Security feature bypass

Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discover a client IP address via vectors involving a crafted web site that leverages file:// mishandling in Firefox, aka TorMoil. NOTE: Tails is unaffected...

UBUNTU-CVE-2017-16541

Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discover a client IP address via vectors involving a crafted web site that leverages file:// mishandling in Firefox, aka TorMoil. NOTE: Tails is unaffected...

CVE-2017-16541

Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discover a client IP address via vectors involving a crafted web site that leverages file:// mishandling in Firefox, aka TorMoil. NOTE: Tails is unaffected...

CVE-2017-16541

Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discover a client IP address via vectors involving a crafted web site that leverages file:// mishandling in Firefox, aka TorMoil. NOTE: Tails is unaffected...

CVE-2017-16541

Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discover a client IP address via vectors involving a crafted web site that leverages file:// mishandling in Firefox, aka TorMoil. NOTE: Tails is unaffected...

CVE-2017-16541

CVE-2017-16541 concerns Tor Browser before 7.0.9 for macOS/Linux, where crafted web content abusing Firefox file:// handling could reveal the client’s IP address, i.e., a partial anonymity bypass. Several connected advisories (e.g., CESA-2018:3403, DSA-4327-1) cite Mozilla Firefox/Thunderbird upd...

Flaw in Tor Browser Leads to Leaking of Your Real IP Address

By Waqas Tor is a unique web browser because it lets users This is a post from HackRead.com Read the original post: Flaw in Tor Browser Leads to Leaking of Your Real IP Address...

Tor Browser Users Urged to Patch Critical ‘TorMoil’ Vulnerability

The Tor Project released a patch for a vulnerability that leaks the real IP addresses of macOS and Linux users of its Tor Browser. The patch was issued late Friday and fixes a vulnerability found in Tor Browser version 7.0.8. The patch is in an upgrade to Tor Browser 7.0.9. Windows users running...

Warning: Critical Tor Browser Vulnerability Leaks Users’ Real IP Address—Update Now

If you follow us on Twitter, you must be aware that since yesterday we have been warning Mac and Linux users of the Tor anonymity browser about a critical vulnerability that could leak their real IP addresses to potential attackers when they visit certain types of web pages. Discovered by Italian...

The Tor Project to Beef Up Privacy with Next-Generation of Onion Services

The Tor Project has made some significant changes to its infrastructure by improving the way the 'onion' network protects its users' privacy and security. Since the beginning, the largest free online anonymity network has been helping users browse the web anonymously, and its onion service provid...

tor/oss-fuzz-diff: Use-of-uninitialized-value in cdline_linecpy

Project: https://git.torproject.org/tor.git Detailed report: https://oss-fuzz.com/testcase?key=4831951589474304 Project: tor Fuzzer: libFuzzertoross-fuzz-diff Fuzz target binary: oss-fuzz-diff Job Type: libfuzzermsantor Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Cras...

tor/oss-fuzz-vrs: Use-of-uninitialized-value in tor_vsscanf

Project: https://git.torproject.org/tor.git Detailed report: https://oss-fuzz.com/testcase?key=5851887808020480 Project: tor Fuzzer: libFuzzertoross-fuzz-vrs Fuzz target binary: oss-fuzz-vrs Job Type: libfuzzermsantor Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

tor/oss-fuzz-extrainfo: Use-of-uninitialized-value in memarea_strdup

Project: https://git.torproject.org/tor.git Detailed report: https://oss-fuzz.com/testcase?key=5253761736900608 Project: tor Fuzzer: libFuzzertoross-fuzz-extrainfo Fuzz target binary: oss-fuzz-extrainfo Job Type: libfuzzermsantor Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

Firefox Bolsters Privacy, Pulls Plug on Browser Canvas Fingerprinting

The Mozilla Foundation is boosting privacy in an upcoming version of its Firefox browser by removing the snooping capability called canvas fingerprinting, a method of tracking users across multiple websites. The feature is expected to be removed in January 2018 with the introduction of Firefox 58...

Exitmap - A Fast and Modular Scanner for TOR Exit Relays

Exitmap is a fast and modular Python-based scanner for Tor exit relays. Exitmap modules implement tasks that are run over a subset of all exit relays. If you have a background in functional programming, think of exitmap as a map interface for Tor exit relays: Modules can perform any TCP-based...

Onion Service nMap Scanner: Onion Map

Use nmap to scan hidden “onion” services on the Tor network. Minimal image based on alpine, using proxychains to wrap nmap. Tor and dnsmasq are run as daemons via s6, and proxychains wraps nmap to use the Tor SOCKS proxy on port 9050. Tor is also configured via DNSPort to anonymously resolve DNS...

Onion Routed Cloud: ORC

Onion Routed Cloud is a decentralized, anonymous, object storage platform owned and operated by allies in defense of human rights and opposition to censorship. ORC is a volunteer run cloud storage network that protects users from surveillance and puts them in control of their data. Use cases: For...

Excerpts from The Ransomware Economy: Emergence and Innovation

Carbon Black recently published an investigative report on the Dark Web marketplace for ransomware. This is an excerpt from that report, which you can find here. For more information about the rise of ransomware, and what you can do about it, check out the Future-Proof Your Ransomware Prevention...

Tor: Detecting Tor Browser UI Language

Suppose that a user downloads a non-English version of Tor Browser from https://www.torproject.org/projects/torbrowser.html.en, there is a way to detect which UI language the user is using. I don't think you want websites to detect this info, because at the first time I launched non-English Tor...

Tor: Cross-domain linkability when system time changed in Tor Browser

This report is inspired by 257942. That report uses languagechange event as an indicator for different tabs to link multiple visits to a single user. This report uses another trick to achieve the same thing. Malicious websites keeps reading Date.now inside a setInterval loop with a short interval...