Tor security advisory: Old Tor Browser Bundles vulnerable

Beauty depends on the

Beauty depends on the specific woman, as it does at any age, and also involves who she is as a person. Since I'm much older I see a 14-year-old as a kid without any real life experience. As my wife ages I still find her very attractive. She isn't 90 yet but I think I'll feel the same then.

Men age like wine. Women age

Men age like wine.
Women age like milk.

I have to agree with this.

I have to agree with this. Not only are jailbait girls typically at the peak of their sexual attraction, but the feeling of doing something so illegal is very addictive as well. It reminds me of being young looking at porn for the first part of my life, trying to hide it from my parents. Something forbidden and secret but so attractive and good feeling. I think the forbidden aspect is half the fun with jailbait, but most surely it is not all of it because I do find actual child pornography to be very disgusting and would not look at it even though it is also forbidden. Peak sexual attraction, plus bringing the rush back to pornography....a very addictive combination.

you are both right, yet i

you are both right, yet i (being young adult) don't think i will live enough to see this being acknowledged by the "masses" not even mentioning the lawmakers.
Internet "pedophiles" - no matter if they fap to toddlers being gang raped or pictures of topless 16 year olds - are way to convenient scapegoats for powers that be, who can gain political capital and sympathy points literally out of nothing by cracking down on internet CP, instead of helping children that are actually being abused (which would require much more effort and $$, but won't make any big headlines)

Also censorship. Whenever you want to impose some restrictions on internet-users, just do it "for the children" and accuse your opponents of supporting pedophilia. Works like a charm.

posting this over tor because FBI lol

Scapegoat is the right thing

Scapegoat is the right thing to called pedophiles/pedosexuals (I feel the latter is more true) in the real world. The whole anti-pedosexual thing started when homosexuals were beginning to be accepted by society, as the new 'boogie man' for society created by feminists/religious leaders who hate that learning that sex is a wonderful and pleasurable thing early is the biggest buster of their bunkus in the world.

"The love between men and

"The love between men and boys is at the foundation of homosexuality. For the gay community to imply that boy-love is not homosexual love is ridiculous." - "No Place for Homo-Homophobia.", San Francisco Sentinel, March 26, 1992

"Shame on us if our lesbian/gay voices remain silent while our
NAMBLA brothers are persecuted once again, and shame on those
lesbians and gay men who will raise their voices to condemn NAMBLA,
insisting that boy lovers (and presumably the boys they love and who
love them) are not part of this thing called the lesbian/gay
community."
- Steve Hanson, "Shame on Us.", Bay Area Reporter, January 23, 1992

"NAMBLA is by no means on the fringe of the "gay rights" movement. For years, it was a member in good standing of the International Lesbian and Gay Association (ILGA), and was only jettisoned by ILGA when the parent organization applied for United Nations consultative status in 1993. Years earlier, the ILGA itself had resolved that "Young people have the right to sexual and social self-determination and that age of consent laws often operate to oppress and not to protect." "
- http://www.lifeissues.net/writers/clo/clo_09homosexuality.html

Note that the "love" being referred-to in the above quotes is little more than an Orwellian euphemism for the buggering and sodomizing of tender youth by adult males.

(This is particularly disturbing when one considers the distinct physical as well as psychological disadvantage that the *receptive* partner in anal penetration is placed at: The bulk of the considerable risk of deadly infection as well as injury, ALL of the pain, discomfort and inconvenience that are endemic to this act, etc. )

you are both right, yet i

you are both right, yet i (being young adult) don't think i will live enough to see this being acknowledged by the "masses" not even mentioning the lawmakers.
Internet "pedophiles" - no matter if they fap to toddlers being gang raped or pictures of topless 16 year olds - are way to convenient scapegoats for powers that be, who can gain political capital and sympathy points literally out of nothing by cracking down on internet CP, instead of helping children that are actually being abused (which would require much more effort and $$, but won't make any big headlines)

Also censorship. Whenever you want to impose some restrictions on internet-users, just do it "for the children" and accuse your opponents of supporting pedophilia. Works like a charm.

posting this over tor because FBI lol

I as young adult find that

I as young adult find that young adults like jailbait and old ass adults think it is horrible. Hardly any of my IRL male friends have not made comments about being attracted to under 18 year old teenagers, many of my internet friends who know about Tor have said they have looked at jailbait on it. But for most old people they seem to think it is totally horrible. Total disconnection between age groups, the same as it is for drugs.

If you are innocently

If you are innocently looking at girls your own age, why do you have to do it on the TOR browser??? makes no sense.
Most of us old ass people have children and idiots like you are a threat to them, when you grow up and have children of your own, only then will you understand.
Please stick to the normal web where you can happily watch naked 18yr olds and not young teens who are being exploited, used and abused for your own selfish needs.

"Internet "pedophiles" - no

"Internet "pedophiles" - no matter if they fap to toddlers being gang raped or pictures of topless 16 year olds - are way to convenient scapegoats for powers that be, who can gain political capital and sympathy points literally out of nothing by cracking down on internet CP, instead of helping children that are actually being abused (which would require much more effort and $$, but won't make any big headlines)"

You raise some valid points that are worthy, if not /requiring/, of consideration and discussion.

Nonetheless:
1.) Wouldn't you say that working to /prevent/ abuse from occurring in the first place is no less important than helping the victims of abuse?

2.) Wouldn't you say that an individual who derives /pleasure/ from images/descriptions/fantasies of the likes of "toddlers being gang raped" is considerably more likely to pose a threat to society than the average or typical random individual? (Considering that the vast, overwhelming majority of the population-at-large in just about any society finds such imagery nothing less than utterly repugnant, revolting, repulsive and deeply disturbing.)

3.) Accepting the premises outlined in #s 1 and 2 above, wouldn't you say that society has a legitimate interest-- if not /duty/-- in at least /flagging/ and /monitoring/ anyone who exhibits solid, convincing evidence of having an unhealthy interest in the type of imagery in question?

4.) This is not to say that the /MERE viewing/ or possessing of /images/--of /any sort/-- should, in and of itself, carry criminal penalties.

1.The problem is, is it

1.The problem is, is it really *scientifically* proven that watching CP facilitates child abuse, (comparable to what they call a "gateway drug", meaning first you watch pictures of 10 yo models in bikinis than you need stronger kick, you switch to harder and harder sex scenes, until just watching doesn't do it for you any longer and you go lure some real kids into your van). Or does it help people who might have those urges, relief them without acting upon them? Your first point seems to be built upon the first assumption, however if the 2nd is true, then what they are doing is not even wasting time/money, but using them to facilitate what they should be actually trying to prevent, since less CP = more people having sex with real kids. (btw. I'm talking about an absolute minority here that would actually act upon their sexual fantasies, I doubt they constitute a large percentage of people watching CP. Just like there are a lot of people into rape/rough sex, but only few of them would/do actually rape)

2. Well he might be. Same as with somebody who watches gore-videos or even Dexter. It's a very difficult question, that can't be properly addressed at our current lvl of technological development. Regardless of that what you are talking about here is thought crime. Just imagine US-government (or any government for that matter) being able to prosecute or even "flag" people for what they think. Imagine all sorts of power abuse that would then happen. And it would be even worse once they actually had the technology to read your thoughts. (and what the vast majority thinks shouldn't even matter, you know what vast majority of people thought/ and in many parts of the world still thinks about homosexuals.)

3. Only if it's proven beyond a doubt that those people would actually act upon their urges. Otherwise we are talking of pre-crime, minority report kind of situations, where innocent people potentially suffer consequences of actions they didn't do. And proving something like that beyond a doubt (i guess we are talking about preventive measures here, if somebody already raped a child and you have evidences, it's an easy game) is not feasible with our technology anyway. But even if it would be, we should really think about if it's worth the trade-offs (see 2nd point). Basically it's the same security vs freedom debate, but with stakes set very high. It was always possible (at least in theory) for people living in dictatorships to keep at least their thoughts free and overthrow the tyrants when the time was right. Open the powers that be the way into your thoughts and there will be no escape.

4. Agree.

1. It is scientifically

1. It is scientifically proven that in all countries that legalize possession and viewing of child porn, there is a sharp drop in child molestation rates, in every single country ever studied

http://phys.org/news/2010-11-legalizing-child-pornography-linked-sex.ht…

Results from the Czech Republic showed, as seen everywhere else studied (Canada, Croatia, Denmark, Germany, Finland, Hong Kong, Shanghai, Sweden, USA), that rape and other sex crimes have not increased following the legalization and wide availability of pornography. And most significantly, the incidence of child sex abuse has fallen considerably since 1989, when child pornography became readily accessible – a phenomenon also seen in Denmark and Japan. Their findings are published online today in Springer's journal Archives of Sexual Behavior.

http://www.wnyc.org/shows/bl/

http://www.wnyc.org/shows/bl/2013/aug/21/crime-online/

Above commentator and some others here may wish to post there. No registration required, only valid email (try disposable).

Especially to respond to comments like this:
"The reason we punish those that possess and traffic is because they are now more than in the past the consumers that drive the creation of the child porn."

In agreement with you A lot

In agreement with you

A lot of people have failed to recognise that the pedo's are providing a service for the watchers, a child is being abused for their viewing and it will continue as long as they watch. I am cringing at the comments that looking at pictures isn't harmful?? are some of you really that dumb? of course its fucking harmful, its a child, abuse damages lives, its against their will and human rights. Too many Pedo's on here.

For the stupid person 2 above saying that the rates of rape and molestation have gone down ,you know why that is?? I can tell you, its online that's why and you watchers are keeping it alive.

[Citation Needed] [Multiple

[Citation Needed]
[Multiple Citations Needed]

this attack has nothing at

this attack has nothing at all to do with CP or JB.

If not nothing, very little, I do believe that this is an example of the weakest exploit in their bag of tricks and they didn't much care that it was exposed as there will be new exploits aimed at de-anonyimizing TOR users.

I believe the feds are after the Darknet drug markets much more than CP. Feds foam at the mouth over Drug users and need to keep the Genocide against drug users going(it's not a war on drugs. only users and a war implies two sides fighting which is not the case) to keep the money flowing and prisons filled and CO's employed and on and on and on!!

It's about adults using drugs. :-(

Re-posting an apropos

Re-posting an apropos post.
______
Re: "drug sites":

-What about, for example, chemotherapy patients, many of whom are dying anyway?
Would you deny them the little respite and relief they claim that marijuana provides them?

Current drug policy in many places does just that, leaving such people-- in misery-- with no alternative but the very "black markets" that you refer-to.

- Alcohol is a DRUG that is at least as deadly and claims at least as many lives as any number of substances that don't enjoy the blessings of the law and social acceptance.

What about "taking down" some of the (legal, sanctioned, privileged) mega corporations that promote, glamorize and glorify this poison?

Re: "money laundering": Can whatever Tor may facilitate in this regard even hold a candle to the likes of the Wall Street banksters or even (or especially) the Federal Reserve, the World Bank, etc., et al?

Not that two wrongs make a right but perspective is needed.

And the prison-industrial complex; the ways in which a number of entities directly benefit from a drug policy that results in mass incarceration is an absolutely critical aspect that cannot be overlooked in any discussion of these matters.

Of course it doesn't, the

Of course it doesn't, the pentagon are one of the biggest fan of CP.

Pentagon declined to investigate hundreds of purchases of child pornography
http://news.yahoo.com/blogs/upshot/pentagon-declined-investigate-hundre…

Why Was Pentagon Child Pornography Investigation Halted
http://www.thesleuthjournal.com/why-was-pentagon-child-pornography-inve…

Pentagon workers found to have downloaded child pornography
Dozens of staff and contractors with high-level security clearance put at risk of blackmail by their sex crimes
http://www.theguardian.com/world/2010/jul/24/pentagon-us-staff-download…

A typical post from a

A typical post from a typical Tor user. "I do no wrong but I am so proficient in CP and JB[1] and know who exploits who etc" purely for educational purposes lol

[1] I can guess what CP is but JB? You are guys are really experts in this stuff. I am sorry you were hacked ;)

Yay free speech and all, but

Yay free speech and all, but yeah, no kidding.

That said, I don't think this little sub-thread counts as typical Tor users. Or said another way, the larger and broader the Tor user base gets, the less relevant this little subset is.

So arma you think it should

So arma you think it should be illegal for people to look at some pictures?

JB is jailbait and means

JB is jailbait and means naked pictures of people about 13 and older

Stay on topic, please.

The very fact that something

The very fact that something is taboo gives it a certain lure.

Stolen water is sweet. Forbidden fruit and all that.

Entrapment? Where did the

Entrapment?

Where did the Tor Project so much as even /encourage/ visting the type of sites that you CHOSE to visit?

Oh, I forgot, that's all

Oh, I forgot, that's all besides the fact that you were running an OUTDATED, DEPRECATED version of TBB that had been replaced over a month ago!

Does running TBB from a

Does running TBB from a Windows based VM protect the host machine MAC address? Only the randomly generated VM MAC could be revealed by this exploit?

Maybe? It seems like a step

Maybe? It seems like a step in the right direction.

So nobody has any idea if

So nobody has any idea if users of versions lower than 17 are affected, like version 10 for example, because nobody knows what was in content1_html. Why is that not mentioned in the article or in any articles for that matter? Why is this not investigated? There could have been another exploit, different from this one in that page, one that still works in the latest version.

javascript is the real

javascript is the real issue. Yeah, it would be great if the exploit only works on v17 (for those using older versions), but if you had javascript disabled, probably doesn't matter which version one used. More data is needed.

See the list of Mozilla

See the list of Mozilla advisories, linked in the Tor advisory:
https://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html

All the ones in red are bad news. And most of the ones in red came out after Firefox 10 was abandoned.

I think most are concerned

I think most are concerned with this specific exploit on non-TBB FF versions under v17.

Nobody cares about outdated

Nobody cares about outdated software. Do you use Win95/98?
Be uptodate!

Not to be paranoid but how

Not to be paranoid but how do we not know that old Tor versions are safe and the new versions are actually planted with back doors ?

Well, you know that older

Well, you know that older Tor versions aren't safe: we give you detailed release notes for all stable releases:
https://gitweb.torproject.org/tor.git/blob/HEAD:/ReleaseNotes

As for whether newer versions have backdoors, see for example
https://www.torproject.org/docs/faq#Backdoor
https://blog.torproject.org/blog/calea-2-and-tor
for some discussion of why it would be unwise for us to put backdoors in.

And if you want to be extra careful (besides reading all the source code of course), check out Mike's recent work on deterministic builds:
https://gitweb.torproject.org/builders/tor-browser-bundle.git/blob/HEAD…

It's open source, Get the

It's open source, Get the code. Read it for yourself and see what it's doing. Reproduce the build environment and build it on your own machine.

If you don't know how to do any of that, learn.

The biggest threat to anonymity and online safety is ignorance,

Have /you/ carefully checked

Have /you/ carefully checked through all of the code for all of the software that you use?

Are you even sure that, should there be anything suspicious in the code, that you would recognize it?

Browser versions less than

Browser versions less than 17 WERE exploited by this. It checks the version and if less than 17 redirects to content_1.html. Does anybody know the contents of that file?

Exactly, there is a lot of

Exactly, there is a lot of misinformation being spread on all official channels. Every expert review I've read so far specifically talks about version 17 being the only one targeted and affected. But that is clearly not the case if you read the code. Versions 0-16 inclusive are subjected to content_1 payload.

content_1, that nobody has seen so far, could have calls to content_4, 5, 6.. and do a lot more than just report the IP. I wonder why it was never obtained? And why is every news source trying to hide it's existence? Can it not be obtained the same way content_2 and 3 was?

Let us know as you learn

Let us know as you learn more!

If my browser was safe but I

If my browser was safe but I had a separate instance of FF open elsewhere, can the malicious javascript bleed through and phone home to the FBI from there?

Can Javascript jump from one open browser to another or is that off the table?

- Just seeking clarification on all of the possibilities and I promise I'm only asking this once! -

In a correctly behaving

In a correctly behaving browser, Javascript shouldn't be able to jump between browsers.

In a vulnerable browser, somebody could have written an exploit to take over your computer, and from there it could mess with any other running (or not yet running) applications.

Since malicious client side

Since malicious client side scripts have no direct access to the underlying filesystem or OS of the client, they can not be transmitted across browsers.

However, if you have malicious bookmarks or addons installed and voluntarily transfer them, perhaps in ignorance, then the other browser is also vulnerable.

And it depends if "malicious scripts installed" are at an OS level, or at a browser level. If something infects your OS, any application is vulnerable.

So, with a older version of

So, with a older version of TBB with javascript disabled and ex on linux, a user would not be affected by this?

Correct. (But you should

Correct.

(But you should upgrade anyway!)

"ex on linux" ex?>

"ex on linux"

ex?>

Did the TBB notify on the

Did the TBB notify on the start page of an update if you where running Firefox ESR 17.0.6 when 17.0.7 was released?

Yes. Or more specifically,

Yes. Or more specifically, it notified you once a new TBB was released, and that TBB included Firefox 17.0.7.

Any knowledge as to whether

Any knowledge as to whether EMET would have prevented the exploit from running? Nobody has talked about this but the enhanced mitigation features are useful under Windows and should be common practice.

Good question. Does Firefox

Good question. Does Firefox build with it?

Does App Armor come in here

Does App Armor come in here at all?

Is the TOR browser from June

Is the TOR browser from June 23 safe?

Depends what version it is.

Would the exploit affect

Would the exploit affect Unix-based operating systems or just windows?

For this exploit, just

For this exploit, just Windows.

But you should stay up-to-date on other platforms too.

i have to repeat the same

i have to repeat the same message as a follower above:
on 30 july or 1st august i received this message as a sub-bar:

In order to implement a crucial fix, this update resets your HTTPS Everywhere rule preferences to their default values

what does it mean i shoulb be worried? it seems i use 1.7.6 version but with javascript off. the rest of browser is on default mode. did that "crucial fix" something wrong? it is known for sure that only javascript ON affected people and nothing else?

Did that bar pop up when you

Did that bar pop up when you visited a know infected site? Or was it randomly some other time?

People know it affected us through Javascript, because specifically it was a Javascript attack when visiting those sites. Events happened in the order of

1. Visit infected site
2. Malicious Javascript code awaits you, it attempts to launch!
3. Blocked/Detected/Affected

Not sure about the crucial fix playing out on this stage. Seems unrelated.

hey. i really cant remember

hey. i really cant remember when that subbar shows up, if i tried to access a site or suddenly doing other thing. certainly is this was in tor, not in mozilla because i use chrome for clearnet. i had c/p that message on google and i can only find it on twitter on a enginner computer guy. it amaze me that this nobody else noticed than fellow above. it has appeared absolutely the same it was rerwritten by me now. does tor ever sent subbars like that?
thing is i did nothing on that because i didnt even know what was happening at that moment, nobody knows. 30 or 1 aug. very strage.

all i want to know if this was sent from TOR or because of this exploit. and if is because of malware, i should be calm using 17.6 at that moment with javascript off and a pretty old TBB(2-3 months)? i am very "lucky" day by day.. it seems legit why almost only me received that....

No, I saw the same message a

No, I saw the same message a couple of days ago and I was prodding around FH to see what was going on but noscript was always on. Thing is, I updated my TBB today to 17.0.7 and the message reappeared after the second launch of TBB. It says "to implement a crucial fix https has reset to default rules" or similar. This is 64bit linux.

A few days ago I also had

A few days ago I also had this bar showing up. IIRC it was displayed as soon as the browser started and visited the check.torproject.org page. I also made screenshots of this event.

Quoting the poster before

Quoting the poster before me: all i want to know if this was sent from TOR or because of this exploit. and if is because of malware....

That is what I wish to know too. Was the message "In order to implement a crucial fix, this update resets your HTTPS Everywhere rule preferences to their default values" sent by Tor?

I was using the latest version of TBB at the time when I received the above "crucial fix" message but with JavaScript enabled.

What I did next was to delete the TBB, re-downloaded the TBB from Tor's official website and re-launched the Tor browser.

I also ran a complete scan of my PC using the latest anti-virus software.

For Tor developers and people who are interested in investigating further whether the website has been infected with the JavaScript exploit, please surf to http://sammyboy.com

That is the website that forced my Tor browser to reset HTTPS Everywhere set of rules.

I am the first person who

I am the first person who posted the "HTTPS Everywhere" crucial fix message.

In answer to your questions:

1. Did that bar pop up when you visited a know infected site? Or was it randomly some other time? I am unable to answer this question as there is no way for me to tell whether the site that gave me the "crucial fix" error has been infected or not.

2. At the time I received the "crucial fix" message, I was already using the latest version of TBB but with JavaScript enabled.

im paranoic i please OP to

im paranoic i please OP to respond. was this message from tor browser or tricky scheme of infected sites i visited?
eearly this year i made $16 each donations on every service i love which is ad block, umusic and tor. i didnt expected this coming!!! please respond to my inquierii

I read that the sub-bar was

I read that the sub-bar was one of the indicators that the exploit had been run on your browser. Sorry, you might want to nuke your hard drives :(

Where exactly did you read

Where exactly did you read that? Could you provide the links?

Sounds like nonsense.

Why not make an official

Why not make an official post reassuring people about the HTTPS-Everywhere pop-up in question. Many people, myself included, were/are obviously concerned. Wasn't that only reasonable and to be expected?

I'm using HTTPS everywhere

I'm using HTTPS everywhere on two another browsers (one on Windows and one on Fedora) which are not being used for tor browsing at all, and received the same message on both recently. Probably it was part of the last update of the extension.

I got that popup after

I got that popup after getting the newest TOR bundle today. I disabled JS and all the other things and did not visit the infected sites on this new bundle. It's most likely unrelated.

me too.. installed the new

me too.. installed the new bundle, disabled javascript, visited only hidden wiki and this blog. after system restart and opening tor i see the same message on my firefox.

I also saw this message pop

I also saw this message pop up. A little research reveals.

The latest tbb comes with HTTPS-Everywhere 3.2.2.
tbb has "update Add-ons automatically" selected by default so it gets updated to the latest version.

Latest version of HTTPS-Everywhere shows changes to code
https://gitweb.torproject.org/https-everywhere.git/blob/HEAD:/src/chrom…
In response to this ticket
https://trac.torproject.org/projects/tor/ticket/8776

It looks like this is normal behavior.

Yes.

I got this message too! Am

I got this message too! Am not sure i was visiting an FH site atm.

Was the update official or it was an attack? I even clicked it. I use FF 17.0.7 ESR on Win7 64bit.

As a translator of HTTPS

As a translator of HTTPS Everywhere, I have seen and translated that very string, so it is an official part of the HTTPS Everywhere extension. It is not related to any exploit. It is not put there by any website one visited.

Sorry if this has been asked

Sorry if this has been asked already, but I only downloaded the Tor Browser Bundle a few days ago, so I presume I had the latest browser version, 17.07. I just checked, and Javascript was enabled.
For non-Tor browsing, I use Firefox 22.0. Am I safe from this exploit?

We think so.

So my Kaspersky marked

So my Kaspersky marked malware in this file "C:\Documents and Settings\-name-\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22" and even labeled it "exploit, is this the same exploit?

Java? Sounds unrelated.

Would running Tails with

Would running Tails with Iceweasel 17.0.7 in VM within windows be safe from the attack as well?

I would say that is VERY safe

Yes. Even safer than on

Yes. Even safer than on normal Windows.

Anon: "Would running Tails

Anon: "Would running Tails with Iceweasel 17.0.7 in VM within windows be safe from the attack as well?"

arma: "Yes. Even safer than on normal Windows."

Huh? Run Tails on Windows? How is that even possible /other/ than within a VM?

For me it sounds like "safer

For me it sounds like "safer than use TBB on Windows".

NSA

NSA RESPONSIBLE:

http://arstechnica.com/tech-policy/2013/08/researchers-say-tor-targeted…

Not that I'm saying it's

Not that I'm saying it's wrong, but I'd like more details than "somebody knows somebody else who has some database that said this netblock was once the NSA's".

domaintools.com shows the

domaintools.com shows the exploiter's server IP (65.222.202.53) belongs to the government contractor SAIC. They do work with NSA but also many other government agencies (source: I used to work for them!). The link in that article to the robtex.com page (pop.robtex.com/nsa.gov.html#records) doesn't seem to include that IP. So I can't see how they know it's been "assigned" to NSA. But that it's linked to SAIC means it likely is some kind of U.S. government project.

When did the attack take

When did the attack take place? i.e. When did they start using the java exploit?

"java exploit" JavaSCRIPT

"java exploit"

JavaSCRIPT not Java!

Can Torproject please fix

Can Torproject please fix the check.torproject.org page that incorrectly informs users of 10.0.12 they are up to date? People who rely on that version check won't know to update.

Might this be a bug in

Might this be a bug in whatever ANCIENT, LONG-DEPRECATED version of TBB has Firefox 10.0.12 ?

I last used Tor in early

I last used Tor in early May, never did anything illegal but I probably visited a FH site if the whole 50% of the sites are hosted by FH is true. Have you got any ideas/guesses on a time frame for the attack?

Time frame was "a few days

Time frame was "a few days ago".

Also, the notion that half the hidden services were hosted by FH is likely bunk. Of course, they're hidden so it's hard to produce a concrete number.

Of all the sites hosted by

Of all the sites hosted by Freedom Hosting, how many were/are dedicated to scabrous material involving underage subjects?

bunk? In this case, I'd say

bunk?

In this case, I'd say it's more likely poppycock.

This TOR exploit thingy. It

This TOR exploit thingy. It supposedly gets your ip but what if you're on a home network behind a router? Will it grab the ip of your computer on that network, like 192.168.x.x?

It grabs your hostname (e.g.

It grabs your hostname (e.g. "John's PC"), your MAC address (the local hardware address), and then it sends those plus a unique number to the remote website. It's that last step where the attacker can learn your public IP address -- and where a firewall sure would be helpful, to block outgoing non-Tor connections (like how Tails does it).

The firewall wouldn't help

The firewall wouldn't help with this exploit, because the malicious assembly code executes within the TorBrowser process space (the firewall would think it's the tor browser and let it through).

There is no reason to let

There is no reason to let the Tor Browser process (or indeed, any process run by that user) speak to the Internet.

Is it another process

Is it another process (vidalia?) that actually makes the internet connection? If so, yes a firewall blocking tor browser outbound would be a really good idea. I was assuming Tor Browser itself makes the connection.

No, it's a program called

No, it's a program called Tor. You might have heard of it. :)

So to prevent future

So to prevent future exploits of this type, could torproject maybe show downloaders how to set the Windows firewall properly to block all outgoing connections (it allows all by default) except allow tor.exe and the user's other trusted programs? And mention if a window ever pops up to allow tbb-firefox.exe to connect outbound (i.e. some exploit is running) to always deny it? Users who understand that would pretty much be safe from any future exploits like this, I'd think.

Maybe? We're all bad with

Maybe? We're all bad with Windows, so it would be great if somebody would volunteer to work on this.

(The other answer is to run Tails in a VM on Windows, if you really need to be running Windows in the first place.)

Wait, how does it get your

Wait, how does it get your ip from the hostname, MAC and the unique number?

"and then it sends those

"and then it sends those [...] to the remote website. It's that last step where the attacker can learn your public IP address"

It sends them outside of TOR?

Yes. (Read the advisory.)

Hi, Once again sorry for

Hi,
Once again sorry for being redundant, but I thought I would ask a broader question hoping that it would answer a lot of questions.

If someone had Windows 7, Tor Browser Bundle 2.3.25.10 with Firefox 17.0.7 ESR, but NO SCRIPT set to "Allow ALL globally", would my Mac address and Ip address have been revealed by this "iFrame picture" exploit?

Also is the Mac address that is revealed, my MOTHERBOARD'S network jack address OR my internet service provider (ISP)'s Router modem?

Thanks

No, the exploit was fixed in

No, the exploit was fixed in 17.0.7. (And for those with earlier versions who were exploited, the MAC address would be your computer network adapter's).

17.0.7 means this exploit

17.0.7 means this exploit won't work, full stop.

As for which mac address, if I'm reading the exploit right, it is your first local address -- so if your Internet connection is through an ethernet connection on your motherboard, it's probably that.

One question .. I have the

One question .. I have the ESR version 17.0.7 I installed on June 26, but I dont have the alpha version 3, I have tor 0.2.3.25, and I visited pages of Freedom Host (With Javascript, Disabled Globally). yesterday i visited Tormail, and I saw the message "Sorry Close for maintenece" (with javascript Disabled globally) that means the exploit worked? or I am at risk? please Help - thanks in advance

You are totally safe. Cant

You are totally safe. Cant you read the information above???

People these days are really

People these days are really fascinating, they seem to work like this: Don't want to invest (time for reading) anything but want to get (a prompt personal answer on a silver dish) everything - I CAN HAS PLZ???

The vulnerability was fixed

The vulnerability was fixed in firefox 17.0.7 esr and you had javascript off anyway. So you are not at risk.

arma, thanks for all your

arma, thanks for all your updates and comments, even if it's "we don't know." Frequent communication is always good!

So if one had turned off

So if one had turned off javascript on ones pre v 17 browser, that would have stopped the exploit from executing?

Do we know 17.0.7 actually

Do we know 17.0.7 actually blocks this? Has somebody tested it against this particular exploit? I know as a programmer myself we like to indicate a bug is "fixed" but it really needs to be tested by others.

Yes -- see Dan's blog post:

Yes -- see Dan's blog post: https://blog.mozilla.org/security/2013/08/04/investigating-security-vul…

why people keep saying

why people keep saying Firefox ESR 17.0.7. is not effected

Firefox ESR 17.0.7 [3] is not effected notice the 3

The [3] is a note number

The [3] is a note number used on the Tor security advisory page.

Any law experts around?

Any law experts around? Assuming this illegal exploit worked, what could they do with the IP list? Is a couple random visits to FH sites (like, exploring hidden wiki links) enough to warrant raids? Just wondering what exactly was the purpose of this illegal exploit, because clearly not all affected are guilty, even if they did visit some of the illegal sites once or twice by mistake or due to curiosity. A raid on them would destroy their lives nevertheless.

Can this list be used against international citizens? Would international agencies accept tips obtained this way? How can the list of addresses be used as evidence, if external, malicious executable code ran on the target PC's, one could easily argue that a version of this code could entrap people by opening illegal sites in the TOR browser. The code did change multiple times, did it not? And parts of it are not yet obtained.

Isn't the entire premise of this attack - pointless? Apart from branding all TOR users as molesters in the news due to sensationalist titles of course, so that people stop using it and the NSA/CIA/FBI has an easier task to play the Big Brother on everyone.

I would also like this

I would also like this answered.

I am positive that this

I am positive that this exploit is a small part of an overarching federal project. The NSA are doing the fishing in order to be able to connect the dots at a later date. It is unlikely that raids will result from this particular attack, as this exploit involves thousands of fished IP's. They are looking for a couple hundreds of big fish, not thousands of small fish.

With respect to this

With respect to this PARTICULAR attack, is there any reason to think that it did not affect Windows computers running Firefox versions BELOW 17 ?

Thank you.

All versions under 17 were

All versions under 17 were in fact subjected to another piece of malicious code contained in a page called content_1.html. Apparently nobody knows what was in it, because it was never obtained. Because the code did not exit but loaded this page, one has to assume another version of this, or another exploit was indeed executed on Firefox versions below 17. Therefore all the news and security reports that specifically claim this attack targeted version 17 only, are wrong.

I use Request Policy with

I use Request Policy with TBB, while NoScript is run in default Global JS On mode. Would Request Policy block this attack?

Thanks

Good question, but I think

Good question, but I think maybe no, since it's being served from the domain you're visiting? Or maybe Request Policy handled iframes differently than the main page? Somebody would need to investigate.

For those of us just hearing

For those of us just hearing about Tor for the first time, help me understand this in non computer tech terms.....what span of time did this attack occur? And if someone used Tor Bundle on windows during this time frame but had that little S in the top left corner clicked so a circle with a line was through it, are they still at risk? Or did that turn off their script stuff? Sorry

Can anyone answer this?

The presumable owner of

The presumable owner of Freedom Host was arrested July 29th and the malicious code was first noticed on August 4th. If you have the little "S" with a red slash through it, it is blocking scripts from executing and you are highly unlikely to have been affected.

When 2.3.25-10 was released,

When 2.3.25-10 was released, were 2.3.25-9 browser bundles displaying that a update on TOR check within a time period of 1 week after the 10 release? I'm not very clear on this.

Erinn commited the change to

Erinn commited the change to the recommended-versions file on June 26:
https://lists.torproject.org/pipermail/tor-commits/2013-June/058867.html
and it would have gone live within about an hour:
https://check.torproject.org/RecommendedTBBVersions

Yes, but did the .9 version

Yes, but did the .9 version get taken OFF of the https://check.torproject.org/RecommendedTBBVersions list so that the update notification would have been displayed?

Yes. You can see that in the

Yes. You can see that in the diff I linked to.

How can you tell if the

How can you tell if the malicious software has been installed on your computer?

As far as we know, this

As far as we know, this exploit didn't install or modify anything. Read the advisory for details.

I have noticed quite a few

I have noticed quite a few write ups in the press that state that Tor's reputation is badly damaged and I regret to say I agree. While the TBB may have made it easier for people to use Tor (a good thing) it has also made Tor into one big honeypot. I don't think that prior to TBB a hack like this would have been worth the FBI's time because there were so many different set-ups that writing the exploit to catch a decent number of IPs would have been a nightmare. By standardizing entry to Tor TBB changed the payout for a hack and thus the risk/reward ratio for the hacker.

Really? I admit I'm still

Really? I admit I'm still not a huge fan of shipping a browser, but I think the alternative is clearly worse.

The situation before TBB was that Tor users had basically no chance to secure themselves against a wide array of known attacks at the browser level.

At least in this case we learned about the issue, and put out a patch that users could upgrade to, more than a month before it was exploited.

Take a look through
https://www.torproject.org/torbutton/en/design/index.html.en
and
https://www.torproject.org/projects/torbrowser/design/
and ask yourself if more than a very few of our users could have gotten things right on their own?

If we lived in a world where there existed a mainstream browser (Firefox, Chrome, Safari, IE, something) that actually addressed these application-level privacy attacks, I think this would be a worthwhile discussion to have. But see:
https://gitweb.torproject.org/torbrowser.git/tree/maint-2.4:/src/curren…
and
https://blog.torproject.org/blog/google-chrome-incognito-mode-tor-and-f…

And currently Firefox and Chrome don't care to accept the patches. That sure would be nice to fix.

https://twitter.com/BrendanEi

https://twitter.com/BrendanEich/status/364265592112414720

In any any event, you and I agree on the fundamentals. It's simply that prior to this hack the downsides of the TBB was mostly theoretical. Now they are real. To pretend that this doesn't impact of the psychology of the average (i.e, non-sophisticated) Tor user is to be in denial of reality.

While I think integrating FF and Tor would be an improvement it doesn't address the underlying problem: to whit, that a TBB enables unsophisticated users to get in over their heads. While one can argue that's their problem when I weigh the alternatives I do not see any of them as "clearly" superior. I see them as all equally bad.

I'm afraid you are wrong

I'm afraid you are wrong about 17.0.7 being "safe" from the NSA attack. I am, and have been, running it for some time now.

A few days ago I was prompted for both a JAVA and a Flash update ... which I allowed. (Probably Unrelated, Huh).

Coincidentally, I realized later that day, that 94% of all of the Onion Hidden Service Sites had simply disappeared ... Took an entire day but I checked EVERY single one.

Whatever it was has also Killed my Relay setup entirely ... I've had to uninstall IT and even Reinstall my "client-only" 17.0.7 just to get the god-damned thing to stop crashing.

Perhaps worse than that, every time I attempt to access certain of the now defunct .onion addresses, INCLUDING TOR MAIL ...TOR goes semi-transparent, turns white and CRASHES, with a burst of activity on the bandwidth graph and a warning that TOR is not responding and is no longer connected ... WTF ?!?!?! ... So now I suppose I have to wonder if the NSA Vaporware is STILL on my computer ???

NOT TO PUT TOO FINE A POINT ON THE THING .... BUT: Are you folks Idiots or just Morons ?

The GDMF#*&^%$*^$% NSA hasn't just attacked a few perverts, drug and porn sites ... They have launched a totally successful and MASSIVE STRIKE against our entire command, control and communications infrastructure. In case you haven't noticed, That's called WAR.

The Most Serious Disappearance is that of TORMAIL's hidden service at http://jhiwjjlqpyawmpjx.onion/ and it seems that

TOR MAIL IS GONE ... leaving about a squillion people with impending losses of BILLIONS of bucks, NO secure communications And wondering if "just maybe" they're suddenly on the fast track to a Fema Camp ... WHY, in the living hell isn't anyone talking about THAT !!! ??? ... and why in the living hell haven't YOU or someone ELSE put a backup TORMAIL SERVER in place ... and why isn't it UP RIGHT NOW ???

I really need you guys to STFU, quit with the polite "conversation" and DO SOMETHING ABOUT IT.

TemplarKnight@tormail.org ... Oh, that's right ... I don't exist anymore.

A) "94% of all of the Onion

A) "94% of all of the Onion Hidden Service Sites had simply disappeared" -- where is your statistic from? I guess you have some list that you think is the entirety of the Tor hidden service list, and not many of those are reachable for you? But at the same time, it sounds like your computer is broken in all sorts of ways? Sounds like you might want a reinstall, and maybe with a safer operating system.

B) "why [...] haven't YOU [...] put a backup TORMAIL SERVER in place" -- I am sorry to inform you that Tormail has nothing to do with Tor. They just took our name to try to trick people into thinking they were legitimate. And then they did a good enough job at never being reachable when we tried to contact them about it. We were exploring the process of asking ICANN to cancel their domain name, but 1) that's not very nice, and 2) it's not clear to me that it would really have done much anyway.

A) Computer is just fine and

A) Computer is just fine and I did a Reinstall of TOR and HTTPS Everywhere. and the problem went away.

YES, I went through SIX lists and I do realize that they did not encompass the entirety of the Onion HS sites, but I have been doing this for several months on a weekly basis and my estimate is fairly accurate.

B) YES, I know that TOR has nothing to do with TorMail ...However:

The fact of the matter is that TOR Mail did work well enough that it became the accepted standard for secure email communications in the world.

With the known death of Freedom Hosting and the catastrophic (and permanent) demise of Tor Mail, it is incumbent upon some TRUSTWORTHY organization to reincarnate Tor Mail as quickly as possible and there is no reason that TOR couldn't run it's own hidden service in this regard.

That Trustworthy organization ... MUST BE TOR ITSELF.

There is NO OTHER anonymous email service in existence that can take it's place and there is NO service provider OTHER THAN TOR that will be TRUSTED to carry on the name, particularly since, should TORMAIL suddenly reappear on the Onion network, It will be assumed (correctly) to be controlled by the NSA and FBI.

TOR will never be compromised by the Intelligence Mega-plex, simply because they use it themselves ... a fact recently illustrated by the effective destruction of much of the Dot-Onion network NOT associated with TOR itself.

You can accomplish this in less than Two Weeks ... Kindly Consider Doing So.

That is correct. Tor has not

That is correct. Tor has not and will not be compromised as long as big corporations, businesses and government agencies use it. I feel safe enough using Tor Browser Bundle by itself with scripts disabled.

have you considered freemail

have you considered freemail on the freenet system?

The update warning was the

The update warning was the blinking yellow triangle?

I can't check now the version I used because I am in vacance. But I think I didn't have any update warnings (no yellow triangle ) . I think I downloaded tor within the dates in the advisory, but not sure.

Thank you.

The blinking yellow triangle

The blinking yellow triangle is a new feature, in more recent TBBs.

The main update warning is the homepage of TBB saying in big letters "There is a security update available for the Tor Browser Bundle. Click here to go to the download page"

I'm running 17.0.7, and have

I'm running 17.0.7, and have NoScript set to block all scripts, but did get a crash in Tor when visiting a possibly infected site on August 3rd. Is there any way that the exploit could still have run, as the advisory states that "the attack appears to collect the hostname and MAC address of the victim computer, send that to a remote webserver over a non-Tor connection, and then crash or exit."

The exploit does attempt to

The exploit does attempt to run on 17.0.7 (it checks for any version above 17.0 and less than 18.0). It's effects on 17.0.7 which supposedly fixed the vulnerability it uses are unknown until somebody can step through the source while it's running the exploit and see what it does exactly.

I need to report that five

I need to report that five customers and counting have similar issues with tor-browser:
1. They had tor-browser crashes and windows reboots reported in early July. Why assume it is unrelated to the attacks in late July. All of these systems had up-to-date browsers with the most secure setting (script etc.)! at least 17.0.7

2. All show, after the window OS rebooted, MS was eager to send you a possible fix. If you report the error (checked MS’s server) it records your IP address along with a serial number. Is MS involved in this matter? Why not? Remember, the FEDS have full access, and they are the good guys.

3. Some/All show there were automatic SSL certificate updates prior to the browser crash? All via MS.

4. It is a fact that the FEDS have been logging the tor-browser downloads via MS IE. They know who might be using the tor browser, based on the Metadata gathered, and the OS used as well.

5. Some/All of my customers had unexplained AV services stopped errors prior to the event. None of them had this problem prior to using the tor-browser (back one year or more). All used the browser for the first time very recently, because of the Snowden leaks. They didn’t know what TOR was before that.

This might be a pattern.

Dear FBI, I hijacked your

Dear FBI, I hijacked your exploit and started loading CP sites through Tor, each time I had the exploit code delivered but firewall rules and other mitigation techniques prevented it from phoning home, simultaneously with this I injected your exploit in users traffic through their clearnet exit nodes, framing them for viewing the CP. I did this a great many times, always taking care to clear cookies and use a new circuit to your compromised hidden services. I started doing this almost as soon as I recognized what was going on, and has added what I imagine must be significant noise to your database of suspected pedophiles.

Sneaky. If you didn't want

Sneaky. If you didn't want to beat the "but exit relays can be bad" horse, you could instead (in this hypothetical world we're talking about) have bought some google adwords that included an image link to the .onion address -- non-Tor users would fail to load it (and not notice), whereas Tor users would autoload it (and also not notice).

sure and the manipulative

sure and the manipulative mind games continue, it is typical behavior for suspects to try and say they were trying to catch a predator, a very common ploy to try to push the blame from their selves because the individual built his own little world inside his head, and therefore blatantly disregards the actual reality of his or her own actions in an attempt to cover his or her own actions.

Fact, many FBI or alike agents that work with cp all day end up with problems, and many of them end up getting caught with possession of cp!

I would just like to clarify

I would just like to clarify that I run multiple exit nodes, they are not part of a family and I will not name them. My exit nodes carry traffic for a great many Tor users every day, and I have randomly exposed them to your exploit during the duration of your operation. I am not going to reveal the exact way in which I did this, but suffice to say I have seriously contaminated your database of harvested IP addresses. That said I would also like to warn all users of Tor that you are very possibly in the database of the FBI even if you never loaded a child porn hidden service. I did this in order to confound their operation and provide plausible deniability to all targeted Tor users. I apologize in advance if the FBI kicks your doors down, but perhaps after they realize a great many of their targets are in fact not involved with CP, they will realize that their operation was a failure.

If someone was always using

If someone was always using the then most current version of TBB, would they have been at risk on any day?

Not from this exploit as we

Not from this exploit as we understand it to have been deployed.

But it's unclear who learned about this exploit first -- certainly back in June when Mozilla were looking at how to fix it, the vulnerability existed. (Mozilla's bug report is sekrit so we don't know the history of the report and fix.)

So, "no but yes".

my understanding of the

my understanding of the exploit is that the TBB would crash after the exploit code ran. If a user was attempting to connect to an exploited site, the browser would crash, preventing them from 'perusing' the site.

Is my understanding correct?

Hi. I used the latest (ie

Hi.

I used the latest (ie "fixed") Tor bundle. JS was disabled in the FF options.

But I once got this notification in the bottom bar from HtppsEverywhere :

In order to implement a crucial fix, this update resets your HTTPS Everywhere

Is this related to the attack ? Was my IP compromised ?

Thanks for your help.

Unrelated (and harmless).

Unrelated (and harmless). Search the other comments here for details.

As a user of Tormail, is

As a user of Tormail, is there any way to find out if my real IP information has leaked out? Freedom of information request to the FBI? The real problem with this is that if your IP/machine name has been captured the FBI can know with, a simple req to the ISP , who we are. Name address, bank account and any other info that they have.
We have been royaly shafted.

"Freedom of information

"Freedom of information request to the FBI?"

Is this your brother?

http://www.technodify.com/virus-made-a-man-arrested

Ha ha ha...

I've installed package

I've installed package 'tor-0.2.3.25-1702.fc17' under Fedora 17...

It's not mentioned in the above list, but 1702 seems higher than 10, right?

I'd check with your

I'd check with your distribution (that's no rpm we've ever made).

And while 1702 does sound higher than 10, it also sounds lower than 1707. I'd be worried.

Fedora (Linux). As I know

Fedora (Linux). As I know the exploit attacks only Win.

Right, true. But based on

Right, true. But based on the number, I'd be worried that Fedora isn't giving me updates to Firefox.

A few questions for arma, if

A few questions for arma, if they'd be so kind as to answer
- I think I downloaded my TOR mid-late June/Early July, am I vulnerable?
-I only ever went to websites and clicked on pictures, can I still have had my IP traced?

Stop double posting.

what kind of pictures?

what kind of pictures? describe

Unfortunately I have missed

Unfortunately I have missed the update and used 17.0.6. But I have the script blocker activated an usually no script is carried out. Is there a risk that this attack can overcome this mechanism ? I remember (maybe I'm wrong) that at some point I saw the n_serv cookie in the cookie menu in the Tor browser. But I think cookies can be received without having script enabled.

If you really saw n_serv

If you really saw n_serv cookie, that's it Game over.
Because
v17.0.6->JS enabled->store n_serv cookie->shellcode execution->Your hostname/IP/MAC data goes to LEA
v17.0.6->JS disabled->NO n_serv cookie->NO shellcode execution->NO data travels to LEA

wouldnt the cookie expire

wouldnt the cookie expire after 30 mins like the code suggests? so even if you didnt see it, you could have had it at some point right? reloading pages would refresh it in theory, but it could still be overlooked

I also saw one cookie, under

I also saw one cookie, under Torbutton cookie Protections, but it was maybe 2 or 3 weeks ago. I was checking everything in settings and so I saw one cookie there and I moved it. But... I was FOR SURE using 17.0.7 the latest 2.3.25-10 release when this happen, I am using that after it was available. I know that for sure by from the file modified date of when I extract it and checked the version.

Is it normal there ever be a cookie under the Torbutton cookie protections? In fixed version does the exploit only make the cookie but not send it?

I have two questions for

I have two questions for arma:
-If I downloaded my browser mid-late June, early July, would I still be vulnerable?
-If I only ever visited websites hidden service addresses, and only ever clicked on images on those sites, would I still be vulnerable?

Yes.

You should obviously have

You should obviously have Javascript disabled by default in Tor browser.
I thought Security > Functionality was the obvious priority for Tor browser.

The https crucial fix bar

The https crucial fix bar seems to belong to the plugin:

https://gitweb.torproject.org/https-everywhere.git/commitdiff/804d74eea…

Does anyone know when the

Does anyone know when the freedom hosting sites were infected?

I know that before the time frame was a few days ago, but I wasnt sure if there had been any developments.

What to do if you think you

What to do if you think you were hacked by the LEA
Time for DAMAGE LIMITATION advice - I suggest add any advice you have and post wide and far!

So the LEA have got 1000's of MAC codes and IP addresses of PCs that visited onion sites that contain illegal material. It will take time to process all that information and get court orders for addresses of IPs etc - so I should think everyone who was compromised has at least a week before their door is busted down and all their computer equipment seized. Probably months. USE THAT TIME WISELY

First, your IP address by itself is not worth much as evidence - could have come from someone using your WiFi or a visitor to your house. The MAC address is more compromising - your PC is the only one in the World with that MAC address and proves that the site access came from that particular PC. So first, change your PC and don't keep that one in your house. If you use a network card or network USB dongle on that PC, get rid of those also (they have unique MAC addresses).

Deleted files can be recovered. If you have *ever* had illegal material on your HDD, get rid of that HDD or, if you know what you are doing, wipe it. Any compromising files you *really* want to keep, copy to an encrypted container on a new, separate HDD (e.g. Truecrypt), unless your country can force you to give up the key (e.g. the UK).

The raid will still happen, but if the computer with the compromised MAC is not found and there is no illegal material found, there is no case against you and you will eventually get all your stuff back with no action taken (though it will probably take a year or so).

Finally and most importantly, if you are questioned by LEA, there is only one answer you MUST give to *every single* question. "NO COMMENT". Do not believe anyone who tells you that saying anything different will be better. It won't.

Nobody is going to get

Nobody is going to get busted because he attempted to visit the front page of some kinky website. FBI is most likely going to distribute the collected list of IPs to local police departments for further surveillance. You will receive your knock years later and nobody is going to even mention this TorSploit then.

Agree, this is the most

Agree, this is the most likely couse of action here. If you think you were infected, disposing of PC and evidence won't help you. You need to change your habits and be very careful what you say or do online and IRL from now till.. forever.

I disagree. It is

I disagree. It is sufficient to get a search warrant, same as happened with the Landslide bust. The LEA then hope to find a good percentage who have illegal material on their PCs - which is what they prosecute over. If you are right but take the precaution you have lost very little except time, if you are wrong and don't take the precaution it could be a life-changing event.

Contrary to what you say, I cannot see that any LEA is going to spend the resources on setting up years of surveillance on the probably thousands of households who were caught by the sting.

But in Landslide the feds

But in Landslide the feds had records of what the customers purchased and downloaded. Here all they know is the person went to the website, but not what they downloaded or looked at. It would seem similar to "this person was observed leaving a house of a known drug dealer." Is that probable cause to search that person's vehicle or house? Reasonable suspicion to stop and question them maybe, but enough probable cause to get a search warrant?

>>but enough probable cause

>>but enough probable cause to get a search warrant?

I would suggest yes. If they know (for instance) that you accessed a cp site, that would be a strong suggestion that you would have cp on your computer (after all, why would you be accessing the cp website if not to get cp?). Present that to a judge and I can't see any reason why a warrant/order wouldn't be issued.

According the Wikipedia, a

According the Wikipedia, a Federal investigation into Texas based Landslide Productions yielded a user database with 300,00 names of which 35,000 were U.S residents. Of the 35,000, a portion were selected to receive invitations to purchase illegal material by mail. The results of this subsequent sting yielded 144 search warrants and 100 arrests. Note that the DOJ did not seek warrants based on the mere presence of names in the subscriber database, but only after the subsequent sting operated by ICAC and USPIS.

It would seem that an IP and MAC address are slight evidence when compared with the credit card and business records found in the Landslide investigations.

I think this server-side

I think this server-side hack would be illegal so the FBI couldn't use it as a basis for anything. It would be like the FBI installing a hidden camera inside a suspected drug dealer's house to record everybody who entered, without a warrant. (On the other hand, is this exploit something a U.S. court could authorize? I'm not a lawyer).

I am a US lawyer (at least

I am a US lawyer (at least by education and historical avocation). First, forget the FBI if the server was outside the US. The NSA can (and does) intercept all international traffic. That's its legitimate job. Outside the US, you don't have any US constitutional protections; that's what international borders are about. We have a constitution in our country (the US), but outside the US different countries are organized under different rules. And, international communications are essentially subject to no rules.

It gets worse. Since the NSA can gather whatever it wants outside the US (German Enigma and Japanse JN-25 codes during WWII, Russian codes for traffic between the US and Moscow under project Venona, Russian codes generally under Project TICOM, etc.), it can do whatever it wants with the information, including giving it to the FBI. If they give information lawfully collected in an international communication to the FBI, the FBI can use it against you. Why would they need a warrant?

Earlier in this thread somebody mentioned WiFi. Are you nuts? Anything you put out using WiFi or other frequencies of the electomagnetic spectrum - including use of your cell phone and its geolocation - is fair game. While the FBI or NSA might go to the FISA court (you'll never know) for a warrant just to be sure, I can make a very strong argument that they don't have to, and shouldn't be required to.

The long-standing principle is that "the airwaves belong to the people" (codified in the Communications Act of 1934). And, you may remember a famous speech in US history about our government being "of the people, by the people, and for the people."

Thus, the government "of the people" should be able to listen to anything on the airwaves they own. [I oppose the legislation that prohibits ordinary citizens from listening to cell phone conversations on scanners. Sounds strange, huh?] If "the people" - which includes the government - cannot listen to WiFi (BTW: Every version of Fedora ships with an application that hacks it.) or the government is required to get a warrant (that is, conditional permission) to listen to your cell phone conversations, it is a very short step to general prohibitions on citizens listening to the BBC or programs the government determines might include information that is "dangerous" or potentially valuable to terrorists.

This is very different from breaking into the house of a suspect to install a surveillance device. That does require a warrant because the Fourth Amendment protects "the right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures" without a warrant. An off-shore server is not the "house, papers or effects" of a US citizen or a citizen then-subject to US law. (Try moving to Russia and setting up a server hosting comments critical of Vladimir Putin. See how far your protest for a US warrant gets you.)

Gnovalis

Even a visit to tormail

Even a visit to tormail front page could lead you to a raid or a surveillance?
If so, it's ridiculous.

Hi Arma, Thanks for your

Hi Arma,
Thanks for your replies.
You are amazing for replying so quickly in these trying times for privacy and anonymity.

Has TOR thought of adopting more advanced header analysis and inbuilt firewall system, that will actively parse and analyze for hack attempts.

Have you thought of upgrading the TOR Browser bundle so that it will act also as a comprehensive firewall like Comodo firewall?

ALSO is TOR safe from ICMP and IGMP exploits???

TOR does NOT Protect you

TOR does NOT Protect you from IGMP or ICMP!
You need to block this in your firewall!
If there is a IGMP Hack someday, even with TOR you are busted!

Does this mean that if we

Does this mean that if we have a tormail email account are emails can now be read. Will tor email ever be back?

Yes, and hosted by FBI.

You have to assume that all

You have to assume that all emails on Tormail are now in the hands of LEA. It could have been the primary target and all the sloppy CP bust exploit could be just a coverup. If that's the case, it worked perfectly. Nobody talks about Tormail - the real issue here, but everyone talks about a few busted pedos.

'Busted the biggest hoster of CP on the planet?" Bullshit, FH didn't host much, the biggest onion CP hosting site is still up and running and most of the CP allegedly hosted on FH were just links to files hosted on clearnet hosts, such as rapidshare, sendspace, mega.. these are the biggest CP hosters in the world.

What they really bust is Tormail, used by whistle blowers and activists. That's the real story here! They want to get to those who are anti government and pro people, like wiki-leaks supporters. Taking down a few CP sites that only had links and have already been partially restored on safe servers, is just a media attention catcher.

this, thousand times this

Yes the primary target of

Yes the primary target of the NSA was tormail. This cannot be repeated enough! The purpose of that is to collect data on as many whistle blowers/leaks as possible. Of course there is the chance to find out lots of other potentially useful info that could come from nation actors of every nation who might happen to use tormail.

The secondary target was fear. They have aimed for some time (though using various stories of busts where TOR was not actually the determining factor) to scare people away from TOR and any other anonymous network. Projects like TOR are quite useful to their own people (and probably even more useful to the CIA) yet to them it is extremely dangerous in the hands of the average citizen (or a whistle-blower). Their position/mentality is that they should maintain total control while TOR is an obstacle to this end.

With this operation - they have achieved both major goals. Going after pedophiles is not and never was the NSA's mission. Much like the MPAA/RIAA - they do not care one bit about CP right up to the point it becomes useful to them as a cover to do whatever they want.

Just so everyone is clear - TOR isn't bulletproof but TOR works... and it is for this reason that the NSA would very much like you to believe otherwise.

Everybody talks about NSA,

Everybody talks about NSA, FBI and CP, when in fact it could be anybody. The U.S. intelligence community (I.C.) has a company, In-Q-Tel in Reston, Va. It is a venture capital company that funds start-up technology companies developing technology of value to intelligence gathering. Two things to keep in mind:

1. In-Q-Tel is NOT the only company in the venture capital world that invests in the information technology surveillance space. There are plenty of others.

2. I know this is hard to believe, but start-up enterprises desperate for sales are not terribly discerning about whom their customers are. They'll basically sell their products to anybody - in government or the private sector - who has the money.

[There are private companies will geolocate your cell phone for anybody with the money. They index every word you write and develop "personality profiles" on you that they'll sell to anybody (like 90% of hiring managers). If you have a Facebook account, why would you ever use Tor? You've already prostituted your mind to innumerable Johns.]

Tor mail was the target. I used it to communicate with my daughter studying last semester in ROK during the tension with PDRK. ROK censors the Internet, and censors the news. Except for information she received from me (some of which was classified and identified as such with instructions not to distribute it further), she knew very little. The international student organization that sponsored her study there was also kept apprised (with the classified intel left out).

[For those who are curious, no, the PDRK does not have any deliverable nuclear weapons, China is working very closely with the U.S. (closer than you could ever imagine), and Russia has essentially broken diplomatic relations with PDRK. There were a few hairy days. But, fortunately, they passed uneventfully.]

[BTW: I also use Tor mail to communicate with a troubled youth who does not want to be found. It would be nice to be able to confirm that she is safe.]

So, I am less worried about NSA than KCIA, which I'm sure has access to the same software and the same information. KCIA will want to get me, again. [Can't tell you about the first time. It's still classified.] Then there's the Chinese, the Libyans (also pissed at me for reasons I can't discuss), and my dear friends at Mossad. Show up at my door, you'd better be well-armed. I don't have visitors. Ever.

My NCIC is "unavailable," I can't get a passport, I can't get a job (if FBI won't acknowledge that you exist, you are unemployable), my $90K Jaguar disappeared (according to the insurance company, there was no record of it having been titled or registered in any jurisdiction, and no documentation that it was lawfully imported). As I recommended in an earlier message, if you are going to play in exciting games, know how the FBI "triple threat" surveillance program works IN ADVANCE. What I've described is the "managed aggression" component.

NSA and FBI would likely ignore my tor mail message traffic. But, KCIA will be pissed and demand that FBI turn up the heat again. I expect them any time. But, NSA, DEA, FBI, CIA are not my primary concerns. I have nothing to do with CP; wouldn't know where to find it (because I haven't made any effort to look). As for DEA, I used to hold a DEA registration, and I purchase all of my controlled substances legally.

The loss of tor mail is tragic. It does have legitimate uses.
Gnovalis

Yeah, maybe it does, but I

Yeah, maybe it does, but I stick with my assessment from tor-talk today:
https://lists.torproject.org/pipermail/tor-talk/2013-August/029320.html

"While I don't really have an opinion on whether this service should stay
dormant, I do hope they leave the TorMail name behind. Too many users got
confused about whether it was an official Tor service (it wasn't). And I
can't help but conclude that this confusion was intentional and welcome
on the part of the service operators -- which I confess makes me have
little sympathy for them disappearing."

>>You have to assume that

>>You have to assume that all emails on Tormail are now in the hands of LEA.

Why? What evidence is there LEA is in possession of the FH servers?

So I downloaded the TBB like

So I downloaded the TBB like 3 hours ago, with Javascript enabled... I shouldn't worry about anything right?

Anything at all? :) You

Anything at all? :)

You should worry about everything that you should normally worry about on the Internet. Most of the recommendations in the advisory still apply, now and in the future.

Well tor is totally safe

Well tor is totally safe anymore. Who knows whats next on the javascript exploits list? You guys wouldn't have even known there was an exploit if it wasn't for the arrest of the FH admin and the sites hosted by FH going down. Best couple it with VPN's or VPS, exploits get nastier by the day. In the meantime, any alternatives to tormail are welcome, since tormail wont come back up anytime soon. Is the tor mail data center compromised now and is a LEA looking through those mails already?

There are some steps you can

There are some steps you can take to protect yourself even more from similar attacks, but a typical VPN service or a proxy is not one of those steps.

why?

I'm pretty sure this script

I'm pretty sure this script ignores your VPN entirely, because it's executed in your browser and gathers info locally. So it obtains your real IP/MAC - before any info even leaves your PC - and only then sends it over your VPN connection to the target port. So the FBI would see the incoming data coming from your VPN but the data would contain your real, naked IP/MAC. Am I correct?

Incorrect, the exploit code

Incorrect, the exploit code itself doesn't get your IP because the kernel functions the code can call only know your network adapter's IP which is pretty useless (i.e. if you're behind a router like most are it's probably a generic 192.168.x.x or similar). The server on their end gets the IP because your router strips the LAN IP and adds its WAN IP to the packet (your "real" IP). However if you're going through a VPN the VPN then strips that and adds its own. So the server would only know the VPN's IP. They would get your MAC address even through the VPN but that's no use to them without also knowing your real IP.

This post looks correct. The

This post looks correct. The ones below is look confused.

They would get your MAC but

They would get your MAC but not your IP.

Wrong: user machine -> tor

Wrong:

user machine -> tor proxy -> onion land / clearnet => SAVE
EXPLOIT WOULD YIELD AN EXITNODE IP

user machine -> vpn -> tor -> onion land / clearnet => SAVE
EXPLOIT WOULD YIELD A VPN EXTERNAL IP

Wrong, see post above. The

Wrong, see post above. The script executes and collects data before it's obfuscated by VPN or TOR.

I fixed your diagram:

user machine (collected real IP) -> tor proxy -> onion land / clearnet => BUSTED
EXPLOIT WOULD YIELD YOUR REAL IP

user machine (collected real IP) -> vpn -> tor -> onion land / clearnet => BUSTED
EXPLOIT WOULD YIELD YOUR REAL IP

That is not how it works. If

That is not how it works. If you have a dedicated tor proxy which only allows traffic to go over the tor network then there is no way that the script could have circumvented that. Same situation if you setup a vpn the api called respects the routing table and therefore would have used the vpn connection.

WTF guys, You don't realize

WTF guys, You don't realize or what?? Exploit reads Your adapters h_addr_list structure, all available IP's including tun/tap interface in case of VPN. So whatever You use VPN, Tor, spacecraft, lasergun or bla-bla-bla, this info package is delivered and stored in DB by adding Your uniq case UUID.

Can you please explain in

Can you please explain in detail how the exploit gets your actual ip address regardless of using a VPN rather then just saying it does?

It reads it from Windows

It reads it from Windows network stack, then sends it over browser-independent connection. If you use VPN, transparent Tor, etc it is just a communication channel for delivery. Like a raindrop, no matter how many clouds are in way, it reaches the ground.
Lucky people who used internal LAN/VM, and non ISP DHCP networks, then they got only 192.168.*,10.*,172.16.* for hunting.

Since Tor Mail was extremely

Since Tor Mail was extremely popular with drug dealers and financial fraudsters I would say yes LEA are looking through the emails.

CP, drug deals and financial

CP, drug deals and financial fraud are only covers. They don't give a damn about any of it unless it suits their larger goals. Like catching whistleblowers who reveal their secret plans and illegal schemes. Like Snowden did with PRISM. They wanted access to Tormail, because it's likely that other heroes like Snowden were using it, and could be caught by reading the emails.

It's an attack on your freedom, don't let them fool you that it's all done to protect you. It's only protecting the interest of the government and those behind it, to stay in power.

What else can we use now to communicate without being spied upon? Tormail was the place to go.. now were redirected to gmail and other compromised email providers, that we know now are logged and read by the NSA.. welcome to the police state.

Today it's TOR. Soon they will call you a pedophile or terrorist, if you use PGP or any sort of encryption at all. We are loosing the War For Freedom, and even small victories like Wikileaks and Snowden don't seem to matter, because most of the population is spoonfed whatever lies the government wants them to swallow.

TorMail is an interesting

TorMail is an interesting issue here. The almost certain fact is that existing accounts are in the hands of FBI. Also, AFAIK, TorMail is an enterprise not related to FreedomHosting, they merely rented a server there. So technically, TorMail could resume as soon as they find a new service provider. They could continue under the name of TorMail, or they could use any other name, in order to not be associated with the compromised old accounts. Now, FBI could launch their own little TorMail. Or FBI could start their own anonymous mail service under a different name.

Whatever. The crucial point is that we will have no way to tell which is true. In fact, I don't think that we even need to worry about that - when one uses someone else's service without seeing where it hides its brain, one should always assume that all his actions may be monitored by some hostile agent. TorMail could have been hostile, bribed, or hacked. Same about FH. Or, no matter how good were the intentions of TorMail and Freedom Hosting, there was always a chance that somebody would accidentally stumble upon the servers and read everyone's correspondence. Or knock the server owner against his head and then read everyone's correspondence.

So if (or rather, when) TorMail or something similar returns, we won't really know whether it's FBI or the original thing (unless they give back your old account, in which case it can only be FBI). But it doesn't really matter. As long as you stay in character, you can as well use the feds' servers for your shadowy actions. If you let your real-world id slip, you are doomed either way.

+1 for the Rowling. The fact

+1 for the Rowling. The fact that hidden services was constructed specifically to hide the identity of both ends of the connection makes it amazing that Torproject did not take steps to protect users from malicious hidden services by disabling javascript by default on onion domains. I keep looking for logical justifications for NoScript not being enabled, and it always comes back to the 'usability' nonsense. Privacy SHOULD trump usability, in this environment.

It should give more than a few people pause to consider that both torproject and TAILS, by default, do not enable javascript blocking AND both software suites direct the browser on load to a page that could be compromised in the exact same manner as site on FreedomHosting were. I understand that to a certain extent you must trust the project developers not to backdoor your software, but I see no reason why every time I load the software I am asked to trust their website.

An interesting take on what

An interesting take on what is going on is cited in this ByteGeist article: http://bytegeist.firedoglake.com/2013/08/05/fbi-software-suspected-of-c…

Basically, the address 65.222.202.54 seems to be NSA, not FBI. NSA doesn't catch criminals, they do PR, and this entire affair may as well be “psyops—a fear campaign… They want to scare folks off Tor, scare folks off all privacy services.”

No, NSA gathers electronic

No, NSA gathers electronic intel -- mostly tracking terrorists. Knowing the real users of TorMail would be of great interest to the NSA (presumably it's used by terrorists as well) and exactly the kind of intel they gather. This exploit would have allowed that if it weren't discovered. They wouldn't want it to be discovered because I'm sure they'd rather have terrorists think they're anonymous and safe and communicate openly rather than think they're being watched.

However, the exploit was far

However, the exploit was far from obfuscated, it actually screamed out "I'm here, look at me, I'm sending data to NSA".

I'll believe the affiliation

I'll believe the affiliation claims when somebody comes forward to claim responsibility.

IP-to-whatever databases are notorious for being inaccurate. I haven't seen anything at all to convince us that it's the NSA, or the FBI, or really anybody at all.

It was FBI or NSA. There is

It was FBI or NSA. There is no doubt about that now. If it were hackers, they would announce it on day 1. They would also inject a virus with the payload.

But the government agencies don't have to announce anything. They can keep the collected data for years to come, watch the suspects, and strike at any time they see fit.

Especially if Tormail was the primary target, they will not issue any official announcements and everyone will forget about it. And they have a contingency in case the talk about this doesn't fade - they can simply raid the collected IP addresses and again shift all attention from their actual target.

All because the public is dumb enough to fall for one of two cliched reasons:

'We are the government and we can do what we want to you and your rights because... Child Porn!"

and

'We are the government and we can do what we want to you and your rights because... Terrorists!"

And the dumb populations says: "Oh that's right, noble goals, do what you have to!"

And here we are.

I wouldn't let them hack our computers even if Bin Laden and his ilk took down random two towers in the US each bloody week. It's not worth it in the long run. How about instead of treating everyone as a suspect, stop invading other countries and kill their children? Maybe that would reduce the amount of hate and terror aimed at you, 'Merica.

It's easy Obama, just tell your soldiers to move out and come home. It really is that simple. And stop spying on the world.

Hi, quick question If I had

Hi, quick question

If I had version 17.05 but NoScript set to block all scripts globally, would that still make me vulnerable?

Thanks in advance.

No, the exploit requires

No, the exploit requires Javascript to work. If Javascript was disabled, as it should have been in the first place, there is no chance it could have worked.

It is impossible to confirm

It is impossible to confirm that patched users of 17.0.7 were immune to the data mine.

For TBB 2.3.25-10 (17.0.7), which is what most of us are currently using, the exploit was fixed and delivered on or about June 26 (assuming you patched).

The exploit was REPORTED to have been executed in early August, so most with 17.0.7 would assume they are safe, however..

How do you know the exploit was not happening before June 26 ???

You do not.

Although it was patched on June 26, it may well have been happening for quite some time before that. Quite some time before you all updated to 17.0.7. Happily collecting your data, waiting for it's presence to be discovered by someone ('Nils' on June 25).

Yes you are safe NOW from this particular exploit if you have 17.0.7, but there is no way Mozilla/TOR can confirm you were not compromised before June 26.

If you did access a FH site before June 26, I think it would be safe to assume there is a significant chance your IP/Host/MAC is on file and currently being 'processed'.

I am not here to panic you. I am just thinking through this logically.

Sources on the reported

Sources on the reported exploit execution dates, please? I've read over a dozen news stories and forum threads on different sites about this, but so far i haven't seen much if any speculation regarding exact dates outside of this blog.

On a related sidenote, i understand most or at least many people who were subjected to this exploit experienced a browser crash. One would think these crashes would have been reported during all of July if the exploit had been in effect "silently" from way beyond the fixed update on the 26th of June. Have there been numerous unexplainable crash reports before this week/last weekend?

I have an interesting

I have an interesting question. did anybody experience a crash who is sure they had javascript disabled? is it proven that only having it enabled could cause the browser to crash? I wonder if theres a possibility the browser could be comprimised and crash using iframe if enabled and/or something else even with javascript disabled.

There are a bunch of bugs in

There are a bunch of bugs in Firefox that can cause unrelated crashes. They're not particularly common, but once you have many hundreds of thousands of users (like TBB does), some users will encounter them.

Assuming you had javascript disabled, your crash was probably something unrelated. As far as we know currently that is.

(Also, it's not just Firefox. We add our own patches to Firefox to deal with privacy and security vulnerabilities that Mozilla doesn't care to fix. And one of those patches could have caused the crash too.)

yes after visiting the TM

yes after visiting the TM homepage. And... I was using Tails and the 1st thing I do is disable JS. Could have been something else as I've had a similar crash in past but not for a while. This happened on the 4 I believe. Also running the most recent Tails distro. ???

Don't know what to think but believe it has more to do with drugs than CP

Freedom hosting admin was

Freedom hosting admin was just busted a little over a week ago.

Would it make a difference

Would it make a difference if Javascript was enabled globally and Iframes were disabled on all sites via NoScript?

I don't think the exploit

I don't think the exploit would work in that case, because it runs inside an iframe. The server-side code would write the cookie but the rest wouldn't run.

Stupid question. But

Stupid question. But everytime I´ve used TOR, I've downloaded tbb, used it and then deleted it. So if I did this a few times over the last couple of weeks I should have used the last version every time, and should be safe even with JS enabled right?

The tbb that you download from the site is that always the latest version?

The website does in fact try

The website does in fact try to give you the latest version each time, yes.

Be sure to check the signature each time you download it. (And if you're on Windows, where it's hard to check the signature because you can't securely get any software to do it ... consider not being on Windows anymore.)

Not happening. It is a

Not happening. It is a ridiculous suggestion. Plus PGP software for windows does exist, despite your comment suggesting otherwise.

It could be easier to use, but a particular piece of software for a platform is not indicative of any problems (or benefits) of that platform. Truth is we have more software choices for just about everything on Windows. Given the existence of VM software - a person can run multiple OS's on any computer at once anyhow so why does it matter?

You aren't doing TOR project any favors with your smug Windows-hating hipster attitude.

_______Begin Quoted

_______Begin Quoted Text_______

The thrust of my position is that security is an absolute property that must be designed in from the beginning, coded with care, and enforced throughout the software development lifecycle. This embodies a set of issues that are orthogonal to whether the source code is open or not -- it depends on training, design, and use of appropriate tools. Thus, the nature of whether code is produced in an open or proprietary manner is largely orthogonal to whether the code (and encompassing system) should be highly trusted.
[...]
We often hear debate about which is more secure: open source or proprietary source. Each side makes arguments and refutes the arguments of others. In truth, neither is correct (or both are). Whether or not source is proprietary does not determine if the software is better.
[...]
From this standpoint, few current offerings, whether open or proprietary, are really trustworthy, and this includes both Windows and Linux, the two systems that consistently have the most security vulnerabilities and release the most security-critical patches.

_________End Quote Text______________

- Gene Spafford (from circa 2000-2002)
http://spaf.cerias.purdue.edu/openvsclosed.html

A famous Spaf quote:
"The only truly secure system is one that is powered off, cast in a block of concrete and sealed in a lead-lined room with armed guards - and even then I have my doubts."
(http://spaf.cerias.purdue.edu/quotes.html )

If you (the one

If you (the one hurt-by-Windows-criticism) had bothered to actually read Arma's comment word for word before huffing and puffing and taking offense, you would have seen
the word

"securely"

as in

" you can't securely get any software to do it".

If you want to rectify that, for starters please cite an URL that fits that criterion. Be constructive.

Thank you.

Yes indeed. Our "how to

Yes indeed. Our "how to verify signatures" page is a disaster for Windows users:
https://www.torproject.org/docs/verifying-signatures
since it starts out with "first, fetch gnupg.exe from this http url"

Sorry but it still isn't

Sorry but it still isn't 100% clear to me.

If I was using 2.3.25-10 with Javascript enabled (in Firefox settings), Forbidden Script Globally and visited Tormail. Was I injected?

No. Firefox ESR 17.0.7

No. Firefox ESR 17.0.7 used in TBB 2.3.25-10 is not vulnerable, even with Javascript enabled.

Switching away from windows

Switching away from windows because there is a security issue in the software YOU use. Forget it, I will no longer support you. You are nothing but Microsoft hating geeks.

Even if everyone switched to

Even if everyone switched to Macs, this exploit still would have worked because it allows execution of whatever code the exploiter wants to put in there. They could have written Mac specific code if they had wanted.

I'm confused with regards to

I'm confused with regards to noscript - did blocking all scripts globally include javascript? I used a javascript test site to see if it was enabled with noscript blocking all scripts, and it wasn't enabled. Does that mean I'm safe?

"block all scripts" does in

"block all scripts" does in fact refer to JavaScript, yes.

Would having only Tor

Would having only Tor allowed to access the net in my Windows firewall settings (not even DNS is allowed through) block this attack? How likely are the ramblings of the guy saying he runs exit nodes and embedded the exploit in random traffic? Would the n_serv cookie have still showed up in that case?

Yes you would have been save

Yes you would have been save from this exploit. Make sure only a user with admin rights is able to turn the FW off. The payload itself was extremely strait forward - a 5 year old could have written it. Honestly, they could have done much more damage if they really wanted but they didn't for some reason (Lack of time?).

The injection story is a hoax imho, but is technically possible if and only if the UUID's were static. If they are dynamic and logged at the FH servers then it is not possible to "poison" the database.

Forgott to mention that as

Forgott to mention that as an exitnode operator he would not be able to "accuse" real tor users because he cannot know their ip addresses.
He could have spoofed random ip's but then it does not make sense to use an exitnode at all. So again 99% sure that this story is a hoax.

If Tor.exe is allowed but

If Tor.exe is allowed but not tbb-firefox.exe (and your version was vulnerable), it would have failed trying to connect outbound because it ran within the tbb-firefox.exe process space.

The real solution is to

The real solution is to install tor in a virtual machine with a new Windows installation, then take a snapshot after you install TBB on it, and have it restore to the snapshot after EACH use.

They can hack all they want, all they'll get is a clean system with nothing on it, and the system will be restored to its original state after each use.

Tips:
Set the DNS server to some bogus IP address so no legit domain names will ever get resolved to an IP unless they go through Tor.

Adjust the firewall so only the tor ports are opened.

Us the open sourced virtualbox instead of closed sourced vmware.

If you're willing to run

If you're willing to run stuff in a VM, you should probably run Tails in that VM rather than TBB.

So, I'm going to ask the

So, I'm going to ask the question nobody seems to be asking. If you feel as if you may have been compromised, what should you do?

Well, it just means your IP

Well, it just means your IP and MAC address as well as proof of what exploited site (possibly page) you visited is on a U.S. government list along with probably thousands of others. Only you know what pages you visited and what would happen if the U.S. government knew you went there. Other than that, the exploit didn't leave a virus or install anything, just phoned home with that info.

You should

You should RUNNNNNNNNNNNNNNNNN

Exactly ... if the javascipt

Exactly ... if the javascipt exploit donwloaded malware on a users computer it should be possbile to scan for traces of this infection. So users need to have a way of finding out if they have been compromised... is there a scanner for this malware?

As far as we can tell, no

As far as we can tell, no malware was installed by the exploit.

Anybody else remember when

Anybody else remember when the default settings for NoScript in TorPark had "allow scripts globally" set to on?

My question is who the hell got paid to turn that on for the bundle when nobody was looking?

As far as I know, there have

As far as I know, there have been no Tor Browser Bundles where JavaScript was disabled globally by default. Please show me one.

Also, seriously, TorPark? That brings me back. I'm glad we have all the browser-level privacy and security fixes that people have developed since then.

Hi - I was one of the

Hi - I was one of the unfortunate ones that tried to login to tormail and got the error system maintenance, please check back in a few hours. I got that error about 5-6 times as i kept trying to login. I had Javascript enabled and was running the torbrowser bundle with Firefox 17.0.7 does this mean i was not affected by this 0day exploit?

Can someone please confirm this as quite worried :( Thanks.

As far as we know, Firefox

As far as we know, Firefox 17.0.7 was not exploitable by this exploit.

hello. i little question if

hello. i little question if anyone is able to confirm.
v17.0.6 + JS off(unchecked from options) = compromised?
thanks.

If you weren't running any

If you weren't running any javascript, you should be ok against this exploit.

(But there are other vulnerabilities in 17.0.6 that mean someone could still attack it in a different way. Upgrade!)

Question: in the advisory it

Question: in the advisory it is recommended to use RequestPolicy. Wouldn't that lead to browser fingerprinting because of the low amount of RP users, meaning my TBB browser would be pretty unique?

It would, you're right. It's

It would, you're right. It's all about tradeoffs -- it depends what aspects of privacy and security you're most concerned about.

I never used Tor on my

I never used Tor on my actual machine; it was always on a virtual machine...which was only connected through a VPN...why make it easier on them?

each time I update TBB,

each time I update TBB, first thing I do is always use for good that damn noscript, people think it's there because it looks cool?

I've been reading about this

I've been reading about this since the last two days... And I wonder...
- What if Tor and Tails are a part o NSA, FBI or CIA?
- What if Tor and Tails are a big fishnet to catch every stupid who thinks "Im using Tor, so I'm safe!!"?

Are you 100% sure that Tor is "gov-free"?

1st Rule to "be safe": never use your own connection!
2nd Rule to "be safe": macchanger -r.
3rd Rule to "be safe": Live system + encryption.

Use Kali or even wifiway (lame piece of cr*p) and get a "backup" connection. Yes, might be slower than your own connection, but FBI guys won't be shooting at your door.

Then, you can use java, flash, or wathever. They may reach your neighbour's ip, but even if they get the router, and take every pc on the neighborhood, including your's, you're safe. Your real mac never connected to the router, the live system leaves no trace, the encrypted flash unit is in your rectum, or another safe place.

PS= I don't need to say that you must use GNU/Linux. If you're stupid enough to use windows, you deserve to get caught.

"Use Kali or even wifiway

"Use Kali or even wifiway (lame piece of cr*p) and get a "backup" connection. Yes, might be slower than your own connection,"

"They may reach your neighbour's ip,"

So you're encouraging people to /crack/ and use their neighbor's WiFi without permission?

Isn't that a form of /theft/?

How would you feel if someone were to do that to /you/?

"the encrypted flash unit is in your rectum"

Put what you want in /your own/ rectum but keep-out and away from the rectums (and other orifices, for that matter) of other people, /especially/ children and adolescents.

Another noob question. I

Another noob question.
I removed Noscript and HTTPS Everywhere from the Tor bundle (2.3.25-10) I always surf with JavaScript disabled and cookies off, if I then went to Tormail, did my IP got uncovered ?

My Firefox version is right,

My Firefox version is right, but my Tor Browser's "date modified" is June 23. Is this okay?

Probably.

If one had java turned off

If one had java turned off in fire fox in the options could it have been used to spoof your ip

Uh. There's an alarming

Uh. There's an alarming amount of confusion in this question. Java, or did you mean JavaScript? Used by whom to spoof your IP to whom?

HELLO! Have an older

HELLO!

Have an older version of TBB (maybe updated last year) on my laptop I use only when my work computers are down. I am sure that it has the version exploit could run on. I last used it mid July but always set the button to no scripts (s tab with blue cross out) for fear of adware and viruses. Not sure if I visited any of those freedom host things, i know i didnt get anything sayingdown for maintenance. but nonetheless am I at risk?

Did the malware only take advantage of stupid people with their scripts left on or did effect those with even the no script turned to block all? Could someone with knowledge respond? Thanks

If you have scripts

If you have scripts disabled, then as far as we know this exploit couldn't exploit you.

(But there are still other vulnerabilities in older Firefoxes that don't need scripting to work. Upgrade!)

I know it says above that it

I know it says above that it was aimed at users with windows, so its that a 100% the attack wouldn't have happened on a mac?

The exploit payload used

The exploit payload used Windows-specific code. So it's pretty clear this exploit wouldn't have worked on OS X.

That doesn't mean there wasn't some alternative exploit out there (the vulnerability was cross-platform after all), but nobody has seen one.

I always thought that any

I always thought that any C/C++ based software is inherently unsafe.
The language is simply too complex and it is just too easy to fuck something up. This is not a matter of "being good coders", this is really a matter of a programming language that makes it too easy to screw something.

I do really think we should move on to newer/better languages. One of them is Go [ http://golang.org/ ]. By using a modern language such as Go which includes several improvements over C/C++ (goroutines, garbage collector, no pointers arithmetic, faster [and easier] compilation time, etc) we could really make our softwares much more robus and safe. It is clear by now that this is becoming an emergency... the more we surround ourselves with gadgets the more we will easily fall prey of hackers and shameful agencies working against their citizens.

What i propose here is to write a custom web browser (in go for instance) that supports only basic HTML and CSS and that relies only on go libraries and to make it the tor-browser. My proposal could be extended to Tor itself in order to prevent exploits in it too.

Here is another

Here is another scenario.
Let's say you want to avoid c*p and illegal stuff on deepweb so you turn off images.
But you need JS for some reason and forget to disable it again.

Then a few days ago you load up your now outdated and vulnerable TBB to find most FH sites are down or act weird.
You go to legal but infected onions on FH or Tormail with the maintenance message, and BAM they have your real ip, mac, host.

They know what site you have

They know what site you have visited by sending not only MAC and hostname but also some sort of generated ID from the site.

Confused here, just

Confused here, just wondering, if you don't mess with Noscript options at all, but still go into options and disable Javascript, that still disables it right? Does it disable anything else?

That should work fine.

I can confirm disabling

I can confirm disabling javascript from the browser options, overrides noscript

Restoring NoScript to the

Restoring NoScript to the default setting of blocking scripts globally may be the preferred option.

See:
http://noscript.net/faq#qa7_5

"Disabling JavaScript using your browser built-in settings (or the IE's < IFRAME SECURITY="restricted" > feature) actually disrupts any JavaScript-based anti-Clickjacking protection the target site may have deployed. The good news is that this limitation does not apply if you use NoScript, thanks to Frame Break Emulation: if a framed page which is not allowed to run JavaScript contains a “frame busting” script, the intention of the page author is honored by NoScript, i.e. the page replaces the topmost document. You can control this feature toggling the noscript.emulateFrameBreak about:config preference."

Restoring NoScript to the

Restoring NoScript to the default setting of blocking scripts globally may be the preferred option.

I meant, of course, the actual NoScript default and not the TBB/Tails default that has NoScript set to allow scripts globally.

If you have javascript OFF

If you have javascript OFF and still get a crash, could the malware still have been executed?

i wan to know this as well,

i wan to know this as well, I was using the most recent TBB with Javascript off and i got the crash since i kept refreshing the "down for maintenance" page...

would this have

would this have displayed/sent back the MAC address for the wireless modem/router, or just the computer/wifi card on the motherboard?

The latter. (Read earlier

The latter.

(Read earlier comments for details.)

Is there any reason to doubt

Is there any reason to doubt that this MAC is sent along trunk fiber to all sorts of major destinations -- that are PRISM'd with taps (just before branch-off to their final destination reaching major company servers such as those named in recent weeks)?

Is anyone confident that Windows' Update software doesn't find and send the MAC over as part of Windows authentication and/or computer ID/fingerprinting? And similarly, many non-OS apps? Skype's rummaging around never uses the MAC for computer ID or any other unknown purposes?

And all these communications are all sent thru super-securely, PFS etc?

The idea that MAC correlation to IP and other fingerprint data is some closely guarded secret in this age....doesn't that seem strange ?

Firefox 17.0.8 HAS BEEN

Firefox 17.0.8 HAS BEEN RELEASED TODAY.

Fixed in Firefox ESR 17.0.8

MFSA 2013-75 Local Java applets may read contents of local file system
MFSA 2013-73 Same-origin bypass with web workers and XMLHttpRequest
MFSA 2013-72 Wrong principal used for validating URI for some Javascript components
MFSA 2013-71 Further Privilege escalation through Mozilla Updater
MFSA 2013-69 CRMF requests allow for code execution and XSS attacks
MFSA 2013-68 Document URI misrepresentation and masquerading
MFSA 2013-66 Buffer overflow in Mozilla Maintenance Service and Mozilla Updater
MFSA 2013-63 Miscellaneous memory safety hazards (rv:23.0 / rv:17.0.8)

https://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html

Yes! Tor users will soon

Yes!

Tor users will soon have another opportunity to upgrade. :)

Hi Arma, So in confirming

Hi Arma,
So in confirming from the advisory, users on OSX running the latest version of TBB but had JS on were not affected regardless of JS being turned on?

I also assume that regardless of the exploit working or not, a person would still see the 'Outage' message on the page?

For example if an OSX user were running an older version of TBB, but had JS turned on they would still not be affected due to this being Windows based?

Correct.

NoScript should be enabled

NoScript should be enabled by default in the next version of TAILS (0.20).

What the fuck is torproject

What the fuck is torproject thinking still having javascript enabled by default?

The whole point of using tor is to stay anonymous, if people want easy access to the net they would use IE instead.

why the fuck would people want the biggest exploit enabled by default? Are they paid by you know who to keep the backdoor open?

https://www.torproject.org/do

https://www.torproject.org/docs/faq.html.en#TBBJavaScriptEnabled :

"we recommend that even users who know how to use NoScript leave JavaScript enabled if possible, because a website or exit node can easily distinguish users who disable JavaScript from users who use Tor Browser bundle with its default settings (thus users who disable JavaScript are less anonymous).

Disabling JavaScript by default, then allowing a few websites to run scripts, is especially bad for your anonymity: the set of websites which you allow to run scripts is very likely to uniquely identify your browser."

(all emphasis mine)

What a load of bullshit

What a load of bullshit excuses.

What they are saying is they recommend you to enable javascripts on all sites so they won't notice you're using tor, thus increase your anonymity.

These excuses may fool newbies, but not to anyone remotely tech savvy on browsers.

So what if they "uniquely identify your browser", as long as you never post personal information on tor they'll never know who is using that browser, and that is the whole point. Explain to me how all users have javascript disabled by default, and almost everyone enable javascript for youtube will 'very likely to uniquely identify your browser'?

Also it's not like it's hard to find out a visitor is from a tor exit node, hell the "Firefox 17.0.x" useragent alone is already a big sign someone is using tor.

Javascript expose so much more info about your browser and os (screen resolution, installed fonts, etc), now THAT is what is 'very likely to uniquely identify your browser', how do they explain that?

Anyone telling you having Javascript enabled is safer is sleeping with the FEDs, period.

Stop the lies and disable javascript by default, NOW.

The thing to know about Tor

The thing to know about Tor developers is that they have major hard ons for unlinkability and don't really care as much about untraceability. They think a win is if you go to website A and then website B, and 99% of the time the same attacker can not link you to both sessions. They don't care as much if 1% of the time any attacker can link you to either website A or website B. This is evidenced in a lot of the choices they have made: quick circuit rotation (even much quicker in the past at 30 seconds, raised only to reduce load on the network too), a suggestion to leave javascript enabled to reduce browser fingerprinting despite opening you up to an entire class of hacking techniques that could deanonymize you, etc. Tor developers have a different threat model in mind than a majority of their users do. You don't want to be traced ever even once, they don't want an attacker to determine that you went to Website A AND Website B.

They also are very concerned about getting as many people using the network as possible, and will sacrifice security for useability. This also contributed to their choice to leave javascript enabled. It also contributes to their choice to give you three entry guards even though you are much more secure with a single entry guard or possibly two. It is also why entry guards rotate so much. It is also why they bundle everything together and make it extremely hard to use individual components in custom configurations (oh we cannot ship Tor browser independently, some people might think it uses Tor even if it isn't configured to!).

So pretty much we have a few issues. The first issue is that our threat model is not the same threat model as the Tor people are focusing on. The second problem is that they have taken to pandering to idiots. The third problem is that they have taken to pandering to people who want to watch cat videos on youtube.

That doesn't make sense.

That doesn't make sense. Enabling javascript is EXACTLY what let them track you from website A to website B.

Let's take a look at torproject.org's frontpage, which states:
Anonymity Online - Protect your privacy. Defend yourself against network surveillance and traffic analysis.

Enabling javascript by default doesn't protect your privacy, period. Sugar coating it doesn't change the fact.

Many webs sites load javascripts from ajax.google.com and also from facebook.com for the 'like button' javascripts, and that gives them details to profile your browsing habbits. Combined with the 100s other tracking javascripts, and the http refer header, you're pretty much dead on the water as long as javascripts are on.

Tor was designed for privacy, I don't care what 'threat model' they are using, if they enable javascript by default then someone in that organization is sleeping with the FEDs. What is so hard to have it disabled by default and only enable it when you really need them? By enabling javascript by default they are tricking those non tech savvy people into leaking information to everyone out there.

More information on how 100s of companies are working together to track you online:
http://www.ibvpn.com/blog/2012/07/how-far-are-you-being-tracked-on-the-…

http://www.forbes.com/sites/kashmirhill/2012/02/29/heres-the-best-and-p…

http://www.alternet.org/story/153592/are_you_being_tracked_8_ways_your_…

Yeah you have a good point

Yeah you have a good point actually. The Tor developers reason for turning javascript on actually makes no sense at all. It doesn't protect you from linkability when you get fucking hacked through your browser and rooted. So pretty much their entire defense of turning javascript on has crumbled.

Right, Tor is a specialized

Right, Tor is a specialized tool to ensure privacy, that is its core function, its sole reason for existence.

The Torproject team should make it easy for people to maintain privacy, not make it easy for people to watch youtube. That means disabling javascript by default, not the other way around.

The Torproject team have lost their priorities and got it all backwards.

Something just isn't right.

You're right about what Tor

You're right about what Tor is -- it's a proxy which, when used correctly, tries to anonymize the traffic flows going through it.

Using this proxy safely, for browsing, introduces a world of new headaches. We have tried to address them with TBB, but it's certainly not easy. And keep in mind that TBB is relatively new compared to the Tor program itself.

See the end of the advisory for links to approaches that can make this better. And then help us do it!

BWAHAHAHA enabling

BWAHAHAHA enabling javascript is safer? Crack pipe please!

Javascript exposes your system's Time zone/Screen size/Color depth/System fonts, without even using any hacks, test it yourself:
https://panopticlick.eff.org/index.php?action=log

How the fuck is that safer? That's before we even talk about all the javascript exploits.

If javascript is safer noscript wouldn't attach the (dangerous) warning sign to it now would it.

Stop lying.

partners in crime? We've

partners in crime? We've been screaming about it for a while and the Devs said , ...move on, nothing to worry about and now here we go, a successful JS exploit on TOR. Great job guys!!

Hey retaaaaaards, if we

Hey retaaaaaards, if we wanted to surf the net easily we'd still be be using IE, make TBB turn off the damned javascript by default, NOW!

The only safe way now is to

The only safe way now is to install a new and clean windows in virtualbox, then install TBB, after that take a snapshot of the virtual machine, so you can restore it to a brand new state after each shutdown.

Set the DNS server to some bogus IP address also helps, no accidental connection to legit domains.

If you're willing to run

If you're willing to run stuff in a VM, I'd suggest running Tails in your VM.

Tails has more holes than

Tails has more holes than swiss cheese, it also enables javascript by default.

The user base for Tails is not large enough to detect hidden backdoors. At least with a new copy of windows you can have a firewall that lock things down PER PROCESS, you'd know exactly what program is making connection and block all processes except TBB. You can't do this with tails.

Suit yourself -- if you're a

Suit yourself -- if you're a Windows expert, go for it. Not many Tor users are Windows experts I bet.

Alas, your approach doesn't scale: Windows isn't free software, so that "new copy of windows" you describe is tough to distribute legally.

As for the Tails user base, their June statistics see a Tails boot every 18 seconds on average:
https://tails.boum.org/news/report_2013_06/index.en.html
That would seem to be quite a few users.

Stay away from PRISM,

Stay away from PRISM, people, use the Snowden torrc

#The Snowden torrc config
#Skips major Prism countries and only from a Russia IP
ExcludeNodes {us},{gb},{ca},{au}
ExitNodes {ru}

A while ago I was talking to

A while ago I was talking to people in Sweden who were lamenting Sweden's new "we log everything that goes across our national border" surveillance approach. These same people also pointed out that much of Russia's Internet traffic transits Sweden. Careful with this more-centralized-than-you-think Internet we've got.

Oh well at least the

Oh well at least the Russians won't suck US's dick by raiding exit nodes every time the US chucks a fit.

How can you know the Russian

How can you know the Russian Exit Nodes aren't maintainded by US?

This is funny, the noscript

This is funny, the noscript button states:
Allow Scripts Globally (dangerous)

And these torproject idiots LEFT IT ON by default?

https://www.torproject.org/do

https://www.torproject.org/docs/faq.html.en#TBBJavaScriptEnabled :

"we recommend that even users who know how to use NoScript leave JavaScript enabled if possible, because a website or exit node can easily distinguish users who disable JavaScript from users who use Tor Browser bundle with its default settings (thus users who disable JavaScript are less anonymous).

Disabling JavaScript by default, then allowing a few websites to run scripts, is especially bad for your anonymity: the set of websites which you allow to run scripts is very likely to uniquely identify your browser."

(all emphasis mine)

What a load of bullshit

What a load of bullshit excuses.

What they are saying is they recommend you to enable javascripts on all sites so they won't notice you're using tor, thus increase your anonymity.

These excuses may fool newbies, but not to anyone remotely tech savvy on browsers.

So what if they "uniquely identify your browser", as long as you never post personal information on tor they'll never know who is using that browser, and that is the whole point. Explain to me how all users have javascript disabled by default, and almost everyone enable javascript for youtube will 'very likely to uniquely identify your browser'?

Also it's not like it's hard to find out a visitor is from a tor exit node, hell the "Firefox 17.0.x" useragent alone is already a big sign someone is using tor.

Javascript expose so much more info about your browser and os (screen resolution, installed fonts, etc), now THAT is what is 'very likely to uniquely identify your browser'.

Cut the BS and disable javascript by default, NOW.

BS, javascript expose your

BS, javascript expose your OS/Screen resolution/Installed Fonts.

Anyone telling you having javascript enabled is safer is sleeping with the FEDs.

Who wrote that anyway? It's time to name names.

BWAHAHAHA enabling

BWAHAHAHA enabling javascript is safer? Crack pipe please!

Javascript exposes your system's Time zone/Screen size/Color depth/System fonts, without even using any hacks, test it yourself:
https://panopticlick.eff.org/index.php?action=log

How the fuck is that safer? That's before we even talk about all the javascript exploits.

If javascript is safer noscript wouldn't attach the (dangerous) warning sign to it now would it.

Stop lying.

These comments should be

These comments should be directed at the **TOR PROJECT** as I was merely **QUOTING** /their/ FAQ, found at:
https://www.torproject.org/docs/faq.html.en#TBBJavaScriptEnabled

and noting that the recent comments on the matter that were posted by "arma", an official representative of the very same Tor Project, glaringly contradict the statements in their FAQ that I quoted.

For this alone-- the glaring contradiction and the lack of any response to it thus far from anyone at the Tor Project (despite numerous other comments being posted by arma in the time since I pointed-out the contradiction)-- people should be alarmed and demanding an explanation, regardless of where anyone may stand on the question of JavaScript itself.

Tor is based on the

Tor is based on the crappiest browser in the world. Firefox sucks and sucks bad.

2012 was the year that Firefox was exposed.

https://www.nsslabs.com/reports/2012-browser-security-comparative-analy…

No kidding. But it's the

No kidding. But it's the best we've got, for now. I want to switch to Chrome, but it still has some enormous privacy vulnerabilities that are unfixed (and unfixable using the APIs provided).

https://blog.torproject.org/blog/google-chrome-incognito-mode-tor-and-f…

Any chance of looking at

Any chance of looking at Midori and QupZilla?

Please do!

Out of curiosity, are there

Out of curiosity, are there plans for a completely sandboxed bundle using an encrypted virtual machine without direct network access? Basically, only TOR itself runs on the host, and everything in the VM is firewalled (by the host) to only be able to communicate with TOR. There are a number of open-source VMs, and you could run a very minimalist distribution of linux inside the VM to cut down on image size.

The only multi-platform code to maintain would be the TOR binary (already ported), the VM, and whatever network rules are used to refuse the VM external access.

The path to exploit that would be:

Browser exploit granting unpermissioned user access
Permission escalation allowing for root access
OS exploit granting the ability to run arbitrary ring-0 code
a VM exploit granting you unpermissioned access to the host OS
another permission escalation on the host OS to remove the firewall rules.

Given that the vast majority use windows, and the guest OS would probably be linux, you'd need a perfect storm of vulnarabilities in two operating systems, a browser and a virtual machine, all unpatched.

Being a single browser hole away from complete de-anonymization is a completely untenable situation.

Yes. If you want to get the

Yes.

If you want to get the extra credit, you could run two VMs, and put the Tor client plus some good iptables rules in the second one.

See the references to Whonix and WiNoN at the end of the advisory.

I'm actually kinda pissed

I'm actually kinda pissed that taking down **ONE** single hosting company could inflict this much damage on the .onion sites.

Why don't we all just host on unpatched windoze servers while we're at it?

Don't worry, people will

Don't worry, people will adapt and something even more secure will surface. As long as the demand is there people will come up with something.

Arma, whoever you are,

Arma, whoever you are, thanks for being there and for bringing a little sanity to this issue. Your efforts are appreciated.

Hi Arma, Thanks for your

Hi Arma,
Thanks for your replies.
So in confirming from the advisory, users on OSX or Linux running the latest version of TBB but had JS on were not affected?
I assume that regardless of the exploit working or not, a person would still see the 'Outage' message on the page?

Also, if an OSX or Linux user was running an older version of TBB, but had JS turned on they would still not be affected due to this being Windows based?

Re OSX or Linux: yes Re

Re OSX or Linux: yes

Re Outage: they'd see whatever content was served by the hidden service website.

Did investigate in cookie

Did investigate in cookie mechanisms because I remember to saw a cookie N-serv once without having any JS functionality enabled. This is possible as cookies can be generated via HTTP alone. (I remember some long time ago TOR BB did not allow any cookies and when I accessed google I had to fill out a captcha).

I can imagine that this cookie even with that name was generated maybe to track my browser history. But without JS enabled there is no known mechanism (yet) that the real IP can be sent out. So I'm safe for now.

What would make it less vulnerable (I think) if Tor - Firefox can be patched to only be able to send out requests through TOR. If I understand it correctly in this case the exploit did sent out info through clearnet.

I agree with others that your IP in a FBI database is not enough to justify a raid, so the question is: Can the ISP monitor the traffic between TOR and 1st node or is it encrypted to block further data analysis.

Definitely a wake up call to more think about where we browse and if it's worth the risk. But I think TOR is doing a good job and I want to thank all who are involved in this project!

Strange to hear that in GB the police can force you to reveal the PW of a container. How do they detect that a certain file is a container (I use TC) ? If yes, are there tools to further 'process' a container file to not get recognized (TC->PSR, PSR->TC) ?

Hi Brand new question

Hi Brand new question here.

If I had a Paid VPN running, and then ran TBB on top of that (Latest patched version with 17.0.7) BUT NO SCRIPT SET TO "ALLOW ALL GLOBALLY" have I been compromised??
Will the exploit by pass my VPN in addition to TBB???

Also is TOR safe from IGMP and ICMP exploits?
No one has a answer for that.
Does that mean TOR is vulnerable to ICMP and IGMP attacks?

Re the VPN, the connection

Re the VPN, the connection made by the exploit would likely go over the VPN. So you would be sending your hostname and MAC address via the VPN. Whether that counts as "safer" depends on your VPN provider, but it's probably an improvement. See above comments about VPNs too.

Re the IGMP and ICMP attacks, can you provide details? I'm guessing the answer is either "what the heck, those aren't attacks" or "why did you think Tor defends against an attack on that level?"

OH SHIT! I do have the

OH SHIT!
I do have the latest version of TOR and Firefox, but had No Script set to Allow ALL globally.

But I still remember my RAM peaking to its FULL capacity and browser wanting to shut down some days back!!!

Since this exploit works by overflowing browser's RAM, does that mean I'm fucked even if I had the latest version of TOR and FF????

The latest version of TOR

The latest version of TOR and Firefox is unaffected by this specific Javascript
The Javascript does not fill all the RAM, it just go over an array (limited RAM size) bound.
The Javascript also make the browser crash and exit, after executing the payload.

I wouldn't have thought so.

I wouldn't have thought so. In the advisory:-

"This vulnerability was fixed in Firefox 17.0.7 ESR. The following versions of the Tor Browser Bundle include this fixed version:

2.3.25-10 (released June 26 2013)
2.4.15-alpha-1 (released June 26 2013)
2.4.15-beta-1 (released July 8 2013)
3.0alpha2 (released June 30 2013)"

If you have Firefox 17.0.7 ESR then the exploit won't have worked. Period.

Sooo, how can we tell which

Sooo, how can we tell which dark sites are hosted with Freedom Hosting before we click on them?
Say if they come back online under the FBi control and who knows what sort of codes injected into them for track and trace.

Now can we get an update for

Now can we get an update for the Windows Obfsproxy TBB? Please, pretty please?

Keep an eye

Keep an eye on
https://trac.torproject.org/projects/tor/ticket/9391
Real Soon Now I hope.

A question please. I

A question please. I downloaded TBB version 2.3.25-10 some time in mid July, but I just checked and it apparently shipped with 17.0.6 ESR, not 17.0.7... yet this article seems to suggest all 2.3.25-10 versions included the 17.0.7 ESR fix, which in my case obviously isn't true. Please correct me if I missed something.

And is the 17.0.6 ESR vulnerable to this exploit? Clarification would be appreciated.

2.3.25-10 included Firefox

2.3.25-10 included Firefox 17.0.7 ESR.

What did you "just check"? It sounds like you are confused about which TBB version you have.

(17.0.6 ESR is vulnerable.)

Thanks for the reply Arma.

Thanks for the reply Arma. To clarify, the TBB 7zip file name I downloaded (mid July) was 2.3.25-10_en-US. When I ran that browser, and clicked Help>About TorBrowser, it said Firefox ESR 17.0.06. I'm quite certain of that. So my conclusion is that not all TBB 2.3.25-10 versions included 17.0.07 ESR, as this article seems to suggest.

Tails ? Was that infected

No. (Read the advisory!)

so, Devs.... still think

so, Devs.... still think making users turn off JS every time a good idea???

We've all been yelling why JS was enabled by default and I've never seen a 1/2 way decent answer from you guys on that one. I make it through 98% of my computing w/JS off, why is it worth it to have it left on by default?
Honestly, I'm asking for real now that we've seen a successful JS based attack on TOR?

Do the math, man. The devs

Do the math, man. The devs are themselves compromised.

The real answer needs to be

The real answer needs to be getting people off the "run an application in Windows and think it can possibly be secure" model.

Whether that's Tails in a VM, or getting them to boot Tails directly, or some other VM-based approach like WiNoN or Whonix... we need more help from the whole community here to get these things both usable and well-analyzed. Don't just sit back and wait for us to do it.

For a bunch of people who

For a bunch of people who surf onion sites, there seem to be an awful lot of paranoid people here. Me thinks perhaps your Tormail and surfing activities might be a little questionable huh? Particulartly if you used Freedom Hosting which was basically a disguise for CP.

"For a bunch of people who

"For a bunch of people who surf onion sites, there seem to be an awful lot of paranoid people here."

It takes onions to surf .onions...

Hello everybody! Well, there

Hello everybody!

Well, there is a lot of fear flowing through every single post around this issue since it came out to light. This is causing doubleposting asking the same questions again and again ... and overall self answers in some cases trying to calm oneselves and others feeling dispair.

First, lets calm our minds ... if we do not we are losing it and the more fear the more mistakes we will commit and the less time to do whatever we can do to get back on our feet.

Second, lets stick to the source ... a LOT of speculations from being a hackattack to being a worldwide raid to stop Tor, that if the exploit installed a cookie, or that is a crash is an unmistakable proof one was compromised ... PLEASE ... Tor developers are our best source of information ... so I propose to stick to the info they are leaking ...

If it is said that using the latest bundle keeps us safe regardless of the javascript configuration on FireFox nor in the NoScript ... LETS STICK TO THAT! ... unless we have proof otherwise ... We need to avoid the path to the paranoia and in the way getting others paranoid ... we have to think with a COLD heart and even a COLDER mind ...

Third, people here are very worried since some of them were sneaking in illegal sites that they are unmistakably going to jail because of that ... WELL ... always reember the SURPRISE FACTOR is key to a successful legal raid ... here .. they dont have it anymore ... deducing and maybe i am not good at it but i will give it a shot , this exploit was inteded only to shut down TOR ... why ... well ...

Fourth, I CANNOT BUT FIND A PATTERN OF THE U.S. EVAQUATION OF EMBASSIES IN THE MIDDLE EAST BECAUSE THEY FOUND INFORMATION OF AN IMMINENT ATTACK ... that ... was days after FH was shutted down ... lemme speculate ... they found that information flowing somewhere in the FH sites, etc ... I cannot but see a pattern there ...

Fifth, yes ... if users are using TOR to cover illegal activites, satisfying illegal appetites ... yeah ... a goverment would be interested in detaiining some of you ... but ... i think all this was a terrorist counter intelligence of the NSA to stop some terrorist organizations that communicate through Tor ... they are hell more interested in THEM ... than in you ... unless you are dealing with tons of illegal substances and illegal material ... and i mean .. otherwise I dont think this will go further unless some of you are a big fish in the same scale of a terrorist organization... or even a terrorist.

Sixth, ... Tor has absorbed the hugest hit in its history ... but after Snowden revelations people has realized the need of doing whatever it takes to fight for our right to privacy ... I have less than a month using Tor and what brought me here is that i felt sick of the Snowden revelations about how the espionage has no limits ... when for somebody EVERYBODY else is a potential threat ... there is where the decomposition starts ... where the Republics become Empires ... and where the resistance starts... lets not forget that ... so ... i urge people that more now than never tor requires that we run RELAYS and not only clients ... Tor is under attack and depends on us this project suvivies ... if the fear startegy works and nobody keeps supporting running relays, ... they will succeed in geting rid of one of the latest places one can truely be private ... and they would have won ... lets keep runnng the relays and for the ones that are not running them is a good moment to start.

Hope nobody got upset with this post ... just trying to bring my 2 cents here.

Take care.

Clarification required

Clarification required please - It says on this site that TBB 2.3.25-10 (released June 26 2013) uses FF 17.0.7 ESR. I downloaded 2.3-25-8 on 23 June, but when I check it uses FF ESR 17.0.7.
Is my TBB vulnerable?

https://gitweb.torproject.org

https://gitweb.torproject.org/torbrowser.git/blob/HEAD:/changelog.windo…
seems to think that TBB 2.3.25-8 shipped with Firefox 17.0.6 ESR.

I think you're confused about what you downloaded.

The advisory recommends

The advisory recommends ("you might like") the Request Policy add-in to improve security. The advice that appears on the download page, however, discourages us from installing add-ins to the Tor browser. These recommendations conflict; what's the resolution?

Up for debate! Join IRC, the

Up for debate!

Join IRC, the mailing lists, and trac, and help us get the right balance.

I am running Firefox ESR

I am running Firefox ESR 10.0.9. When I go to Help | About | and press the "Update" button, the message that returns says that I have the current version. Yet this advisory refers to a later version of the browser as the current one. What am I missing?

I don't think you can update

I don't think you can update the Tor browser bundle using the update button in the help window. You have to download the Tor browser bundle from https://www.torproject.org, delete the folder with the old version of the Tor browser bundle and uncompress the new version.

Correct.

Would enabling the NX bit

Would enabling the NX bit for ALL the softwares in Windows have prevented this exploit from running?

If so, wouldn't be a good idea to warn the user about it when starting Tor and the Tor Browser? A message like "Your system seems to support the NX bit but it is currently enabled only for Windows Services, you should enable it for all the programs in order to avoid running exploits which could deanonymize you".

I remind everyone that to enable the NX bit on their Windows machines they can follow this tutorial: http://www.itechtalk.com/thread3591.html (usually you don't need to add anything to the exclusion list).

Renton Thurston

P.S.: Changing this setting requires you to reboot.

At what date was the

At what date was the malicious code placed onto the Freedom Hosting sites? How long had it been there before it was detected?

As far as I know from what I

As far as I know from what I have been reading is that it could be no less than 1 week but likely closer to 2 weeks before Aug 4th.

sorry, where is that

sorry, where is that timeframe coming from?

Quick question - isn't

Quick question - isn't leaving Firefox behind and adopting Iceweasel like TAILS a better idea for TBB?

What makes you think that

What makes you think that Iceweasel is more secure?

Iceweasel is Firefox with a

Iceweasel is Firefox with a different logo and name.

"Iceweasel is Firefox with a

"Iceweasel is Firefox with a different logo and name. "

That's what I (and I would daresay /most/ people) always thought.

But then, some time back, one of the Tails devs made a post in the (no longer active) Tails forum stating that there were at least /some/ actual substantive differences between Iceweasel and Firefox. (Namely, certain "patches" in Iceweasel, IIRC)

As for the difference, if any, between Iceweasel and Gnu IceCat, I'm still at a complete loss.

Could someone explain

Could someone explain exactly what the exploit did? Did it just take over the browser, and deidentify the user, or did it compromise the machine completely? Also, I'm assuming that standard non .onion sites were not used as an attack vector (or am I wrong?).

The attack exploited a bug

The attack exploited a bug in Firefox's onstagechange handler, which allowed arbitrary code execution. In principle, if you were running Firefox older than 17.0.7 ESR, anyone could use this exploit to do anything they like as the user your browser was running under, regardless of what OS you use. In practice, in this specific case it seems that only Windows users were affected. The code that they chose to run was a program which grabbed the name of your computer and the MAC address of its network adapter, and sent these over a non-Tor connection to an as yet unknown server somewhere in the USA. It doesn't look like it did anything more than this.

Since at the same time the exploit installed a tracking cookie, anyone who was vulnerable to the exploit and who browsed Freedom Hosting sites while they were up should assume that whoever the attacker is has your IP address, the hostname of your computer, its MAC address, and a list of the pages you visited, and when.

It's unlikely that non-onion sites were targeted with this specific attack payload. However, you should be aware that the exploit code is now public, and in principle anyone could install it on their website and try to use it to unmask Tor users. Also, it's possible for malicious exit nodes to inject the exploit, including the malicious payload, into reponses from non-encrypted HTTP connections, thus exposing you to the attack without you knowing.

Advice: upgrade your browser, don't use Windows, and realize that this isn't the first or the last time that Firefox will fall victim to a security vulnerability.

Oh dear, PLEASE help. If

Oh dear, PLEASE help.

If someone had not updated TOR since May and erm java was enabled.
They also had some incriminating evidence on tormail.

Would advise them to get out of country if there country had not so friendly governments?

Again, please help.

I would tell that person not

I would tell that person not to worry at this point, because the exploit only tells the U.S. feds that person visited Tormail during the time the exploit was running (probably only the last week) and may correlate the time they visited with activity in Tormail server logs. However U.S. law enforcement is not allowed to examine the contents of the Tormail server without a proper warrant, and nothing has been shown so far that Tormail was a law enforcement target.

I always use TBB latest

I always use TBB latest version with JS off, so I don't worry about the recent upsets for me.

My concern is, however, whether my machine's obfsproxy bridge setting through the other port and the other Tor and privoxy's (polipo cannot handle obfsproxy smoothly-) job process that I aimed to assist dissidents' access from restricted countries to their necessities is safe or not.

If obfsproxy clients with TBB had been affected the exploit, did their requests to my machine bridging to Tor network expose my ip and MAC address?

You are asking whether

You are asking whether vulnerable TBB users who configured their TBB to use your bridge would end up running code on your bridge? No, they won't.

Thanks for reply. I meant

Thanks for reply.
I meant exactly what you interpreted. I'll continue my machine's obfsproxy bridge to facilitate dissidents' accesses to Tor network.

Hi you all there. I have two

Hi you all there. I have two questions... of which, one is a bit off topic ...
What do you think about using tor not just with the bundle but route the whole pc traffic trough it? (Im on Gnu/linux of course...)What are cons and pros?
I mean ... as a solution for ordinary people and their daily browsing. So no whistleblowing, hidden services or something. People who have "nothing to hide" but are not so stupid to give away their privacy to some pigs.

And the second...would it be safer for bimbows users to route the internet traffic not in their machines but in the router? For example installing tor on dd-wrt router so all the OS build-in malware couldnt bypass tor so easily. Im no tech pro so maybe its a bit stupid question... but it makes me curious...

Tails used to route all

Tails used to route all traffic into Tor by default. They changed their policy a year or two back, to configure the proxy settings on all applications that they knew would talk safely through Tor, and set the firewall rules to drop all other connections. The idea is that if an application hasn't been specifically configured to use Tor correctly, it will probably use it incorrectly, so it's better to prevent it from talking to the network at all.

See https://blog.torproject.org/blog/bittorrent-over-tor-isnt-good-idea for an example of how things can go wrong with an application that doesn't care about privacy.

I think I understand... So

I think I understand... So if I would like to use my day to day linux install with tor... I would need to set all applications to tor.

But what abut the idea setting my dd-wrt router to work with tor? I man... installing tor into the router ... so the router would route all the traffic trough tor network... Is something like this possible?

It is possible, but you're

It is possible, but you're likely to screw up your privacy. See the "Bittorrent over Tor isn't a good idea" post for an example of how you'll lose -- your bittorrent application will end up "anonymously" sending out your IP address in its application-level traffic, and things will go downhill from there.

So, I've been keeping my

So, I've been keeping my version of TBB up to date, but I haven't disabled javascript manually in Noscript. Am I compromised?

Sigh I don't know why you

*Sigh* I don't know why you people seem unable to read before posting. It CLEARLY says in the advisory at the TOP OF THIS PAGE -

"This vulnerability was fixed in Firefox 17.0.7 ESR. The following versions of the Tor Browser Bundle include this fixed version:

2.3.25-10 (released June 26 2013)
2.4.15-alpha-1 (released June 26 2013)
2.4.15-beta-1 (released July 8 2013)
3.0alpha2 (released June 30 2013)"

So no, if you have Firefox 17.0.7 ESR the exploit will not have worked notwithstanding whether you had Javascript disabled or not.

Quick question - I have the

Quick question - I have the latest version of TBB, but I didn't have javascript disabled manually in Noscript. Am I compromised?

If maybe arma could confirm

If maybe arma could confirm this, but from my understanding, in firefox 17.07. Visiting one of the infected web pages would produce a XML Parsing error, were if you had a vulnerable browser but had JS disable in either the browser settings or noscript. You would have saw "down for maintenance" page, but do to JS being off the code would not be able to run

To: Webmaster/Website

To: Webmaster/Website Admin

At the time of writing, I noticed there are 456 posts before mine.

I wonder why the webmaster of this web site did not consider asking users to register and post at http://torforum.org

The current display of posts on this web site appears clunky and disorganized.

Yeah, this blog is a poor

Yeah, this blog is a poor forum, I agree.

And we do need a forum.

But we need one that competent Tor people will contribute to regularly, or it will just be a bunch of wrong users being wrong at each other. I have no idea what torforum.org is, or who runs it (hint: Tor doesn't), and that's not a good sign.

See also recent blog posts here about our stackexchange plans.

Ashish Garg writes: If we

Ashish Garg writes: If we disable javascript, there is no point using TOR because these days we can't open any website without javascript-enabled browsers; we can't log onto Facebook, yahoo etc.

Not all websites use

Not all websites use Javascript (although I accept a lot do).

I hope you;re not suggesting that people use TOR to login to sites like Facebook, yahoo? You SHOULD NOT be accessing any clearnet sites through TOR!

Why not? Well... I dont care

Why not? Well... I dont care about FBshit... but for what purpose should one use Tor if not for anonymity? Why darknet only? Isnt the diversity of users the main pillar for privacy by design here? Really... why shouldnt I use Tor for clearnet?

Ignore the post above yours.

Ignore the post above yours. Tor is designed to be used on clearnet to allow you to browse the internet anonymously. Probably the majority of users use it that way, to visit regular websites. That is why they leave javascript on by default.

Plenty of people use Tor to

Plenty of people use Tor to log in to Facebook. Even if they're ok telling Facebook what their account is, they still don't want Facebook (or somebody surveilling Facebook) to know where they're located currently, and they don't want their ISP to know where they're connecting.

Also, there are whole countries where Facebook is blocked, and many tens of thousands of people use Tor to reach it anyway.

There are many different angles to anonymity, and this diversity is part of what contributes to Tor's security.

Do people think that an

Do people think that an attack like this one could work against a system like TAILS? As I understand it, this code sends the collected information over a non-Tor connection to the internet, and TAILS supposedly blocks all non-Tor connections to the internet. Or would it be possible to get around that blocking?

In Tails it would have been

In Tails it would have been blocked by iptables rules, however even if Tails is a lot more well structured for anonymity purposes than Windows no system is safe when an attacker can execute some arbitrary code on your machine.

Right.

If you got the "Sorry, This

If you got the "Sorry, This server is currently offline for maintenance" message when visiting an infected site does that mean you have been exposed or would everyone have seen the message even if their setup was safe from the exploit?

Everyone would have seen the

Everyone would have seen the "offline for maintenance" message when the sites were down because, well they were down :-) no matter whether you had a vulnerable browser or not.

not long time ago nvidia

not long time ago nvidia released new drivers which didnt like firefox (bsods and other stuff) - they blamed microsoft for some old bug or something. could there be a connection ?

LOOK FOLKS; Quit with the

LOOK FOLKS;

Quit with the idiotic discussions related to Gosh, I'm a poor misunderstood pedophile ... Am I going to prison? ... and How? ... and Why? ... and how can I squirm out of it ??? etc., ad nauseum.

The simple answer is YES !!! if you're a God Damned Pedophile ... YOU ARE GOING TO PRISON ... So Just STFU and accept it.

Apparently nobody spent the time to teach you the basics of ABSOLUTE MORALITY ... a quaint custom Wherein Children are both innocent and worthy of Actual Love ... That means that you are almost certainly a Progressive Democrat, possessed of Relative Morality, which means that we can get along without your presence quite nicely.

As far as the rest of us are concerned, The REAL and only serious problem is the loss of TOR MAIL.

With the known death of Freedom Hosting and the catastrophic (and permanent) demise of Tor Mail, it is incumbent upon some TRUSTWORTHY organization to reincarnate Tor Mail as quickly as possible.

That organization ... MUST, ABSOLUTELY, BE TOR ITSELF.

There is NO OTHER anonymous email service in existence that can take it's place and there is NO service provider OTHER THAN TOR that will be TRUSTED to carry on the name, particularly since, should TORMAIL suddenly reappear on the Onion network, It will be assumed (correctly) to be controlled by the NSA and FBI.

TOR will never be compromised by the Intelligence Mega-plex, simply because they use it themselves ... a fact recently illustrated by the effective destruction of the Dot-Onion network NOT associated with TOR itself.

TOR can accomplish this in less than Two Weeks ... Kindly Do So.

TemplarKnight@tormail.org ... At least, that's who I used to be.

The next worst thing is

The next worst thing is people telling everyone to shut up followed by angry ramblings.

http://arstechnica.com/tech-p

http://arstechnica.com/tech-policy/2012/06/fbi-halted-one-child-porn-in…

>wangstramedeous | Ars Praetorian Tue Jun 12, 2012 1:55 pm

>Child pornography is a symptom of a larger malaise in society, namely child abuse and exploitation. Simply putting so much emphasis on one medium of distribution (media delivered via the internet) suppresses and ignores what is going on all around us. Really, its a snap shot of a reality that is part of the fabric of society. Destroying the evidence of it in one aspect does nothing to address it.

>It is simply an act of making unseen what is clearly a problem more widespread and larger than people looking at videos and pictures. Even if we were to imagine that we wiped out every single cache available online, it ignores that one of the most vulnerable segments of our population is still being exploited. The lopsided nature of policies targeting people that consume the media vs people who actually engage in abuse belies this.
.......

http://news.cnet.com/8301-13578_3-9899151-38.html

>by PzkwVIb March 21, 2008 4:55 AM PDT

>If people are abusing children and producing child porn, then go after them. [...]downloading such material does not harm a hair on a child's head. [...]Making possession, which on the net can even mean hidden thumbnails on web pages, is just plain Stupid.
[...]

>but as a law enforcement official or a politician you get the same boost in popularity if you go after the easier to catch people than the ones actually harming children.
_________
It would seem to me that the more people who view "pedo/CP" material and sites, the more chances for predators to be exposed and their victims identified.

I am fairly certain that at least one child-rapist is now, finally, behind bars as a direct result of evidence I saw at a "pedo"-oriented site and acted-upon. Yet, both myself as well as the people who cooperated with me put ourselves at risk in coming forward and presenting the evidence.

"Sunlight is the best disinfectant."

"The love between men and

"The love between men and boys is at the foundation of homosexuality. For the gay community to imply that boy-love is not homosexual love is ridiculous." - "No Place for Homo-Homophobia.", San Francisco Sentinel, March 26, 1992

"Shame on us if our lesbian/gay voices remain silent while our
NAMBLA brothers are persecuted once again, and shame on those
lesbians and gay men who will raise their voices to condemn NAMBLA,
insisting that boy lovers (and presumably the boys they love and who
love them) are not part of this thing called the lesbian/gay
community."
- Steve Hanson, "Shame on Us.", Bay Area Reporter, January 23, 1992

"NAMBLA is by no means on the fringe of the "gay rights" movement. For years, it was a member in good standing of the International Lesbian and Gay Association (ILGA), and was only jettisoned by ILGA when the parent organization applied for United Nations consultative status in 1993. Years earlier, the ILGA itself had resolved that "Young people have the right to sexual and social self-determination and that age of consent laws often operate to oppress and not to protect." "
- http://www.lifeissues.net/writers/clo/clo_09homosexuality.html

Note that the "love" being referred-to in the above quotes is little more than an Orwellian euphemism for the buggering and sodomizing of tender youth by adult males.

(This is particularly disturbing when one considers the distinct physical as well as psychological disadvantage that the *receptive* partner in anal penetration is placed at: The bulk of the considerable risk of deadly infection as well as injury, ALL of the pain, discomfort and inconvenience that are endemic to this act, etc. )

"Note that the "love" being

"Note that the "love" being referred-to in the above quotes is little more than an Orwellian euphemism for the buggering and sodomizing of tender youth by adult males."

What is your agenda here? Do you know all of the people in question personally and know for a fact it's all anal rape? Because you can't be more wrong, and that's a fact. Your claim is as silly and misinformed, as saying that all love between man and woman is limited exclusively to him sodomizing her and nothing else.

The love referred in the quotes above is what it should be - admiration, emotional comfort, having feelings to each other. What's wrong with that? Just because you can't imagine love without sex, doesn't mean everyone else is like that. And I don't claim sex can't be involved in this kind of relationship, but it can go both ways, with the younger partner being in charge. But sex is not required for love. You are taking the worst criminals, rapists and molesters, and project their deeds onto an entire group of people, because you don't understand them, and because they can't defend themselves, due to current laws. Try to say the same about black people or women, that they only rape each other and know no love.. let's see how you'll fare then.

What's disturbing is your comment and the way you twist facts to show other social groups as subhuman. Do you only rape your women/men? No? Neither do the people you accuse, in most of the cases. There are a few bad sheep, but aren't they common in all social groups?

I'm sorry for being off-topic here, but a voice of common sense, reason and simple human compassion was necessary. Even so so, my defense of those who deserve defending, will be seen as 'pedophile defense' so thanks God for TOR and the freedom of speech it enables.

Sorry if it was already

Sorry if it was already asked, i can't find it. Is there any reliable information on what date the exploit could have been online for the first time?

You mean either you didn't

You mean either you didn't look at all, or you didn't look very hard as the answer is posted a mere 18 post above users...

"As far as I know from what I have been reading is that it could be no less than 1 week but likely closer to 2 weeks before Aug 4th."

Poster is asking for

Poster is asking for 'reliable information'. Where did 2 weeks before 4th august info come from? Can the original poster provide a link?

The exploit caused browsers to crash out, so I guess it cant have been too far in the past. When did Tormail users start spotting issues?

yes, any idea where this

yes, any idea where this timeframe comes from?

Interesting coincidence that

Interesting coincidence that the big terror alert in Yemen coincided with the Tor exploit. All the talk is about CP sites. But was the exploit used against terror sites too? Or were they the real target and the CP sites "bonus"? Was the breach of Tormail related to the terror alerts???

If I had to pick my

If I had to pick my conspiracy theories, I'd be more inclined to guess that the timing of the Yemen publicity is more related to the "should we allow NSA to do this surveillance stuff" arguments that America is having right now.

I do not like that Vendetta

I do not like that Vendetta movie but its really like "... and now we show you how really you need us"

I've read through all of the

I've read through all of the above comments, and one of the questions I still have is in regards to the mechanism that this exploit uses to send the gathered information back out through clearnet. Does it have it's own means to access your internet connection? Or does it use your existing browser to send the information? If the latter, would running an updated version of FF (such as v.22) block this on the way out, or does the version only matter on the way into your system? TIA for anyone who answers.

Also, in spite of all of those who want to blame those of you at TOR for this, thank you for all the hard work you've done.

Tor security advisory: Old Tor Browser Bundles vulnerable

Comments