Stories
Slash Boxes
Comments

SoylentNews is people

posted by takyon on Tuesday August 01, @08:52AM   Printer-friendly
from the click-our-summary's-specially-crafted-URLs dept.

"This release features an important security update to Tor Browser for Linux users. On Linux systems with GVfs/GIO support Firefox allows to bypass proxy settings as it ships a whitelist of supported protocols. Once an affected user navigates to a specially crafted URL the operating system may directly connect to the remote host, bypassing Tor Browser. Tails and Whonix users, and users of our sandboxed Tor Browser are unaffected, though."


Original Submission

This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough

Mark All as Read

Mark All as Unread

The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
(1)
  • (Score: -1, Flamebait) by Anonymous Coward on Tuesday August 01, @08:59AM (1 child)

    by Anonymous Coward on Tuesday August 01, @08:59AM (#547566)

    Tor is for child-molesting fags.

    • (Score: -1, Troll) by Anonymous Coward on Tuesday August 01, @10:28AM

      by Anonymous Coward on Tuesday August 01, @10:28AM (#547583)

      Tor is for child-molesting fags.

      It's all true!

  • (Score: 0) by Anonymous Coward on Tuesday August 01, @09:29AM (3 children)

    by Anonymous Coward on Tuesday August 01, @09:29AM (#547570)

    We believe that previous versions of Tor Browser are affected as well (definitely 6.5.2 which I tested).

    There is no particular version this bug got added as the offending code has been in Firefox for years.

    - source [torproject.org]

    • (Score: 2) by kaszz on Tuesday August 01, @11:37AM

      by kaszz (4211) on Tuesday August 01, @11:37AM (#547595) Journal

      That might explain some busts in the last years.

    • (Score: 2) by frojack on Tuesday August 01, @08:18PM (1 child)

      by frojack (1554) Subscriber Badge on Tuesday August 01, @08:18PM (#547743) Journal

      Are we sure it has anything to do with firefox, and not the linux TCP stack?

      I saw a longish discussion on the the opensuse list about this very issue not long ago.

      The application does not have total control of the routing. Any leakage of ultimate destination IP back to the client TCP stack will often trigger route metrics ("cost") to kick in if there are ANY other routes defined and enabled with lower metric.

      --
      No, you are mistaken. I've always had this sig.
      • (Score: 2) by FatPhil on Wednesday August 02, @08:25AM

        by FatPhil (863) <{pc-soylent} {at} {asdf.fi}> on Wednesday August 02, @08:25AM (#547873) Homepage
        It's because of the design of GVfs (the Gnome Virtual File System, not to be confused with GnomeVFS, the Gnome Virtual File System). The linux TCP stack can happily exist without GVfs/GIO being on the system, so no, it's not the Linux TCP stack that's to blame. That's like blaming bank robberies on highways because getaway drivers use them.
        --
        I was worried about my command. I was the scientist of the Holy Ghost.
  • (Score: 2) by kaszz on Tuesday August 01, @11:31AM (3 children)

    by kaszz (4211) on Tuesday August 01, @11:31AM (#547592) Journal

    If security really matters, then sandboxing is at least a minimum measure to take.
    And the sandbox should not even be aware of what the real local network it is operating in.

    • (Score: 1, Insightful) by Anonymous Coward on Tuesday August 01, @12:30PM (2 children)

      by Anonymous Coward on Tuesday August 01, @12:30PM (#547607)

      You need to have the system running TBB on an isolated network with a firewalled proxy that in turn only allows Tor connections out. If you did this, as I have, then this direct connect exploit doesn't affect you.

      A VM might be a less secure alternative, but physical system isolation is still the best bet, especially with dumb non-embedded ethernet devices just in case any of management engine systems in use actually CAN be triggered with coded ethernet/IP messages.

      • (Score: 0) by Anonymous Coward on Wednesday August 02, @08:57PM (1 child)

        by Anonymous Coward on Wednesday August 02, @08:57PM (#548111)
        That system probably has to run something popular too. Otherwise if you're the only person in the world running it, it starts becoming more and more identifying ;).
  • (Score: 5, Informative) by Arik on Tuesday August 01, @11:43AM (6 children)

    by Arik (4543) on Tuesday August 01, @11:43AM (#547596)
    Once again the former gives a bad name to, well, anyone foolish enough to ship it.
    --
    "Unix? These savages aren't even circumcised!"
    • (Score: 3, Informative) by kaszz on Tuesday August 01, @12:41PM (3 children)

      by kaszz (4211) on Tuesday August 01, @12:41PM (#547611) Journal

      GNOME needs systemd which is a product of RedHat. Which is controlled by its chairman Shelton. That is a career military officer.

      Anyone got the message? ;-)

    • (Score: 2) by FatPhil on Wednesday August 02, @08:29AM (1 child)

      by FatPhil (863) <{pc-soylent} {at} {asdf.fi}> on Wednesday August 02, @08:29AM (#547875) Homepage
      Yeah, I was going to post something similar, framed around the following rhetorical question:

      So, who should we blame for this - RedHat (current majority contributor to Gnome), well known for things such as systemd, or Miguel de Icaza (originator of Gnome), well known for trying to push .NET into Linux?
      --
      I was worried about my command. I was the scientist of the Holy Ghost.
      • (Score: 0) by Anonymous Coward on Wednesday August 02, @06:48PM

        by Anonymous Coward on Wednesday August 02, @06:48PM (#548049)
        Pretty sure de Icaza hasn't had anything to do with GNOME - or working - for years. He got a cushy sinecure from Microsoft after he endorsed .NET iirc.
  • (Score: 0) by Anonymous Coward on Tuesday August 01, @06:53PM (2 children)

    by Anonymous Coward on Tuesday August 01, @06:53PM (#547727)

    hmmm .. affected here.
    so where and how does one edit this "whitelist" in firefox?
    I am pretty sure it can be used for other nefarious tasks that don't involve tor ... *humph*

(1)