Tor security advisory: Old Tor Browser Bundles vulnerable

by arma | August 05, 2013

An attack that exploits a Firefox vulnerability in JavaScript has been observed in the wild. Specifically, Windows users using the Tor Browser Bundle (which includes Firefox plus privacy patches) appear to have been targeted.

This vulnerability was fixed in Firefox 17.0.7 ESR. The following versions of the Tor Browser Bundle include this fixed version:

Tor Browser Bundle users should ensure they're running a recent enough bundle version, and consider taking further security precautions.

Read the full advisory here:
https://lists.torproject.org/pipermail/tor-announce/2013-August/000089…

Tags
security
tor browser
tbb
Anonymous

Anonymous (not verified) said:

August 05, 2013

Permalink

On or around July 30, 2013, while I was at a certain website, my Tor Browser displayed a yellow ribbon just below the menu bar.

It read as follows:

In order to implement a crucial fix, this update resets your HTTPS Everywhere rule preferences to their default values

Question: Has anyone encountered such a situation?

The version of the TBB that I was using at the time is the latest version. My OS is Microsoft Windows 8, 64-bit.

absolute the same here my friend. i did nothing when that message appears as a bar below original bar but it was first time when i saw it. probably im fucked. time to buy another laptop i will burn this one

I got the same message! But I had never fiddled with the settings of HTTPS Everywhere. Why the need to "reset to default values"?

arma, why no comment from you??

I did, on in both my copy of the TBB as well as my untrusted (regular) copy of Firefox and my copy of Portable Firefox. A new version of HTTPS-E came out that day, but required reconfiguration almost from scratch.

Anonymous

Anonymous (not verified) said:

August 05, 2013

Permalink

What should one do if they cant remember whether or not they used TOR over the last couple of weeks?

No there isnt any way. Tor is designed not to keep logs for your own safety. But seriously. If you cant remember whether or not you have used tor in the last week you should see a doctor. Alzheimer's can be slowed down if it's detected early.

That depends. If you are using Windows then... maybe. Windows uses an NTFS file system. NTFS has something called Last Access Update. Assuming this is turned on, it will update with the last time you accessed a file. Right click on a file and choose properties.

If it is turned off - the date will be the same as the created date. If it is turned on, it will be the last time you accessed the file. In the case of TBB, the last time you ran it. That can tell you(or anyone with access to your computer) when it was last ran.

This is turned on by default in XP and I cannot remember if this is true of later versions of Windows. Mine is turned off though and I suggest everyone turn theirs off. It is not hard - Google NtfsDisableLastAccessUpdate and you will see how.

It is better that someone getting a hold of your computer does not know when the last time you access files is. But disabling this "feature" also improves Hard Drive performance and longevity since you are cutting out a write operation from every file read operation! I expect disabling this would also help laptop battery life to some extent. It is a terrible "feature."

I will add one more thing. If you use Truecrypt to protect sensitive information and you also utilize keyfiles (music files are good but random recorded radio noise is better) then this "feature" makes it very, very easy to figure out your keyfiles. Disable it NOW.

Last Access Time is disabled on NTFS for windows > XP and Windows Server > 2003 unless you cleverly re-enabled the feature. It's disabled for performance reasons. It may even be disabled on those named OS's with the last service packs, but I am only surmising.

I think Last Access Date (no time recorded) is still enabled by default on FAT volumes, but I could be wrong.

You can show the column in Windows Explorer and see if it is useful...

Anonymous

Anonymous (not verified) said:

August 05, 2013

Permalink

Great Tor I never even thought about jailbait before I found Tor but then I got curious and looked at freedom hosting site and now I go to jail and get ass raped. Thanks for entrapment asshole.

why would not naked hot teenagers spike curiosity in you? Tor promised me hot teenage action and all I got was raided by the feds!

Who couldn't be mesmerized by the undeniable lure of tender, smooth, taut, voluptuous youth?

Who could corrupt, exploit, bugger, sodomize, defile, desecrate, deflower, etc.?

It depends on their age you dirty bastard! you need a rope around your neck if it were young girls! I have no sympathy for sick fuckers who get ass raped in prison for seeking child porn, not everyone who uses TOR is into this shit

Have you not noticed that a lot of 13 year old girls look like hot 20 year old sluts? When will the pretending that they are not attractive end? When will it end putting people in prison just for looking at such hotties showing off? Let's get some sanity in this issue!

"Have you not noticed that a lot of 13 year old girls look like hot 20 year old sluts? "

In that case, why not stick to the 20-year olds and avoid much drama?

Those are your thoughts in your own head and not what the actual child of 13 is thinking! idiot!
Girls that age throw tantrums, bitch a lot, cry a lot, they are mouthy and like boys around their own age. Do us all a favour and use your brain when you look at youngsters

maybe because only fools accept someone else's opinion about something they never saw for themselves? why do YOU hate child porn? because someone told you it's all evil and disgusting rape and torture of babies correct? WRONG. A photo of a teenage boy model in underwear can, and has been called child porn. a video recorded by a underage school student and shared by him over the net is called child porn. if you view it, the government will tell you you abused that kid. did you really? does watching dexter make you a brutal killer? does watching news of 9/11 make you a terrorist responsible for the deaths of thousands? does looking at the footage of the first and second world war make you in any way responsible for the actions in it? are you that blind and compliant to believe anything you are told that you yourself did not research? that's why people are curious and go see things, even if the things are 'awful' and illegal - or are they?

perhaps 1% of the people caught in this exploit actually did any harm to a child. the 99% will be persecuted nevertheless. because people do not understand what child porn really is and that not even 0.1% of it is rape or torture. most of it is teenage kids masturbating on webcam or vintage videos from 30 years ago. hardly a reason to destroy lives by branding all of them rapists and molesters.

Thing is that there is really a big line between CP and JB. There is a ton of sick CP of toddlers and babies being raped and very underage kids being generally exploited. I find such things disgusting, but I don't care what other people get off to, I care only that they do not molest kids themselves. On the other hand there is also a ton of JB and it is considered CP only by legal technicality. In reality it consists almost entirely of teenagers taking pictures of themselves naked and uploading to the internet. Some small percent of them are blackmailed into doing so, some larger percent of them shared pictures with a boyfriend who shared it with the internet, but none of them are really raped and absued and a lot of them willingly and knowingly uploaded their own pictures. The biggest problem with Tor is that sites that host JB mix it in with tons of very disturbing and disgusting other shit that very few people who care about JB even want to look at. There are tons of clearnet sites for JB and the feds totally ignore them, but the people looking at JB on Tor are all going to be fucked by this operation because the feds cannot tell them apart from the people looking at 6 month old getting brutally raped. Personally I don't really care if people look at picture of 6 month old getting brutally raped though, looking at pictures is very far from doing the things in the pictures, or else everyone who looks at holocaust picture is then guilty of war crimes. Anybody with any fucking logic in their mind at all knows this, but these emotional thinking idiots control the world.

Jailbait is very addictive. It is best to never look at it even one time. Once you see fresh young teenagers you never want to go back to looking at old generally very rough looking adults in legal pornography. I have many friends who use Tor for various reasons not related to CP at all, and many of them have claimed to become addicted to jailbait after first finding it on Tor.

Beauty depends on the specific woman, as it does at any age, and also involves who she is as a person. Since I'm much older I see a 14-year-old as a kid without any real life experience. As my wife ages I still find her very attractive. She isn't 90 yet but I think I'll feel the same then.

I have to agree with this. Not only are jailbait girls typically at the peak of their sexual attraction, but the feeling of doing something so illegal is very addictive as well. It reminds me of being young looking at porn for the first part of my life, trying to hide it from my parents. Something forbidden and secret but so attractive and good feeling. I think the forbidden aspect is half the fun with jailbait, but most surely it is not all of it because I do find actual child pornography to be very disgusting and would not look at it even though it is also forbidden. Peak sexual attraction, plus bringing the rush back to pornography....a very addictive combination.

you are both right, yet i (being young adult) don't think i will live enough to see this being acknowledged by the "masses" not even mentioning the lawmakers.
Internet "pedophiles" - no matter if they fap to toddlers being gang raped or pictures of topless 16 year olds - are way to convenient scapegoats for powers that be, who can gain political capital and sympathy points literally out of nothing by cracking down on internet CP, instead of helping children that are actually being abused (which would require much more effort and $$, but won't make any big headlines)

Also censorship. Whenever you want to impose some restrictions on internet-users, just do it "for the children" and accuse your opponents of supporting pedophilia. Works like a charm.

posting this over tor because FBI lol

Scapegoat is the right thing to called pedophiles/pedosexuals (I feel the latter is more true) in the real world. The whole anti-pedosexual thing started when homosexuals were beginning to be accepted by society, as the new 'boogie man' for society created by feminists/religious leaders who hate that learning that sex is a wonderful and pleasurable thing early is the biggest buster of their bunkus in the world.

"The love between men and boys is at the foundation of homosexuality. For the gay community to imply that boy-love is not homosexual love is ridiculous." - "No Place for Homo-Homophobia.", San Francisco Sentinel, March 26, 1992

"Shame on us if our lesbian/gay voices remain silent while our
NAMBLA brothers are persecuted once again, and shame on those
lesbians and gay men who will raise their voices to condemn NAMBLA,
insisting that boy lovers (and presumably the boys they love and who
love them) are not part of this thing called the lesbian/gay
community."
- Steve Hanson, "Shame on Us.", Bay Area Reporter, January 23, 1992

"NAMBLA is by no means on the fringe of the "gay rights" movement. For years, it was a member in good standing of the International Lesbian and Gay Association (ILGA), and was only jettisoned by ILGA when the parent organization applied for United Nations consultative status in 1993. Years earlier, the ILGA itself had resolved that "Young people have the right to sexual and social self-determination and that age of consent laws often operate to oppress and not to protect." "
- http://www.lifeissues.net/writers/clo/clo_09homosexuality.html

Note that the "love" being referred-to in the above quotes is little more than an Orwellian euphemism for the buggering and sodomizing of tender youth by adult males.

(This is particularly disturbing when one considers the distinct physical as well as psychological disadvantage that the *receptive* partner in anal penetration is placed at: The bulk of the considerable risk of deadly infection as well as injury, ALL of the pain, discomfort and inconvenience that are endemic to this act, etc. )

you are both right, yet i (being young adult) don't think i will live enough to see this being acknowledged by the "masses" not even mentioning the lawmakers.
Internet "pedophiles" - no matter if they fap to toddlers being gang raped or pictures of topless 16 year olds - are way to convenient scapegoats for powers that be, who can gain political capital and sympathy points literally out of nothing by cracking down on internet CP, instead of helping children that are actually being abused (which would require much more effort and $$, but won't make any big headlines)

Also censorship. Whenever you want to impose some restrictions on internet-users, just do it "for the children" and accuse your opponents of supporting pedophilia. Works like a charm.

posting this over tor because FBI lol

I as young adult find that young adults like jailbait and old ass adults think it is horrible. Hardly any of my IRL male friends have not made comments about being attracted to under 18 year old teenagers, many of my internet friends who know about Tor have said they have looked at jailbait on it. But for most old people they seem to think it is totally horrible. Total disconnection between age groups, the same as it is for drugs.

If you are innocently looking at girls your own age, why do you have to do it on the TOR browser??? makes no sense.
Most of us old ass people have children and idiots like you are a threat to them, when you grow up and have children of your own, only then will you understand.
Please stick to the normal web where you can happily watch naked 18yr olds and not young teens who are being exploited, used and abused for your own selfish needs.

"Internet "pedophiles" - no matter if they fap to toddlers being gang raped or pictures of topless 16 year olds - are way to convenient scapegoats for powers that be, who can gain political capital and sympathy points literally out of nothing by cracking down on internet CP, instead of helping children that are actually being abused (which would require much more effort and $$, but won't make any big headlines)"

You raise some valid points that are worthy, if not /requiring/, of consideration and discussion.

Nonetheless:
1.) Wouldn't you say that working to /prevent/ abuse from occurring in the first place is no less important than helping the victims of abuse?

2.) Wouldn't you say that an individual who derives /pleasure/ from images/descriptions/fantasies of the likes of "toddlers being gang raped" is considerably more likely to pose a threat to society than the average or typical random individual? (Considering that the vast, overwhelming majority of the population-at-large in just about any society finds such imagery nothing less than utterly repugnant, revolting, repulsive and deeply disturbing.)

3.) Accepting the premises outlined in #s 1 and 2 above, wouldn't you say that society has a legitimate interest-- if not /duty/-- in at least /flagging/ and /monitoring/ anyone who exhibits solid, convincing evidence of having an unhealthy interest in the type of imagery in question?

4.) This is not to say that the /MERE viewing/ or possessing of /images/--of /any sort/-- should, in and of itself, carry criminal penalties.

1.The problem is, is it really *scientifically* proven that watching CP facilitates child abuse, (comparable to what they call a "gateway drug", meaning first you watch pictures of 10 yo models in bikinis than you need stronger kick, you switch to harder and harder sex scenes, until just watching doesn't do it for you any longer and you go lure some real kids into your van). Or does it help people who might have those urges, relief them without acting upon them? Your first point seems to be built upon the first assumption, however if the 2nd is true, then what they are doing is not even wasting time/money, but using them to facilitate what they should be actually trying to prevent, since less CP = more people having sex with real kids. (btw. I'm talking about an absolute minority here that would actually act upon their sexual fantasies, I doubt they constitute a large percentage of people watching CP. Just like there are a lot of people into rape/rough sex, but only few of them would/do actually rape)

2. Well he might be. Same as with somebody who watches gore-videos or even Dexter. It's a very difficult question, that can't be properly addressed at our current lvl of technological development. Regardless of that what you are talking about here is thought crime. Just imagine US-government (or any government for that matter) being able to prosecute or even "flag" people for what they think. Imagine all sorts of power abuse that would then happen. And it would be even worse once they actually had the technology to read your thoughts. (and what the vast majority thinks shouldn't even matter, you know what vast majority of people thought/ and in many parts of the world still thinks about homosexuals.)

3. Only if it's proven beyond a doubt that those people would actually act upon their urges. Otherwise we are talking of pre-crime, minority report kind of situations, where innocent people potentially suffer consequences of actions they didn't do. And proving something like that beyond a doubt (i guess we are talking about preventive measures here, if somebody already raped a child and you have evidences, it's an easy game) is not feasible with our technology anyway. But even if it would be, we should really think about if it's worth the trade-offs (see 2nd point). Basically it's the same security vs freedom debate, but with stakes set very high. It was always possible (at least in theory) for people living in dictatorships to keep at least their thoughts free and overthrow the tyrants when the time was right. Open the powers that be the way into your thoughts and there will be no escape.

4. Agree.

1. It is scientifically proven that in all countries that legalize possession and viewing of child porn, there is a sharp drop in child molestation rates, in every single country ever studied

http://phys.org/news/2010-11-legalizing-child-pornography-linked-sex.ht…

Results from the Czech Republic showed, as seen everywhere else studied (Canada, Croatia, Denmark, Germany, Finland, Hong Kong, Shanghai, Sweden, USA), that rape and other sex crimes have not increased following the legalization and wide availability of pornography. And most significantly, the incidence of child sex abuse has fallen considerably since 1989, when child pornography became readily accessible – a phenomenon also seen in Denmark and Japan. Their findings are published online today in Springer's journal Archives of Sexual Behavior.

http://www.wnyc.org/shows/bl/2013/aug/21/crime-online/

Above commentator and some others here may wish to post there. No registration required, only valid email (try disposable).

Especially to respond to comments like this:
"The reason we punish those that possess and traffic is because they are now more than in the past the consumers that drive the creation of the child porn."

In agreement with you

A lot of people have failed to recognise that the pedo's are providing a service for the watchers, a child is being abused for their viewing and it will continue as long as they watch. I am cringing at the comments that looking at pictures isn't harmful?? are some of you really that dumb? of course its fucking harmful, its a child, abuse damages lives, its against their will and human rights. Too many Pedo's on here.

For the stupid person 2 above saying that the rates of rape and molestation have gone down ,you know why that is?? I can tell you, its online that's why and you watchers are keeping it alive.

this attack has nothing at all to do with CP or JB.

If not nothing, very little, I do believe that this is an example of the weakest exploit in their bag of tricks and they didn't much care that it was exposed as there will be new exploits aimed at de-anonyimizing TOR users.

I believe the feds are after the Darknet drug markets much more than CP. Feds foam at the mouth over Drug users and need to keep the Genocide against drug users going(it's not a war on drugs. only users and a war implies two sides fighting which is not the case) to keep the money flowing and prisons filled and CO's employed and on and on and on!!

It's about adults using drugs. :-(

Re-posting an apropos post.
______
Re: "drug sites":

-What about, for example, chemotherapy patients, many of whom are dying anyway?
Would you deny them the little respite and relief they claim that marijuana provides them?

Current drug policy in many places does just that, leaving such people-- in misery-- with no alternative but the very "black markets" that you refer-to.

- Alcohol is a DRUG that is at least as deadly and claims at least as many lives as any number of substances that don't enjoy the blessings of the law and social acceptance.

What about "taking down" some of the (legal, sanctioned, privileged) mega corporations that promote, glamorize and glorify this poison?

Re: "money laundering": Can whatever Tor may facilitate in this regard even hold a candle to the likes of the Wall Street banksters or even (or especially) the Federal Reserve, the World Bank, etc., et al?

Not that two wrongs make a right but perspective is needed.

And the prison-industrial complex; the ways in which a number of entities directly benefit from a drug policy that results in mass incarceration is an absolutely critical aspect that cannot be overlooked in any discussion of these matters.

Of course it doesn't, the pentagon are one of the biggest fan of CP.

Pentagon declined to investigate hundreds of purchases of child pornography
http://news.yahoo.com/blogs/upshot/pentagon-declined-investigate-hundre…

Why Was Pentagon Child Pornography Investigation Halted
http://www.thesleuthjournal.com/why-was-pentagon-child-pornography-inve…

Pentagon workers found to have downloaded child pornography
Dozens of staff and contractors with high-level security clearance put at risk of blackmail by their sex crimes
http://www.theguardian.com/world/2010/jul/24/pentagon-us-staff-download…

A typical post from a typical Tor user. "I do no wrong but I am so proficient in CP and JB[1] and know who exploits who etc" purely for educational purposes lol

[1] I can guess what CP is but JB? You are guys are really experts in this stuff. I am sorry you were hacked ;)

Yay free speech and all, but yeah, no kidding.

That said, I don't think this little sub-thread counts as typical Tor users. Or said another way, the larger and broader the Tor user base gets, the less relevant this little subset is.