6 ms·

FBI exploits vulnerabilities in old versions of TorBrowser. Solution: only run latest version of TorBrowser. Did I parse the article correctly?

comex 12y ago
FBI has, in one case where the exploit was spotted and made public (and they probably knew it would be, since it was deployed so widely), exploited an out-of-date version of TorBrowser. No guarantee that they don't use zero-days elsewhere or won't in the future. This is why I think TorBrowser should switch to Chromium. Whatever you have to say about Google, Chromium is unambiguously more secure than Firefox.
- jordigh 12y ago
  Unambiguously? This seems like a strong statement. What makes you say that?
  - aaron42net 12y ago
    Until Firefox tightens their sandbox, I believe any exploit can still use system calls to directly create TCP sockets. Chrome forces sandboxed processes to use its network stack; if that's been configured to use Tor, it shouldn't end up revealing your IP and therefore identity.
  - Niten 12y ago
    comex's statement is correct. Chrome/Chromium was designed from the ground up for fine-grained sandboxing of renderers and extensions; Firefox's single-process design currently prevents it from implementing any similar layered defense. Mozilla acknowledges as much with the mission statement of their Electrolysis project: https://wiki.mozilla.org/Electrolysis https://wiki.mozilla.org/Electrolysis Hopefully Firefox's situation will improve in the near future—at the very least, we'll all benefit if Chrome has a viable competitor. But in the meantime Firefox absolutely is behind Chrome in the security department.
- wtallis 12y ago
  If you actually care about security and privacy, then there are plenty of Firefox extensions that go far beyond what can be done with Chromium. Even just adding NoScript to Firefox closes whatever gap still exists. (Aside from the process-per-tab model, what's Chromium got out of the box that Firefox still lacks?)
  - debux 12y ago
    NoScript equivalent for Chrome is "HTTP Switchboard"
    - wtallis 12y ago
      Only superficially, and even then, they're not really equivalent. HTTP Switchboard has some blocking features that NoScript users need to use things like AdBlock Plus and RequestPolicy to get. NoScript's features aside from script and plugin blocking are completely beyond the scope of HTTP Switchboard, and some of them are completely unique to NoScript.
    - finnn 12y ago
      Hardly, but chrome does has an option to disable Javascript on a per site basis, similar to NoScript.
  - coderzach 12y ago
    Sandboxed processes. There are limits to what code running in chrome can do. AFAIK firefox provides no such guarantees.
    - Freaky 12y ago
      Firefox is moving in that direction at least: https://wiki.mozilla.org/Electrolysis https://wiki.mozilla.org/Electrolysis
  - comex 12y ago
    It's certainly true that using NoScript prevents most browser exploits (though not all), and that if you're strongly concerned about privacy, you should use it. And make sure not to disable it for any trusted darknet sites, since as this article reminds, they have a habit of being compromised... I'm not trying to be sarcastic - this is totally reasonable for many use cases. But the default browser bundle leaves JavaScript enabled by default for good reasons[1], and if you want higher security with JavaScript enabled and/or against non-JS exploits, Chrome's process sandbox is a big deal, and will probably keep it significantly more secure than Firefox for a good amount of time.
- dublinben 12y ago
  The TorBrowserBundle is based on Firefox ESR. This is a stable release with extended support for security patches. There is no equivalent for Chromium, which is essentially the unstable track of the Chrome browser.
- makomk 12y ago
  Unfortunately, quite a lot of browser changes are required to prevent information leaks when using Tor, and it's not clear that Chromium can feasibly be made suitable or where the developer time to do it would come from. (That's I think part of the reason TorBrowser is based on Firefox ESR - they can't keep up with the new features otherwise. I don't believe Chromium has equivalent extended-support releases; in order to get security fixes you have to upgrade to new versions with new features and new information leaks.) If you screw up and miss something, the FBI might not even need to exploit a bug in order to find users' IP addresses, they could just use documented browser features to get users to connect to their honeypot using their real IP addresses.
  - mike_hearn 12y ago
    This is an artifact of how Tor works. VPN services don't suffer from this issue because all traffic gets routed via the VPN at the operating system level.
    - makomk 12y ago
      Even then there's the issue of various browser and OS fingerprinting attacks which the current Tor Browser goes to significant effort to prevent. Tor actually supports a VPN-like mode, at least on Linux, but it can only protect against some classes of attack.
  - pcwalton 12y ago
    Right. I don't believe that process sandboxing would have prevented what the FBI wanted to do here: unmask the identities of Tor users. I would be surprised if compromising a renderer at the moment didn't give you access to enough information for law enforcement to figure out who was accessing the site. (See the list of current leaks on the Site Isolation description [1] just to name a few.) As a practical example, the FBI could slurp usernames and passwords from other sites the user has been to, then subpoena them to determine if they'd ever logged in without Tor, and so forth. [1]: http://www.chromium.org/developers/design-documents/site-isolation http://www.chromium.org/developers/design-documents/site-iso...
- RexRollman 12y ago
  I think they should consider opening a conversation with Mozilla and see what can be worked out.
higherpurpose 12y ago
Yes. It's also old news. The new news here is that FBI used regular warrants to infect everyone who visited a certain website with malware, which I think is inexcusable under the 4th amendment - and common sense.
- adestefan 12y ago
  That's debatable.
  - mike_hearn 12y ago
    Highly debatable. As pointed out in the comments of the article, the FBI would not require a special warrant to watch people going in and out of a crack house.
    - delucain 12y ago
      But this isn't watching them going in and out of a crack house. This is watching all their movements after going in and out of a crack house. Still debatable, but I think your analogy didn't show how broad the scope of this would be.
      - justizin 12y ago
        and possibly after pulling into the driveway of a crackhouse for a three-point turnaround.
- x0x0 12y ago
  If visiting the site itself is prima facie evidence of wrongdoing -- like child porn -- I disagree. In the case Silk Road, I agree: users could merely be motivated by curiosity and therefore browsing isn't on its face a crime.
  - centizen 12y ago
    What about misspelled domains? DNS Hijacking or Bit Errors? Hostile redirects from innocuous hacked domains? I'm not against using access as evidence, but there needs to be more context than a single attempt to access a domain.
Canada 12y ago
It's safe to assume such well funded attackers will use zero day. You could force all your traffic through Tor with a router. That way your compromised end point won't easily reveal your public IP. The attacker would be forced to generate some traffic they could fingerprint or use the microphone and camera to spy on you.
- x0x0 12y ago
  True, so don't engage in behavior like child porn worth burning a zero-day for.
  - CapitalistCartr 12y ago
    "Like - having the same characteristics or qualities as; similar to" Who decides what is worth compromising basic security and a zero-day? In the recent past, the US federal gov't has shown itself far more hostile to those who challenged them, or ratted on their actions than actual dangerous people. Is the "similar to" being a whistle-blower? Maybe being person who criticizes the policies of the gov't while being employed by it? If I trusted my gov't to restrain itself to child pornographers and actual threats to the country (not government, country), I'd sleep easier.
    - csandreasen 12y ago
      Who decides what is worth compromising basic security and a zero-day? Ultimately, lawmakers and the people who elected them. Additionally, elected presidents and the people who elect them, as well as the court system.
      - coldtea 12y ago
        I don't think that's how modern democracy works, if it works at all. Direct democracy in 4 b.C Athens, maybe.
        csandreasen 12y ago
sp332 12y ago
Unfortunately, the solution is: never find out that you used any version of TorBrowser when the FBI was exploiting it. After all, the vulnerability existed back when that version was the "latest version."

comex 12y ago

FBI has, in one case where the exploit was spotted and made public (and they probably knew it would be, since it was deployed so widely), exploited an out-of-date version of TorBrowser. No guarantee that they don't use zero-days elsewhere or won't in the future. This is why I think TorBrowser should switch to Chromium. Whatever you have to say about Google, Chromium is unambiguously more secure than Firefox.

jordigh 12y ago
Unambiguously? This seems like a strong statement. What makes you say that?
- aaron42net 12y ago
  Until Firefox tightens their sandbox, I believe any exploit can still use system calls to directly create TCP sockets. Chrome forces sandboxed processes to use its network stack; if that's been configured to use Tor, it shouldn't end up revealing your IP and therefore identity.
- Niten 12y ago
  comex's statement is correct. Chrome/Chromium was designed from the ground up for fine-grained sandboxing of renderers and extensions; Firefox's single-process design currently prevents it from implementing any similar layered defense. Mozilla acknowledges as much with the mission statement of their Electrolysis project: https://wiki.mozilla.org/Electrolysis https://wiki.mozilla.org/Electrolysis Hopefully Firefox's situation will improve in the near future—at the very least, we'll all benefit if Chrome has a viable competitor. But in the meantime Firefox absolutely is behind Chrome in the security department.
wtallis 12y ago
If you actually care about security and privacy, then there are plenty of Firefox extensions that go far beyond what can be done with Chromium. Even just adding NoScript to Firefox closes whatever gap still exists. (Aside from the process-per-tab model, what's Chromium got out of the box that Firefox still lacks?)
- debux 12y ago
  NoScript equivalent for Chrome is "HTTP Switchboard"
  - wtallis 12y ago
    Only superficially, and even then, they're not really equivalent. HTTP Switchboard has some blocking features that NoScript users need to use things like AdBlock Plus and RequestPolicy to get. NoScript's features aside from script and plugin blocking are completely beyond the scope of HTTP Switchboard, and some of them are completely unique to NoScript.
  - finnn 12y ago
    Hardly, but chrome does has an option to disable Javascript on a per site basis, similar to NoScript.
- coderzach 12y ago
  Sandboxed processes. There are limits to what code running in chrome can do. AFAIK firefox provides no such guarantees.
  - Freaky 12y ago
    Firefox is moving in that direction at least: https://wiki.mozilla.org/Electrolysis https://wiki.mozilla.org/Electrolysis
- comex 12y ago
  It's certainly true that using NoScript prevents most browser exploits (though not all), and that if you're strongly concerned about privacy, you should use it. And make sure not to disable it for any trusted darknet sites, since as this article reminds, they have a habit of being compromised... I'm not trying to be sarcastic - this is totally reasonable for many use cases. But the default browser bundle leaves JavaScript enabled by default for good reasons[1], and if you want higher security with JavaScript enabled and/or against non-JS exploits, Chrome's process sandbox is a big deal, and will probably keep it significantly more secure than Firefox for a good amount of time.
dublinben 12y ago
The TorBrowserBundle is based on Firefox ESR. This is a stable release with extended support for security patches. There is no equivalent for Chromium, which is essentially the unstable track of the Chrome browser.
makomk 12y ago
Unfortunately, quite a lot of browser changes are required to prevent information leaks when using Tor, and it's not clear that Chromium can feasibly be made suitable or where the developer time to do it would come from. (That's I think part of the reason TorBrowser is based on Firefox ESR - they can't keep up with the new features otherwise. I don't believe Chromium has equivalent extended-support releases; in order to get security fixes you have to upgrade to new versions with new features and new information leaks.) If you screw up and miss something, the FBI might not even need to exploit a bug in order to find users' IP addresses, they could just use documented browser features to get users to connect to their honeypot using their real IP addresses.
- mike_hearn 12y ago
  This is an artifact of how Tor works. VPN services don't suffer from this issue because all traffic gets routed via the VPN at the operating system level.
  - makomk 12y ago
    Even then there's the issue of various browser and OS fingerprinting attacks which the current Tor Browser goes to significant effort to prevent. Tor actually supports a VPN-like mode, at least on Linux, but it can only protect against some classes of attack.
- pcwalton 12y ago
  Right. I don't believe that process sandboxing would have prevented what the FBI wanted to do here: unmask the identities of Tor users. I would be surprised if compromising a renderer at the moment didn't give you access to enough information for law enforcement to figure out who was accessing the site. (See the list of current leaks on the Site Isolation description [1] just to name a few.) As a practical example, the FBI could slurp usernames and passwords from other sites the user has been to, then subpoena them to determine if they'd ever logged in without Tor, and so forth. [1]: http://www.chromium.org/developers/design-documents/site-isolation http://www.chromium.org/developers/design-documents/site-iso...
RexRollman 12y ago
I think they should consider opening a conversation with Mozilla and see what can be worked out.

higherpurpose 12y ago

Yes. It's also old news. The new news here is that FBI used regular warrants to infect everyone who visited a certain website with malware, which I think is inexcusable under the 4th amendment - and common sense.

adestefan 12y ago
That's debatable.
- mike_hearn 12y ago
  Highly debatable. As pointed out in the comments of the article, the FBI would not require a special warrant to watch people going in and out of a crack house.
  - delucain 12y ago
    But this isn't watching them going in and out of a crack house. This is watching all their movements after going in and out of a crack house. Still debatable, but I think your analogy didn't show how broad the scope of this would be.
    - justizin 12y ago
      and possibly after pulling into the driveway of a crackhouse for a three-point turnaround.
x0x0 12y ago
If visiting the site itself is prima facie evidence of wrongdoing -- like child porn -- I disagree. In the case Silk Road, I agree: users could merely be motivated by curiosity and therefore browsing isn't on its face a crime.
- centizen 12y ago
  What about misspelled domains? DNS Hijacking or Bit Errors? Hostile redirects from innocuous hacked domains? I'm not against using access as evidence, but there needs to be more context than a single attempt to access a domain.

Canada 12y ago

It's safe to assume such well funded attackers will use zero day. You could force all your traffic through Tor with a router. That way your compromised end point won't easily reveal your public IP. The attacker would be forced to generate some traffic they could fingerprint or use the microphone and camera to spy on you.

x0x0 12y ago
True, so don't engage in behavior like child porn worth burning a zero-day for.
- CapitalistCartr 12y ago
  "Like - having the same characteristics or qualities as; similar to" Who decides what is worth compromising basic security and a zero-day? In the recent past, the US federal gov't has shown itself far more hostile to those who challenged them, or ratted on their actions than actual dangerous people. Is the "similar to" being a whistle-blower? Maybe being person who criticizes the policies of the gov't while being employed by it? If I trusted my gov't to restrain itself to child pornographers and actual threats to the country (not government, country), I'd sleep easier.
  - csandreasen 12y ago
    Who decides what is worth compromising basic security and a zero-day? Ultimately, lawmakers and the people who elected them. Additionally, elected presidents and the people who elect them, as well as the court system.
    - coldtea 12y ago
      I don't think that's how modern democracy works, if it works at all. Direct democracy in 4 b.C Athens, maybe.
      - csandreasen 12y ago

sp332 12y ago

Unfortunately, the solution is: never find out that you used any version of TorBrowser when the FBI was exploiting it. After all, the vulnerability existed back when that version was the "latest version."