Tor Browser 7.0.7 is released

by boklm | October 19, 2017

Tor Browser 7.0.7 is now available from the Tor Browser Project page and also from our distribution directory.

This release updates Firefox to 52.4.1esr, HTTPS-Everywhere to 2017.10.4 and NoScript to 5.1.2. On Linux the content sandboxing is now enabled. This release is also fixing some crashes and adding a donation banner starting on Oct 23 in order to point to our end-of-the-year 2017 donation campaign.

The full changelog since Tor Browser 7.0.6 is:

  • All Platforms
    • Update Firefox to 52.4.1esr
    • Update Torbutton to 1.9.7.8
      • Bug 23887: Update banner locales and Mozilla text
      • Bug 23526: Add 2017 Donation banner text
      • Bug 23483: Donation banner on about:tor for 2017 (testing mode)
      • Bug 22610: Avoid crashes when canceling external helper app related downloads
      • Bug 22472: Fix FTP downloads when external helper app dialog is shown
      • Bug 22471: Downloading pdf files via the PDF viewer download button is broken
      • Bug 22618: Downloading pdf file via file:/// is stalling
      • Translations update
    • Update HTTPS-Everywhere to 2017.10.4
    • Update NoScript to 5.1.2
      • Bug 23723: Loading entities from NoScript .dtd files is blocked
      • Bug 23724: NoScript update breaks Security Slider and its icon disappears
    • Bug 23745: Tab crashes when using Tor Browser to access Google Drive
    • Bug 22610: Avoid crashes when canceling external helper app related downloads
    • Bug 22472: Fix FTP downloads when external helper app dialog is shown
    • Bug 22471: Downloading pdf files via the PDF viewer download button is broken
    • Bug 22618: Downloading pdf file via file:/// is stalling
    • Bug 23694: Update the detailsURL in update responses
  • OS X
    • Bug 23807: Tab crashes when playing video on High Sierra
  • Linux
    • Bug 22692: Enable content sandboxing on Linux
Tags
tor browser
tbb
tbb-7.0
Anon

eee (not verified) said:

October 19, 2017

Permalink

This new version 7.0.7 and the previous version - which i think was the immediate preceding release version of TBB - cause the windows crash alert when shutdown by clicking the "X" in upper right (right end of titlebar). Commented previously, in https://blog.torproject.org/comment/271794#comment-271794

I am using a fresh install from the exe (the previous version).
I have hardly used TBB since.
However, I haven't left TBB exactly as installed. I've added no bookmarks, but I am using a custom userchrome.css and have used firefox's normal Customize GUI. I've chosen max security in TBB slider, then changed a few settings in noscript, and allowed history in Firefox options.

Anon

eee (not verified) said:

October 19, 2017

Permalink

more info.
eventviewer:
event D 1000 application error
Faulting application name: firefox.exe, version: 52.4.1.6242, time stamp: 0x00000000
Faulting module name: nssckbi.dll_unloaded, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x7336da4c
Faulting process id: 0x930
Faulting application start time: 0x01d349599ac3bb7e
Faulting application path: (path)\Browser\firefox.exe
Faulting module path: nssckbi.dll

this is the event related to TBB crash when TBB wanted to restart after the update download. Also Event ID 1000 Application Error:
Faulting application name: firefox.exe, version: 52.4.0.6242, time stamp: 0x00000000
Faulting module name: nssckbi.dll_unloaded, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x7336da4c
Faulting process id: 0x1158
Faulting application start time: 0x01d3495875729585
Faulting application path: (path)\Browser\firefox.exe
Faulting module path: nssckbi.dll

same dll in the earlier app crash, nssckbi.dll
but can see the earlier esr firefox.exe version

If it matters, hardware is common laptop of 2009 - penryn core 2 duo, intel chipset, and nvidia gpu

(preview page wants to redirect, which I allowed, but only after I copied text into memory as "backup". I needed that "backup".
Hope this is not duplicate comment)

Hard to say. But you could try. I asked the Tails folks a while ago to test 7.5a5 in particular as it contained the sandboxing enabled which 7.0.7 has now as well. I have not heard back from any issues so far (but am not sure either whether they actually tested the content sandboxing in a Tails context).

Anon

Anonymous (not verified) said:

October 20, 2017

Permalink

2017.10.20 18:27:04.800 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections.
2017.10.20 18:27:04.800 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections.
2017.10.20 18:27:04.800 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections.
2017.10.20 18:27:04.800 [NOTICE] Opening Socks listener on 127.0.0.1:9150
2017.10.20 18:27:04.800 [NOTICE] Renaming old configuration file to "\Tor Browser\Browser\TorBrowser\Data\Tor\torrc.orig.1"
2017.10.20 18:27:05.000 [NOTICE] Bootstrapped 5%: Connecting to directory server
2017.10.20 18:27:06.400 [NOTICE] Bootstrapped 10%: Finishing handshake with directory server
2017.10.20 18:27:07.300 [NOTICE] Bootstrapped 15%: Establishing an encrypted directory connection
2017.10.20 18:27:07.600 [NOTICE] Bootstrapped 20%: Asking for networkstatus consensus
2017.10.20 18:27:07.800 [NOTICE] Bootstrapped 25%: Loading networkstatus consensus
2017.10.20 18:27:15.300 [WARN] Problem bootstrapping. Stuck at 25%: Loading networkstatus consensus. (No route to host [WSAEHOSTUNREACH ]; NOROUTE; count 1; recommendation warn; host 79861CF8522FC637EF046F7688F5289E49D94576 at 171.25.193.131:443)
Other browsers work.

Anon

Anonymous (not verified) said:

October 20, 2017

Permalink

Problem remains, when the title isn't English, the title doesn't display in the title bar.

Which title and title bar are you referring to?

eg.Sites from Japan, Taiwan...

nice, tor is a good tool for chinese!

I am totally flabbergasted

by reading this
"First, a warning: The sandboxing isn't very strong yet, especially for the threats that Tor Browser deals with: it still allows reading any file and doing arbitrary socket and connect calls, for example, so there's probably a way for a determined attacker to get a generic sandbox escape, and it definitely allows obtaining PII such as MAC addresses."
https://trac.torproject.org/projects/tor/ticket/22692

So all those years we thought Torbrowser was a solid privacy option, we were wrong because we are leaving our mac address everywhere?!
People are using standard browsers as well and a lot of tracking companies will probably have our mac addresses for use and sale.
So everyone that buys a database of mac addresses can compare this with Torbrowser web statistics to deanonymise Torbrowser users?

This is not a bad joke but just very dangerous for a lot of people.

The MAC address can only be seen from the local network. A website cannot get your MAC address, even in standard browsers, so I don't think tracking companies have databases of the MAC addresses of people who visited some websites. What is possible to do is a database of people who connected to a particular wifi network.

The warning you are quoting explains that in case of a vulnerability in the browser, the sandbox is not protecting access to the MAC addresses (and other things), so it still needs improvements to be able to protect anonymity in the case of someone exploiting an unknown vulnerability.

Thank you for your answer.

Also you forgot to read this part:

Once we have content sandboxing running on all supported platforms we can think about tightening the policies by backporting (more) patches.

why is there no option to uninstall the app either in windows "program and features" nor in windowsball menu?

Windows standard “Uninstall” utility is not used to avoid leaving traces or logs of the installation somewhere.

To uninstall it you simply need to remove the Tor Browser folder:
https://tb-manual.torproject.org/en-US/uninstalling.html

i notice that :
security.ssl3.dhe_rsa_aes_128_sha;true
security.ssl3.rsa_aes_128_sha;true
security.ssl3.rsa_des_ede3_sha;true
network.IDN_show_punycode;false
security.tls.version.min=1

it should be better set "false" and security.tls.version.min=3 (force TLS 1.2 & disables TLS 1.0 and TLS 1.1) , network.IDN_show_punycode;true. If you (additionally) want to force the usage of PFS, the only enabled ciphers should be of the ecdhe/dhe variants : security.ssl3.rsa_aes_256_sha=false. Enabling weakest ciphers is obsolete since 3 years and still present in Tor_october 2017.

Users must avoid unsecure/intrusive service which gmail, brand cloud, fun app & exotic site not because they are bad (i am speaking about the persons who are behind) ; but because the users are running Tor and/or debian/linux system(s). Do not use a linux o.s if you post with gmail : you lost & spoil all your advantages replacing by the worst inconvenient : a big incoherence.
All these services are built for a perfect transparency (not for yourself of course) running on microsoft/apple for the consumers (retarded & handicapped first) providing a great support (not free). These weaks ciphers are for microsoft users : just a minimal setting.

If it is true that running Tor on microsoft/apple is the first step for obtaining a minimal privacy ;
security in mind, anonymity, privacy, foss should have to be understood as a whole concept for a safe internet & personal usage not because it is geek, modern, fun ... it is at the opposite of the idea to be a consumer with a number labeled on your identity ... but because it is the only way to become the owner of his/her own private life and , following the same movement , re-appropriate for oneself his/her own e-space. If you are not involved (or do not wanted to be) in this choice _ it is not an obligation_ do not use debian/linux & harden tweaks.

I should prefer a hardened update version for linux users & the owners of site should have to update their configuration.

this Tor browser is updating and applying despite the prefs for each extension are not autoupdate?!?!?!?!

when are you useless developers going to address and fix this?!

Which pref did you set?

If you want to disable auto updates, you can set app.update.auto to false: http://kb.mozillazine.org/App.update.auto
If you want to disable updates completely, you can set app.update.enabled to false: http://kb.mozillazine.org/App.update.enabled

Hello. I too have been experiencing the same problem: I installed Tor Browser 6.5.2, went into
Tools->Options->Advanced->Update
and selected EITHER of these options:
Check for updates, but let me choose whether to install them
Never check for updates (not recommended: security risk)
In either case, after using Tor Browser for 30-60 minutes, after exiting it, I would find that on the next relaunch, it will have updated itself contrary to the settings above.

I know this problem did not exist in 5.5.5; must have appeared somewhere between 6.0.0 and 6.5.2. Please fix, this is very annoying.

The 7.0.x versions that i'm forced to update to have broken functionality: they do not let me save web pages properly!!!

Have you filed a bug for the broken functionality somewhere? Staying on an old version without any security updates is not a good solution? Have you tested that 7.0.7 is still broken for your use case?

Just upgraded to TB 7.0.7, and can hardly open pages I traditionally opened in older versions. The few pages that open, do it after a very long time spinning. What gives? Going back to older versions is not an option, and not using TB is not an option either. Any TB developers reading this? Thanks.

Which pages and which older versions worked for you? Which operating system are you using?

None

just updated tor browser and when trying to start it, avast intercepts firefox.exe and says it has idp.generic virus.

Chances are pretty high that your avast tool is wrong here. You could probably make an exception for firefox.exe or use a different tool than avast.

why has my comment not been approved yet?
after this update, when starting tor browser, avast says firefox.exe contains idp.generic virus and put it in the virus chest.

How access gmail and Google Drive with Tor Browser?
I used the firefox add-on "Export Import Cookies" to import cookies and logs into email accounts like gmail and yahoo with Tor Browser 6.5 successfully, but that does not work in Tor Browser 7.07. Using Tor Browser 7.07, although cookies are imported, websites behave as if cookies do not exist and I can not get into my email accounts. I can not use a phone number to login because that breaks my anonymity. I need to import some cookies to enter the email accounts using different IPs because without those cookies the security of the email prevents the login if the IP is not the same used in the creation of the account. I do not understand why cookies are successfully imported by the "Export Import Cookies" but Tor Browser and the sites behave as if cookies were never imported. I can see imported cookies in "preferences> privacy> Show Cookies," but the sites can not find them. I tested the same add-on on firefox-esr 52.4.1, which is the basis of Tor Browser 7.07, and I was able to import cookies and log in to email accounts normally. Can anyone tell me how to import cookies using Tor Browser 7.0.7? Does anyone have any other ideas on how to access yahoo and gmail email accounts using Tor Browser? Tor Browser should support an add-on to export and import cookies.

Do you see any errors in the browser console (Ctrl+Shift+J) when you are installing the extension?

Just upgraded to TB 7.0.7, and can hardly open pages I traditionally opened in older versions. The few pages that open, do it after a very long time spinning. What gives? Going back to older versions is not an option, and not using TB is not an option either. Any TB developers reading this? Thanks.

this page is a good app

Same issue with avast and 7.07. Tried uninstalling, tried using older installs, creating an exception in avast, nothing seems to work.

I am running Tor Browser on Windows 7-64.

Why does Tor Browser always cause my ZoneAlarm firewall to report that Tor Browser is trying to communicate with explorer.exe? It does this twice, every time I start Tor Browser, even though I tell ZoneAlarm to remember the setting to deny access.

This seems very suspect to me, and has been going on for some time now.

That's the first time I hear about it. Where did you get your Tor Browser from?

I always download directly from the Tor website.

I again just downloaded the windows installer from the Tor website, and installed it to my desktop, the default location.

The installer triggered ZoneAlarm firewall twice, trying to access explorer.exe. I denied permission, and the installation proceeded normally.

Then, when I opened this new instance of Tor Browser, it again made two attempts to access explorer.exe, as indicated by ZoneAlarm firewall. I denied permission, twice, and the browser opened normally.

Here is the log:

10/24/2017 5:06:33 AM.800 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections.
10/24/2017 5:06:33 AM.800 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections.
10/24/2017 5:06:33 AM.800 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections.
10/24/2017 5:06:33 AM.800 [NOTICE] Opening Socks listener on 127.0.0.1:9150
10/24/2017 5:06:33 AM.800 [NOTICE] Renaming old configuration file to "C:\Users\XX\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc.orig.1"
10/24/2017 5:06:34 AM.000 [NOTICE] Bootstrapped 5%: Connecting to directory server
10/24/2017 5:06:34 AM.200 [NOTICE] Bootstrapped 10%: Finishing handshake with directory server
10/24/2017 5:06:34 AM.700 [NOTICE] Bootstrapped 15%: Establishing an encrypted directory connection
10/24/2017 5:06:34 AM.900 [NOTICE] Bootstrapped 20%: Asking for networkstatus consensus
10/24/2017 5:06:35 AM.000 [NOTICE] Bootstrapped 25%: Loading networkstatus consensus
10/24/2017 5:06:38 AM.600 [WARN] Received directory with skewed time (DIRSERV:193.23.244.244:443): It seems that our clock is ahead by 1 hours, 57 minutes, or that theirs is behind. Tor requires an accurate clock to work: please check your time, timezone, and date settings.
10/24/2017 5:06:38 AM.600 [NOTICE] I learned some more directory information, but not enough to build a circuit: We have no usable consensus.
10/24/2017 5:06:38 AM.800 [NOTICE] Bootstrapped 40%: Loading authority key certs
10/24/2017 5:06:39 AM.800 [WARN] Received directory with skewed time (DIRSERV:193.23.244.244:443): It seems that our clock is ahead by 1 hours, 57 minutes, or that theirs is behind. Tor requires an accurate clock to work: please check your time, timezone, and date settings.
10/24/2017 5:06:39 AM.800 [NOTICE] Bootstrapped 45%: Asking for relay descriptors
10/24/2017 5:06:39 AM.800 [NOTICE] I learned some more directory information, but not enough to build a circuit: We need more microdescriptors: we have 0/6399, and can only build 0% of likely paths. (We have 0% of guards bw, 0% of midpoint bw, and 0% of exit bw = 0% of path bw.)
10/24/2017 5:06:40 AM.500 [NOTICE] Bootstrapped 50%: Loading relay descriptors
10/24/2017 5:06:43 AM.600 [NOTICE] Bootstrapped 56%: Loading relay descriptors
10/24/2017 5:07:05 AM.300 [NOTICE] Bootstrapped 64%: Loading relay descriptors
10/24/2017 5:07:05 AM.600 [NOTICE] Bootstrapped 70%: Loading relay descriptors
10/24/2017 5:07:05 AM.800 [NOTICE] Bootstrapped 80%: Connecting to the Tor network
10/24/2017 5:07:06 AM.500 [NOTICE] Bootstrapped 85%: Finishing handshake with first hop
10/24/2017 5:07:06 AM.800 [NOTICE] Bootstrapped 90%: Establishing a Tor circuit
10/24/2017 5:07:07 AM.300 [NOTICE] Tor has successfully opened a circuit. Looks like client functionality is working.
10/24/2017 5:07:07 AM.300 [NOTICE] Bootstrapped 100%: Done
10/24/2017 5:07:08 AM.800 [NOTICE] New control connection opened from 127.0.0.1.
10/24/2017 5:07:09 AM.000 [NOTICE] New control connection opened from 127.0.0.1.

You might want to fix your clock offset:

10/24/2017 5:06:38 AM.600 [WARN] Received directory with skewed time (DIRSERV:193.23.244.244:443): It seems that our clock is ahead by 1 hours, 57 minutes, or that theirs is behind. Tor requires an accurate clock to work: please check your time, timezone, and date settings.

But that should not be the reason for the zonealarm trigger.

Does a normal Firefox trigger the same alarm?

My clock appears to show the correct time for my time zone. Haven't had any problems with that at all. It is set to synchronize automatically with the naval observatory time server.

What could be causing Tor Browser to report a severe clock skew problem? This did not use to happen, until fairly recently.

Once Tor Browser is up and running, it seems to function normally. But that could just be an illusion. What is going on beneath the surface could be a different story.

I have not noticed this issue with Firefox, which I have highly customized to tighten up security, to approximate that of Tor Browser. I get test scores comparable to Tor Browser when I test using Panopticlick and ip-check.info, though I know they don't tell the whole story.

Any help is appreciated.

Hows does one fix the clock issue, if my system clock seems to be correct?

"installed it to my desktop, the default location"

this might be what bothers the firewall.

"Desktop" is a special folder.
(The icons on the desktop you see may be in two different "Desktop" folders - C:\Users\yourusername\Desktop and C:\Users\Public\Desktop)

So, to keep things simpler, I would "install" TBB to a more typical folder such as C:program files\TBB\ or perhaps in a folder on the drive letter (C:\TBB\)

I had previously placed the Tor Browser folder in my C:\Program Files (x86) folder, to get it off my desktop.

Later, after experiencing this issue, and thinking this might be a problem, I tried putting a fresh installation of Tor Browser back on my desktop, the default location where the installer wants to put it.

It makes no difference. Same problem, either way.

From the ZoneAlarm Advisor page:

Tor Browser is trying to open an existing process.
ZoneAlarm is asking you whether to allow this behavior. Your computer is safe.

What should I do?

If Tor Browser needs to open an existing process in order to function correctly and you know what this program is, then give it permission. If it does not need to open a process, or you know that a process should not be opened, then deny it. If you are unsure, you can always deny it from opening a process and run the program again if it is required.

Why?

Tor Browser is potentially malicious. This is particularly true if opening an existing process will load malicious programs and/or utilize an excessive amount of CPU time, memory, and other resources.

Inside the OSFirewall alert

Alert property Alert property value Technical explanation
Program Name Tor Browser A program running on your computer, which attempted an action that was detected by the OSFirewall.
Filename firefox.exe The filename of the program that ZoneAlarm found on your computer.
Program Version 52.4.1 The version of Tor Browser running on your computer.
Program Size 337920 The size of the program executable file in bytes.
Program MD5 946fd9704dcddf0041eecb2beb28e342 The MD5 hash, or number, that uniquely identifies the executable.
Smart Checksum 4eadd97966ec4a78d2271d214f0d9272 The SKIMP hash, or number, that uniquely identifies the executable.
Date Modified Dec-31-1999 05:00:00 PM The date when firefox.exe was most recently modified.
Event Type Process The event involved starting or terminating a thread or process.
Sub Event Type OpenProcess Tor Browser attempted to open another process.
Command Line C:\Windows\Explorer.EXE The command being used to open another process.

Still have gotten no resolution of this problem.
Tor Browser has updated to 7.08, but the problem persists of Tor Browser invoking to access explorer.exe on Windows 7-64

Runs a little slow on my macbook pro but wanted to update and keep it around for an occasional private search

after the update I have "your tab just failed" and I do not load any pages. How can I solve that problem? for what is this?
attached I leave the image of the fault
http://pixs.ru/showimage/torpng_3680800_28011011.png

Which Tor Browser version did you use previously? Does it work for you if you open about:config and set browser.tabs.remote.autostart.2 to false and restart?

The sandboxed-tor-browser (0.0.14) is completely broken with this update. Any idea when it'll be fixed?