Tor is kind of a big deal in internet security, but that seems to have changed overnight.

If I understand correctly (which I might not, but the gist is right), the US launched an attack against the Tor Windows browser bundle by owning a bunch of exit nodes[1], then injecting HTML into the responses, exploiting some kind of zero day JS interpreter flaw in Firefox 17-21 (fixed in 22) to implant an iframe, which when the user disabled Tor in their browser, was accessed from their own IP address, so the iframe’s target server logs show all. This is what you might call proper black hat shit.

This even hit the BBC under a headline where the Tor guys advise against using Windows, but this is bullshit from what I understand (just like shipping a secure browser bundle with JS enabled) – the attack would work against an underlying Linux OS just as effectively, it just happened to be written for Windows – the flaw was in Firefox, not the OS.

It’s very worrying to see this kind of attack on the free internet. For many people today, fascism is something you see in films and has never been experienced first hand by anyone or anyone they know, so it has a sort of safe remoteness to it. Remember that only 70 years ago, a certain class of moustachioed dictator would have regarded access to this kind of domestic surveillance as a tool for rounding up and dealing with undesirables to be some kind of cruel science fiction invented to taunt him about the shortcomings of his own system.

[1] There are so few that it’s trivial for a well funded agency to have a massive understanding of the network simply by making sure they are providing a significant proportion of the exit nodes. Tor has never been able to withstand a serious attack because it’s never been big enough, but this is the first we’ve known that it is actually under a serious attack.


I like blogging

Tagged with: , , , ,
Posted in Uncategorized

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: