9 ms·

Exploit vendor drops Tor Browser zero-day on Twitter

116 points by rauhl 8y ago

driverdan 8y ago
I'm surprised no one is discussing how unethical Zerodium is. Selling undisclosed vulnerabilities to the government for a tool designed to protect users from government oppression is about as unethical as you can be.
- djsumdog 8y ago
  It's pretty common practice. I was at a panel discussion at Ruxcon 2012 where selling exploits was brought up. Ranty Ben talked about selling exploits was how he made a living. The original/official upload of the panel discussion use to be here, but it's been taken down since. :( https://www.youtube.com/watch?v=xlJ1DQdjVHM https://www.youtube.com/watch?v=xlJ1DQdjVHM
  - deleted 8y ago
    [deleted]
  - deleted 8y ago
    [deleted]
- gizmo385 8y ago
  Can you really call TOR a tool to "protect users from government oppression" when the project itself is majority-funded by the US Department of Defense?
  - skygazer 8y ago
    Indeed you can, so long as you assume governments (and countries) aren't fungible.
  - brokensegue 8y ago
    i thought it was the state dept?
  - valarauca1 8y ago
    Yes you can. You just need to accept that the US Government's agenda of regime change in Vietnam, China, Iran, Cuba, Egypt, Venezuela, North Korea, Belarus, Russia, Ukraine, and Turkey is the correct course of action of the continuing development of international human rights. Also it helps to ignore any chance that there could a majority of the population who sees their government's action as necessary, just, or even acceptable. They're simply wrong and uninformed due to the oppression of their government. Western European liberal capitalist representative democracy is the only successful government which stands the test of time, we have nearly 200 years of data to support this, every other model by comparison simply doesn't work.
    - EthanHeilman 8y ago
      >You just need to accept that the US Government's agenda of regime change in Vietnam, China, Iran, Cuba, Egypt, Venezuela, North Korea, Belarus, Russia, Ukraine, and Turkey is the correct course of action I would like to see some citations that the US is pursuing regime change in Vietnam, Egypt and Ukraine. The US is a direct supporter of both the Egyptian and Ukrainian governments and on fairly decent terms with the government of Vietnam. >Also it helps to ignore any chance that there could a majority of the population who sees their government's action as necessary, just, or even acceptable. They're simply wrong and uninformed due to the oppression of their government. How do you gauge the support for censorship within non-democracies like North Korea especially when opposition to censorship may be brutally punished? I'm not saying that the population of North Korea is anti-censorship, I don't know what they believe. I'm curious how you arrived at the conclusion that they are pro-censorship.
      - valarauca1 8y ago
        To your first point. The goal of TOR is to subvert local attempts to control internet access. Generally this takes the form of censoring pro-western internet views as the internet in its more open access form the internet is a product of the western hegemony and its filled with praises for the western hegemony's polices and its propaganda. Attempts made by Governments to censor the external internet, and attempts made by those outside of the government cannot escape the political elements of their actions. The goal is either the preservation of the current regime, or the change/overthrow of the regime/party/structure all political actions boil down this. In light of these facts. The diplomatic relationships effectively serve as a short term tools, while projects like TOR are long term tools. The former exists for PR, and making concrete treaties. The later exists for building political divisions over longer periods of time which can trigger national instability and crises. See: Arab Spring. How do you gauge the support for censorship within non democracies like North Korea especially when opposition to censorship may be brutally punished? DPRK regularly has multi-party elections so I think we could gauge how the people vote?
- tedunangst 8y ago
  What would the discussion look like, besides finger wagging and hand wringing? Is there something interesting to be said?
- mr_overalls 8y ago
  I agree with you, but I suppose I'm just unsurprised by what shady things people and companies will do for money.
laken 8y ago
Wow, that's quite the vulnerability. Several years ago, the FBI used JS-based identification scripts on an entire hidden-service hosting service to identify visitors. https://www.wired.com/2013/09/freedom-hosting-fbi/ https://www.wired.com/2013/09/freedom-hosting-fbi/ I wonder if it's already being used in the wild by governmental agencies.
- otriv 8y ago
  The article says: > This Tor Browser exploit was acquired by Zerodium many months ago as a zero-day and was shared with our government customers. It's a possibility that it has been used. I'm not sure if a government would buy an exploit and not use it before it's patched, unless they couldn't find any use for it. This exploit is different than the one the FBI used on the child porn site though. They'd need to combine it with something that can bypass the Tor Browser's socks5 setting. It would be a much bigger deal if they had an exploit that could do that.
  - tgragnato 8y ago
    The bounty was specifically targeting Tor Browser on Tails and/or Windows 10. This vulnerability affects the security settings at high, so the payouts were 185k for cross platform RCE, and 250k for cross platform RCE+LPE. > We've launched back in December 2017 a specific and time-limited bug bounty for Tor Browser and we've received and acquired, during and after the bounty, many Tor exploits meeting our requirements If we have to take their words for granted, "many exploits" probably means they have a LPE too. And when you escalate, you are able to bypass both SOCKS5 and Tails' firewall.
  - djsumdog 8y ago
    > This exploit is different than the one the FBI used on the child porn site though I was wondering if this was related to the Playpen case. I thought the FBI refused to release any information on that (and subsequently charged were dropped against several of the people they arrested). Who has discovered with was the Tor Brower's socks5 setting?
- deleted 8y ago
  [deleted]
jermaustin1 8y ago
Is it ever valid/legal to accept multiple content-types like this? Or is this a regression bug that was introduced?
- deathanatos 8y ago
  This isn't even "multiple content-types", the value is just malformed. The ";" would normally introduce parameters to the content-type, such as in "text/plain; charset=utf-8". Here, "/json" is just garbage. It isn't allowed to have multiple content-types. (And it would make no sense.)
  - jermaustin1 8y ago
    My thought was for a "mixed media" like multi-part form data. Maybe the response would be text/plain; text/json (or shortened because the first one is text/plain to just /json). I will do mental gymnastics to try and figure out if something was meant to be a certain way or not.
Tepix 8y ago
Woah! I'm wondering - is this a side effect from disabling JavaScript using NoScript instead of using the "javascript:enabled" flag in about:config ? Also, what's a good way to capture all HTTP traffic (after decryption) to find/analyze exploits like this being used against me?
kodablah 8y ago
Hrmm, can execute JS in FF's JSON viewer it seems. Still even with JS available there are more steps required to deanonymize. > This Tor Browser exploit was acquired by Zerodium many months ago as a zero-day and was shared with our government customers Of course it was. The surface area of browser tech is just so large. We need a subset of html+css and a browser that only renders that with a really simple implementation (plus side, low bandwidth and terminal friendly). Not a full browser with features conditionally disabled. I haven't put enough thought into client-side scriptability so I'd punt on it for now, but I did put thought into other parts the other day [0]. Many onion services don't want all the features of the modern web anyways. The TBB can still exist for users of full sites of course. 0 - https://github.com/cretz/software-ideas/issues/92 https://github.com/cretz/software-ideas/issues/92
- Eridrus 8y ago
  I don't know why people are focusing on deanonymization here, once you can run JS, they can just run one of the dozen Firefox 0days they are stockpiling. If your threat profile involves governments targeting you, this bug is critical, more so than the code execution exploits because these bugs are rarer.
- pcwalton 8y ago
  There's no need to go that far. Just do what Mozilla already did for legacy addons: kill them.
  - kodablah 8y ago
    For this issue and for JS execution maybe. But there are so many features in modern browsers that the cat-and-mouse game of waiting for vulns to know you've hit all of the places for fingerprinting and other deanon is untenable. Couple that with extensions TBB bundles by default, e.g. https everywhere, and the surface area is even larger. TBB has value for general browsing, but secure browsing needs to be by document format as much as implementation. Right now, the only reasonable option for onion services is to have their site browsed via the large, feature-rich bundle. Unfortunately, it requires a good bit of funding to build a document browsing platform of any size so I definitely understand the current practical approach.
motohagiography 8y ago
The incentives to develop Tor exploits, target Tor users, and the attack surface of the browser could seem to make using it at all an exercise of poor judgement. You basically add some anonymity but change your threat model to include an extremely high likelihood of injection attacks, and practically provoke every state level agency to monitor you, where they might have previously ignored you. This was the pgp problem in the 90s where you would essentially be sending a tracer round across the network saying, "hey everyone, these two people are using encryption!" Tor is a great effort and it gets people involved in privacy, but onion routing to exit nodes on the internet has diminishing efficacy, and I think everyone needs a clearer articulation of what and whose problem it solves.
- yjftsjthsd-h 8y ago
  Disagree: Exploits in the browser bundle would affect stock Firefox or bypass security measure not present in stock. NSA monitors all traffic anyways; they certainly don't ignore normal users.
  - dagenix 8y ago
    > NSA monitors all traffic Source for this claim? I don't doubt they monitor what they can - but the sheer volume of internet traffic makes it unlikely that they are able to monitor everything and instead must target specific things to monitor. They have a lot of money and a lot of smart people, but they don't have wizard magic.
    - polshaw 8y ago
      The UK was doing a full take of every packet in 2013, the US are definitely able to. https://en.wikipedia.org/wiki/Tempora https://en.wikipedia.org/wiki/Tempora >The Guardian claims that no distinction is made in the gathering of data between public citizens and targeted suspects.
      - stordoff 8y ago
        After going through volume reduction, so maybe not _strictly_ every packet: > The processing centres apply a series of sophisticated computer programmes in order to filter the material through what is known as MVR – massive volume reduction. The first filter immediately rejects high-volume, low-value traffic, such as peer-to-peer downloads, which reduces the volume by about 30%. They have access, but it isn't necessarily analysed or kept.
TACIXAT 8y ago
Speculation: Zerodium has an 8.x RCE and burns the 7.x noscript bypass to get users to the new version. Added bonus of publicity.
- legatus 8y ago
  That's an interesting explanation. "We have decided to disclose this exploit as it has reached its end-of-life and it's not affecting Tor Browser version 8 which was released last week. We also wanted to raise awareness about the lack (or insufficient) security auditing of major components bundled by default with Tor Browser and trusted by millions of users." is the explanation provided by Zerodium. End of life? Raise awareness? Sounds like shitty PR to me... There must be other explanations. Anyone has any idea, beyond the one already provided above?
  - emerongi 8y ago
    Maybe there's a slight chance that they just want to undermine Tor and make people question its security. But honestly, the parent's idea seems quite likely.
    - rav 8y ago
      If they're in the business of buying and selling Tor browser zero-days, I'd think they shouldn't be undermining the adoption of the Tor browser...?
      - emerongi 8y ago
        Some agency might want to do that. Could have just paid Zerodium to make such a strong statement.
        loa-in-backup 8y ago
        Cheaper than decrypting and mitm-ing all this traffic. Scare ordinary people away, more likely it is to random pick a valid target
yeloboy 8y ago
Strip the javascript engine out of the Tor browser, it has no reason to be there. It beats the purpose of using Tor if you're gonna allow Javascript to run. It'd be much easier to just strip it all out, despite breaking site support in the process. Especially since Tor is usually used to access hidden services instead of the clearnet.
- evilpie 8y ago
  Firefox doesn't work without a JavaScript engine.
  - flatiron 8y ago
    what about just toggling javascript.enabled ?
    - tmpaccount823 8y ago
      I can confirm that setting javascript.enabled to false would have prevented that bug in older versions. I've always thought that the highest security setting would set it to false on its own, but apparently it does not.
- pcwalton 8y ago
  All that has to happen to fix this vulnerability is to remove support for legacy addons—which is what Firefox Quantum already did. The old addon system made it far too easy to make catastrophic mistakes like this. Web Extensions, which are an API that was actually designed with security in mind, constitute a huge security improvement.
- throwaway2048 8y ago
  A tor browser that isn't usable means people don't use it.
- crtasm 8y ago
  > Especially since Tor is usually used to access hidden services instead of the clearnet. My assumption is the opposite but I have no data to cite here, is it even possible to tell?
pcwalton 8y ago
An important takeaway from this is that legacy addons in Firefox were dangerous. The API was too large and powerful for most developers to use safely. Web Extensions were designed with security in mind and are much safer as a result.

116 points by rauhl 8y ago

I'm surprised no one is discussing how unethical Zerodium is. Selling undisclosed vulnerabilities to the government for a tool designed to protect users from government oppression is about as unethical as you can be.

djsumdog 8y ago
It's pretty common practice. I was at a panel discussion at Ruxcon 2012 where selling exploits was brought up. Ranty Ben talked about selling exploits was how he made a living. The original/official upload of the panel discussion use to be here, but it's been taken down since. :( https://www.youtube.com/watch?v=xlJ1DQdjVHM https://www.youtube.com/watch?v=xlJ1DQdjVHM
- deleted 8y ago
  [deleted]
- deleted 8y ago
  [deleted]
gizmo385 8y ago
Can you really call TOR a tool to "protect users from government oppression" when the project itself is majority-funded by the US Department of Defense?
- skygazer 8y ago
  Indeed you can, so long as you assume governments (and countries) aren't fungible.
- brokensegue 8y ago
  i thought it was the state dept?
- valarauca1 8y ago
  Yes you can. You just need to accept that the US Government's agenda of regime change in Vietnam, China, Iran, Cuba, Egypt, Venezuela, North Korea, Belarus, Russia, Ukraine, and Turkey is the correct course of action of the continuing development of international human rights. Also it helps to ignore any chance that there could a majority of the population who sees their government's action as necessary, just, or even acceptable. They're simply wrong and uninformed due to the oppression of their government. Western European liberal capitalist representative democracy is the only successful government which stands the test of time, we have nearly 200 years of data to support this, every other model by comparison simply doesn't work.
  - EthanHeilman 8y ago
    >You just need to accept that the US Government's agenda of regime change in Vietnam, China, Iran, Cuba, Egypt, Venezuela, North Korea, Belarus, Russia, Ukraine, and Turkey is the correct course of action I would like to see some citations that the US is pursuing regime change in Vietnam, Egypt and Ukraine. The US is a direct supporter of both the Egyptian and Ukrainian governments and on fairly decent terms with the government of Vietnam. >Also it helps to ignore any chance that there could a majority of the population who sees their government's action as necessary, just, or even acceptable. They're simply wrong and uninformed due to the oppression of their government. How do you gauge the support for censorship within non-democracies like North Korea especially when opposition to censorship may be brutally punished? I'm not saying that the population of North Korea is anti-censorship, I don't know what they believe. I'm curious how you arrived at the conclusion that they are pro-censorship.
    - valarauca1 8y ago
      To your first point. The goal of TOR is to subvert local attempts to control internet access. Generally this takes the form of censoring pro-western internet views as the internet in its more open access form the internet is a product of the western hegemony and its filled with praises for the western hegemony's polices and its propaganda. Attempts made by Governments to censor the external internet, and attempts made by those outside of the government cannot escape the political elements of their actions. The goal is either the preservation of the current regime, or the change/overthrow of the regime/party/structure all political actions boil down this. In light of these facts. The diplomatic relationships effectively serve as a short term tools, while projects like TOR are long term tools. The former exists for PR, and making concrete treaties. The later exists for building political divisions over longer periods of time which can trigger national instability and crises. See: Arab Spring. How do you gauge the support for censorship within non democracies like North Korea especially when opposition to censorship may be brutally punished? DPRK regularly has multi-party elections so I think we could gauge how the people vote?
tedunangst 8y ago
What would the discussion look like, besides finger wagging and hand wringing? Is there something interesting to be said?
mr_overalls 8y ago
I agree with you, but I suppose I'm just unsurprised by what shady things people and companies will do for money.

laken 8y ago

Wow, that's quite the vulnerability. Several years ago, the FBI used JS-based identification scripts on an entire hidden-service hosting service to identify visitors. https://www.wired.com/2013/09/freedom-hosting-fbi/ https://www.wired.com/2013/09/freedom-hosting-fbi/ I wonder if it's already being used in the wild by governmental agencies.

otriv 8y ago
The article says: > This Tor Browser exploit was acquired by Zerodium many months ago as a zero-day and was shared with our government customers. It's a possibility that it has been used. I'm not sure if a government would buy an exploit and not use it before it's patched, unless they couldn't find any use for it. This exploit is different than the one the FBI used on the child porn site though. They'd need to combine it with something that can bypass the Tor Browser's socks5 setting. It would be a much bigger deal if they had an exploit that could do that.
- tgragnato 8y ago
  The bounty was specifically targeting Tor Browser on Tails and/or Windows 10. This vulnerability affects the security settings at high, so the payouts were 185k for cross platform RCE, and 250k for cross platform RCE+LPE. > We've launched back in December 2017 a specific and time-limited bug bounty for Tor Browser and we've received and acquired, during and after the bounty, many Tor exploits meeting our requirements If we have to take their words for granted, "many exploits" probably means they have a LPE too. And when you escalate, you are able to bypass both SOCKS5 and Tails' firewall.
- djsumdog 8y ago
  > This exploit is different than the one the FBI used on the child porn site though I was wondering if this was related to the Playpen case. I thought the FBI refused to release any information on that (and subsequently charged were dropped against several of the people they arrested). Who has discovered with was the Tor Brower's socks5 setting?
deleted 8y ago
[deleted]

jermaustin1 8y ago

Is it ever valid/legal to accept multiple content-types like this? Or is this a regression bug that was introduced?

deathanatos 8y ago
This isn't even "multiple content-types", the value is just malformed. The ";" would normally introduce parameters to the content-type, such as in "text/plain; charset=utf-8". Here, "/json" is just garbage. It isn't allowed to have multiple content-types. (And it would make no sense.)
- jermaustin1 8y ago
  My thought was for a "mixed media" like multi-part form data. Maybe the response would be text/plain; text/json (or shortened because the first one is text/plain to just /json). I will do mental gymnastics to try and figure out if something was meant to be a certain way or not.

Tepix 8y ago

Woah! I'm wondering - is this a side effect from disabling JavaScript using NoScript instead of using the "javascript:enabled" flag in about:config ? Also, what's a good way to capture all HTTP traffic (after decryption) to find/analyze exploits like this being used against me?

kodablah 8y ago

Hrmm, can execute JS in FF's JSON viewer it seems. Still even with JS available there are more steps required to deanonymize. > This Tor Browser exploit was acquired by Zerodium many months ago as a zero-day and was shared with our government customers Of course it was. The surface area of browser tech is just so large. We need a subset of html+css and a browser that only renders that with a really simple implementation (plus side, low bandwidth and terminal friendly). Not a full browser with features conditionally disabled. I haven't put enough thought into client-side scriptability so I'd punt on it for now, but I did put thought into other parts the other day [0]. Many onion services don't want all the features of the modern web anyways. The TBB can still exist for users of full sites of course. 0 - https://github.com/cretz/software-ideas/issues/92 https://github.com/cretz/software-ideas/issues/92

Eridrus 8y ago
I don't know why people are focusing on deanonymization here, once you can run JS, they can just run one of the dozen Firefox 0days they are stockpiling. If your threat profile involves governments targeting you, this bug is critical, more so than the code execution exploits because these bugs are rarer.
pcwalton 8y ago
There's no need to go that far. Just do what Mozilla already did for legacy addons: kill them.
- kodablah 8y ago
  For this issue and for JS execution maybe. But there are so many features in modern browsers that the cat-and-mouse game of waiting for vulns to know you've hit all of the places for fingerprinting and other deanon is untenable. Couple that with extensions TBB bundles by default, e.g. https everywhere, and the surface area is even larger. TBB has value for general browsing, but secure browsing needs to be by document format as much as implementation. Right now, the only reasonable option for onion services is to have their site browsed via the large, feature-rich bundle. Unfortunately, it requires a good bit of funding to build a document browsing platform of any size so I definitely understand the current practical approach.

motohagiography 8y ago

The incentives to develop Tor exploits, target Tor users, and the attack surface of the browser could seem to make using it at all an exercise of poor judgement. You basically add some anonymity but change your threat model to include an extremely high likelihood of injection attacks, and practically provoke every state level agency to monitor you, where they might have previously ignored you. This was the pgp problem in the 90s where you would essentially be sending a tracer round across the network saying, "hey everyone, these two people are using encryption!" Tor is a great effort and it gets people involved in privacy, but onion routing to exit nodes on the internet has diminishing efficacy, and I think everyone needs a clearer articulation of what and whose problem it solves.

yjftsjthsd-h 8y ago
Disagree: Exploits in the browser bundle would affect stock Firefox or bypass security measure not present in stock. NSA monitors all traffic anyways; they certainly don't ignore normal users.
- dagenix 8y ago
  > NSA monitors all traffic Source for this claim? I don't doubt they monitor what they can - but the sheer volume of internet traffic makes it unlikely that they are able to monitor everything and instead must target specific things to monitor. They have a lot of money and a lot of smart people, but they don't have wizard magic.
  - polshaw 8y ago
    The UK was doing a full take of every packet in 2013, the US are definitely able to. https://en.wikipedia.org/wiki/Tempora https://en.wikipedia.org/wiki/Tempora >The Guardian claims that no distinction is made in the gathering of data between public citizens and targeted suspects.
    - stordoff 8y ago
      After going through volume reduction, so maybe not _strictly_ every packet: > The processing centres apply a series of sophisticated computer programmes in order to filter the material through what is known as MVR – massive volume reduction. The first filter immediately rejects high-volume, low-value traffic, such as peer-to-peer downloads, which reduces the volume by about 30%. They have access, but it isn't necessarily analysed or kept.

TACIXAT 8y ago

Speculation: Zerodium has an 8.x RCE and burns the 7.x noscript bypass to get users to the new version. Added bonus of publicity.

legatus 8y ago
That's an interesting explanation. "We have decided to disclose this exploit as it has reached its end-of-life and it's not affecting Tor Browser version 8 which was released last week. We also wanted to raise awareness about the lack (or insufficient) security auditing of major components bundled by default with Tor Browser and trusted by millions of users." is the explanation provided by Zerodium. End of life? Raise awareness? Sounds like shitty PR to me... There must be other explanations. Anyone has any idea, beyond the one already provided above?
- emerongi 8y ago
  Maybe there's a slight chance that they just want to undermine Tor and make people question its security. But honestly, the parent's idea seems quite likely.
  - rav 8y ago
    If they're in the business of buying and selling Tor browser zero-days, I'd think they shouldn't be undermining the adoption of the Tor browser...?
    - emerongi 8y ago
      Some agency might want to do that. Could have just paid Zerodium to make such a strong statement.
      - loa-in-backup 8y ago
        Cheaper than decrypting and mitm-ing all this traffic. Scare ordinary people away, more likely it is to random pick a valid target

yeloboy 8y ago

Strip the javascript engine out of the Tor browser, it has no reason to be there. It beats the purpose of using Tor if you're gonna allow Javascript to run. It'd be much easier to just strip it all out, despite breaking site support in the process. Especially since Tor is usually used to access hidden services instead of the clearnet.

evilpie 8y ago
Firefox doesn't work without a JavaScript engine.
- flatiron 8y ago
  what about just toggling javascript.enabled ?
  - tmpaccount823 8y ago
    I can confirm that setting javascript.enabled to false would have prevented that bug in older versions. I've always thought that the highest security setting would set it to false on its own, but apparently it does not.
pcwalton 8y ago
All that has to happen to fix this vulnerability is to remove support for legacy addons—which is what Firefox Quantum already did. The old addon system made it far too easy to make catastrophic mistakes like this. Web Extensions, which are an API that was actually designed with security in mind, constitute a huge security improvement.
throwaway2048 8y ago
A tor browser that isn't usable means people don't use it.
crtasm 8y ago
> Especially since Tor is usually used to access hidden services instead of the clearnet. My assumption is the opposite but I have no data to cite here, is it even possible to tell?

pcwalton 8y ago

An important takeaway from this is that legacy addons in Firefox were dangerous. The API was too large and powerful for most developers to use safely. Web Extensions were designed with security in mind and are much safer as a result.