Hacker News Reader

Comment by jedanbik | Hacker News Reader

FBI exploits vulnerabilities in old versions of TorBrowser. Solution: only run latest version of TorBrowser.

Did I parse the article correctly?

It's safe to assume such well funded attackers will use zero day.

You could force all your traffic through Tor with a router. That way your compromised end point won't easily reveal your public IP. The attacker would be forced to generate some traffic they could fingerprint or use the microphone and camera to spy on you.

True, so don't engage in behavior like child porn worth burning a zero-day for.

"Like - having the same characteristics or qualities as; similar to"

Who decides what is worth compromising basic security and a zero-day? In the recent past, the US federal gov't has shown itself far more hostile to those who challenged them, or ratted on their actions than actual dangerous people. Is the "similar to" being a whistle-blower? Maybe being person who criticizes the policies of the gov't while being employed by it? If I trusted my gov't to restrain itself to child pornographers and actual threats to the country (not government, country), I'd sleep easier.

Who decides what is worth compromising basic security and a zero-day?

Ultimately, lawmakers and the people who elected them. Additionally, elected presidents and the people who elect them, as well as the court system.

I don't think that's how modern democracy works, if it works at all. Direct democracy in 4 b.C Athens, maybe.

It's a slow system with a lot of flaws, but ultimately if Congress were to pass a law saying who the FBI could or could not use a 0-day against, they'd be legally bound to comply. Ditto for presidential directives. If you're arrested as a result evidence acquired through use of a 0-day, you can make an argument in court if you really think you have a compelling case.

There's a whole lot of little details that make these easier or harder under certain circumstances, but none of these are impossible, especially if you have popular support for your cause.

If you don't like the way something works, you can talk to your congressmen, vote, support organizations that promote your cause, etc. Just complaining on the internet won't change much.

Unfortunately, not everything "worth burning a zero-day" to some misguided government agent is as clear cut of an activity to categorize as child porn.

Obviously, I mean, it's fine if the government just walks into your house once a week for inspection because, pff, what have you got to hide?

Yeah, so many fails. First they failed to use Whonix or similar separation which forces all traffic to go only through tor. Secondly you shouldn't ever mess with, normal (daily use), secure (secret / confidential), and anonymous (no identifying information what so ever) systems. All of those should be completely separate, as deep as hardware level, preferably with individual Internet connections. For secure systems it's good idea to use separation with extremely limited connectivity (rs-serial cable in my case), it's enough to pass ASCII armored pgp messages. AS well for anonymous systems you'll use prepaid data with burner phone and also replace hardware from time to time. You'll also boot the system from read only media, so when ever you'll reset it, it'll be clean again. But if you're lazy and don't care, it's easy to fail. If you use your normal system for all three settings, the results will probably be pretty bad. Also always check signatures, without signature(s) checking it's trivial to give you version which contains well, what ever.

Yes. It's also old news. The new news here is that FBI used regular warrants to infect everyone who visited a certain website with malware, which I think is inexcusable under the 4th amendment - and common sense.

That's debatable.

Highly debatable. As pointed out in the comments of the article, the FBI would not require a special warrant to watch people going in and out of a crack house.

But this isn't watching them going in and out of a crack house. This is watching all their movements after going in and out of a crack house. Still debatable, but I think your analogy didn't show how broad the scope of this would be.

and possibly after pulling into the driveway of a crackhouse for a three-point turnaround.

If visiting the site itself is prima facie evidence of wrongdoing -- like child porn -- I disagree. In the case Silk Road, I agree: users could merely be motivated by curiosity and therefore browsing isn't on its face a crime.

What about misspelled domains? DNS Hijacking or Bit Errors? Hostile redirects from innocuous hacked domains? I'm not against using access as evidence, but there needs to be more context than a single attempt to access a domain.

Unfortunately, the solution is: never find out that you used any version of TorBrowser when the FBI was exploiting it. After all, the vulnerability existed back when that version was the "latest version."

FBI has, in one case where the exploit was spotted and made public (and they probably knew it would be, since it was deployed so widely), exploited an out-of-date version of TorBrowser. No guarantee that they don't use zero-days elsewhere or won't in the future.

This is why I think TorBrowser should switch to Chromium. Whatever you have to say about Google, Chromium is unambiguously more secure than Firefox.

Unambiguously? This seems like a strong statement. What makes you say that?

Until Firefox tightens their sandbox, I believe any exploit can still use system calls to directly create TCP sockets.

Chrome forces sandboxed processes to use its network stack; if that's been configured to use Tor, it shouldn't end up revealing your IP and therefore identity.

comex's statement is correct. Chrome/Chromium was designed from the ground up for fine-grained sandboxing of renderers and extensions; Firefox's single-process design currently prevents it from implementing any similar layered defense.

Mozilla acknowledges as much with the mission statement of their Electrolysis project:

https://wiki.mozilla.org/Electrolysis

Hopefully Firefox's situation will improve in the near future—at the very least, we'll all benefit if Chrome has a viable competitor. But in the meantime Firefox absolutely is behind Chrome in the security department.

If you actually care about security and privacy, then there are plenty of Firefox extensions that go far beyond what can be done with Chromium. Even just adding NoScript to Firefox closes whatever gap still exists.

(Aside from the process-per-tab model, what's Chromium got out of the box that Firefox still lacks?)

NoScript equivalent for Chrome is "HTTP Switchboard"

Only superficially, and even then, they're not really equivalent. HTTP Switchboard has some blocking features that NoScript users need to use things like AdBlock Plus and RequestPolicy to get. NoScript's features aside from script and plugin blocking are completely beyond the scope of HTTP Switchboard, and some of them are completely unique to NoScript.

Hardly, but chrome does has an option to disable Javascript on a per site basis, similar to NoScript.

Sandboxed processes. There are limits to what code running in chrome can do. AFAIK firefox provides no such guarantees.

Firefox is moving in that direction at least: https://wiki.mozilla.org/Electrolysis

It's certainly true that using NoScript prevents most browser exploits (though not all), and that if you're strongly concerned about privacy, you should use it. And make sure not to disable it for any trusted darknet sites, since as this article reminds, they have a habit of being compromised... I'm not trying to be sarcastic - this is totally reasonable for many use cases.

But the default browser bundle leaves JavaScript enabled by default for good reasons[1], and if you want higher security with JavaScript enabled and/or against non-JS exploits, Chrome's process sandbox is a big deal, and will probably keep it significantly more secure than Firefox for a good amount of time.

The TorBrowserBundle is based on Firefox ESR. This is a stable release with extended support for security patches. There is no equivalent for Chromium, which is essentially the unstable track of the Chrome browser.

Unfortunately, quite a lot of browser changes are required to prevent information leaks when using Tor, and it's not clear that Chromium can feasibly be made suitable or where the developer time to do it would come from. (That's I think part of the reason TorBrowser is based on Firefox ESR - they can't keep up with the new features otherwise. I don't believe Chromium has equivalent extended-support releases; in order to get security fixes you have to upgrade to new versions with new features and new information leaks.)

If you screw up and miss something, the FBI might not even need to exploit a bug in order to find users' IP addresses, they could just use documented browser features to get users to connect to their honeypot using their real IP addresses.

This is an artifact of how Tor works. VPN services don't suffer from this issue because all traffic gets routed via the VPN at the operating system level.

Even then there's the issue of various browser and OS fingerprinting attacks which the current Tor Browser goes to significant effort to prevent. Tor actually supports a VPN-like mode, at least on Linux, but it can only protect against some classes of attack.

Right. I don't believe that process sandboxing would have prevented what the FBI wanted to do here: unmask the identities of Tor users. I would be surprised if compromising a renderer at the moment didn't give you access to enough information for law enforcement to figure out who was accessing the site. (See the list of current leaks on the Site Isolation description [1] just to name a few.)

As a practical example, the FBI could slurp usernames and passwords from other sites the user has been to, then subpoena them to determine if they'd ever logged in without Tor, and so forth.

[1]: http://www.chromium.org/developers/design-documents/site-iso...

I think they should consider opening a conversation with Mozilla and see what can be worked out.

Reply on news.ycombinator.com