// http:// address prefixes. When the Tor browser for macOS and Linux is in the process of opening such an address, "the operating system may directly connect to the remote host, bypassing Tor Browser," according to a brief blog post published Tuesday by We Are Segment, the security firm that privately reported the bug to Tor developers. Oh, well ... This is basically the same vulnerability exploited by the FBI's NIT. And this is the key aspect ... > ... "the operating system may directly connect to the remote host, bypassing Tor Browser," ... Well, in any sort of secure Tor implementation, such a thing should be impossible. The Tor client should be running in a router or gateway VM, and the machine used for browsing should not even have a public IP address. That's easy to manage with Whonix. I've badgered Tor Project about this for years. And they've ignored me. Their mantra has been about keeping things simple, so more people will use Tor. Damn. Edit: They've plugged this leak, but the fundamental weakness remains. Tor Browser doesn't even block non-Tor connectivity with firewall rules. Even VPN clients block non-VPN connectivity.
- Buge 9y agoWhat do you mean the FBI's NIT used basically the same thing? Do you have a source?
- mirimir 9y agoWhat I mean is that it pwns users by bypassing Tor, and reporting their ISP-assigned IP addresses. I'm not arguing that the methods for doing that are similar. [edited for coherence]
- anonymous5133 9y agoAgree completely. If you are running a TOR service/browser you should at least have an option to block all data that wants to move outside of TOR. Imo, the option should be enabled by default. It is better to have a "broken" service rather than risk leaking the real IP. If I recall correctly, wasn't silkroad and alphabay compromised by such a flaw? silkroad leaked the server IP through the captcha and I think something similar for alphabay.
- saurik 9y ago"Critical Tor flaw leaks users’ real IP address" This is not a problem with Tor: this is a problem with the Tor Browser (and even then, only on macOS and Linux: users on Windows are not affected)... I'd recommend changing the title as this otherwise sounds like some extremely concerning flaw in the platform itself, which this attack is not targeting.
- mirimir 9y agoThat's a good point, and the title ought to be "... Tor browser ...". Still, for the vast majority of Tor users, Tor is Tor browser. However, most of them use Windows, and weren't affected. So maybe "... OSX/Linux Tor browser ...".
- captainmuon 9y agoThe Tor project itself muddles the distinction. If you go to their website and click "download", you get the Tor Browser. They actively encourage people to only use Tor Browser and not roll their own (because your browser requests would look different and you would be trackable). The "only way" (without contortions) to get Tor without the bundle is via linux package manager.
- saurik 9y agoI know a bunch of people who use Tor in various ways that does not in any way involve a browser at all, and the ramifications of an attack at these two levels (in the routing stack vs. in the app layer) are very different. I appreciate why Ars Technica's headline is what it is, but this is Hacker News.
- captainmuon 9y agoYeah, you're right. This would be one of the cases where it makes sense to change the title.
- sillysaurus3 9y agoIf anyone is wondering how the attack works, here's a guess: file://../../dev/tcp/74.125.225.19/80 That would also explain why it works on 'nix but not windows. (This is probably mistaken, but the attack might be something along those lines.) Hmm... Anyone have a link to the hotfix diff? We could just look rather than guess.
- JoshTriplett 9y ago/dev/tcp doesn't exist on the filesystem, only in bash, and only if enabled; some distributions like Debian disable it.
- gnu8 9y agoI can imagine why that would be useful, but that seems like a fundamentally misguided feature. The shell is a key partner in the Unix philosophy of small programs that do a particular thing. The maintainers of bash should have known better than to add this. What does /dev/tcp add to bash, other than security vulnerabilities, that couldn't be better accomplished with wget, curl, netcat, or similar programs external to bash?
- sillysaurus3 9y agoYeah, it was a wild guess. I just looked over all the new bug tracker entries in Tor since Oct 28th, but none of them seem particularly critical. Our best bet would be to look at Firefox's commit history since the 28th. One crafty way to determine the exploit would be to bindiff the hotfix'd firefox binary vs the previous release and examine the diffs in a disassembler to see what code changed. Non-deterministic builds make that tricky, but it's a neat technique to be aware of.
- qeternity 9y agoIsn't this pretty standard practice?
- sillysaurus3 9y ago
- captainmuon 9y agoAnd this is why I usually run Tor as a transparent proxy, and put the browser in a VM. All traffic from the VM is forced through Tor via iptables. One downside is that you no longer look like all the other users that are using TorBrowser. But I value non-identifiability (that they can't get to my real identity) more than non-trackability.
- CodesInChaos 9y agoYou could use whonix. That way you get a similar VM based setup and look like all the other whonix users.
- mirimir 9y agoThis is truly such an obvious exploit, given well-acknowledged risks of opening files downloaded via Tor browser. I'm quite embarrassed that I didn't think of it. And I'm pretty sure that others have exploited it. But on reflection, this is actually excellent news. At least, for those of us who don't rely on Tor browser. That is, Tor users occasionally get pwned. And now there's less reason to suspect unreported vulnerabilities in Tor itself.
- kakarot 9y agoWith an implementation like Whonix, arguably the only safe and (relatively) easy way to use Tor, this exploit wouldn't have worked. The Tor Project's insistence on placing ease of use above security is admirable and understandable, but it provides a very false sense of security for the majority of users, to the point where it can potentially be detrimental. We sometimes take for granted our intelligence in this domain and forget that the average Tor user doesn't know shit about opsec. Just last week I found out a relative has been exploring Tor behind a VPN, and try as I may, I couldn't make them understand what a MitM attack was. They just read from a random page on the internet that it was safer to use a VPN and didn't bother doing research because frankly, how would they know what to look for?
- anonymous5133 9y agoMost security advice is always dumbed down like that. "Always do this" "always do that" without actually explaining why or the risks of doing it etc.
- mirimir 9y agoWell, I recommend using Tor through VPN services. I worry more about ISPs doing MitM than VPNs. You have far more choice about VPNs than ISPs. Governments can pressure local ISPs far more easily than VPN services, which may do business from uncooperative jurisdictions. And mostly, it's just that the VPN provides another level of IP obscurity. If an adversary compromises Tor somehow, and learns your VPN exit IP, there's at least a chance that they won't get your ISP-assigned IP. And if you use nested VPN chains, the adversary would need information from multiple VPN providers. It's the same logic behind three-relay Tor circuits.
- amluto 9y agoUgh. Linux has this shiny feature called network namespaces. Tor Browser should run in a network namespace such that it has no access to the Internet and doesn't know it's real IP address in the first place and therefore can't have this kind of leak barring a code execution attack and a sandbox break.
- mirimir 9y agoWhat's the advantage over just using iptables? -A OUTPUT -m owner --uid-owner [Tor uid] -j ACCEPT -A OUTPUT -j DROP
- dingaling 9y agouid-owner hasn't worked properly for a long time. gid-owner does but oftenbreaks for apps such as KDE programs which hand-off to kioslaves for networking. Network namespaces are much cleaner and can be created and destroyed without risk to other networking rules.
- mirimir 9y ago> uid-owner hasn't worked properly for a long time Please say more. Cites would help too.
- amluto 9y agoSo the browser itself doesn't know the IP. Then you don't have to worry about, say, a WebRTC bug leaking your IP. You also gain a considerable degree of protection from browser bugs in general. Also, using network namespaces doesn't require root.
- catern 9y agoUsing network namespaces does require root. User namespaces can give you something close enough to root to use network namespaces. But that only helps you if user namespaces are usable unprivileged, which they usually aren't, due to distro/sysadmin customization.
- rb666 9y agoLet us quickly catch all the pedos on there and then close the leak for good. Just this once...
- Tepix 9y agoThere is a similar old attack with file URLs: Redirect-to-SMB (https://blog.cylance.com/redirect-to-smb https://blog.cylance.com/redirect-to-smb). The fix is to block outbound SMB connections in your router.