Zerodium Offers $500K for Secure Messaging App Zero Days

Zerodium, a vendor operating in the nebulous exploit acquisition market, has put a premium on zero-day vulnerabilities in secure messaging applications in a new pricing structure announced today. Remote code execution and local privilege elevation zero days in messaging apps such as WhatsApp,...

[SECURITY] Fedora 25 Update: torbrowser-launcher-0.2.8-1.fc25

Tor Browser Launcher is intended to make Tor Browser easier to install and use for GNU/Linux users. You install torbrowser-launcher from your distribution's package manager and it handles everything else: Downloads and installs the most recent version of Tor Browser in your lan guage and for your...

[SECURITY] Fedora 26 Update: torbrowser-launcher-0.2.8-1.fc26

Tor Browser Launcher is intended to make Tor Browser easier to install and use for GNU/Linux users. You install torbrowser-launcher from your distribution's package manager and it handles everything else: Downloads and installs the most recent version of Tor Browser in your lan guage and for your...

Tor: Access to local file system using javascript

Issue : Access to local file system using javascriptslightly xss on server side The browser can access the local files using iframes with a local html file. this is very normal and often used for local web development but javascript shouldn't be able to get the content of that iframe because this...

The vulnerability of the debian/tor.init script of the Tor information exchange software allows a hacker to circumvent restrictions.

The vulnerability of the debian/tor.init script in the Debian software for anonymous information exchange, Tor, is related to access control deficiencies. This script was designed to execute aa-exec from the standard system path, provided the AppArmor package is installed. Exploiting this...

Tor: languagechange event fires simultaneously on all tabs

The languagechange event, which fires when the user modifies the browser's language settings fires simultaneously on all tabs. This would allow an adversary to link multiple visits to a single user: the adversary e.g. a malicious ad provider has a script that listens for this event, and when fire...

Microsoft CNG/CryptoAPI Tor Protocol Implementation PoC

mini-tor is a proof-of-concept utility for accessing internet content and hidden service content .onion via tor routers. this utility is aiming for as smallest size as possible currently 47kb, compressed with kkrunchy 20kb, which is achieved by using Microsoft CryptoAPI/CNG instead of embedding...

DEFCON 25

After a few days in Las Vegas and after BlackHat, DEFCON 25 is finally over! It was an amazing time around awesome people. I didn't attend all the talks, but most of the ones I saw were interesting: There's no place like 127.0.0.1 - Achieving reliable DNS rebinding in modern browsers, by Luke...

Tor Developer Busts Myths, Announces New Features

The Tor Project gets a bad rap as being a playground for the guilty. That’s why Tor Project co-founder Roger Dingledine took the stage last week at DEF CON to bust popular myths and announce upcoming features related to the anonymity network that averages 2 million users a day. Dingledine’s bigge...

Tor: Simple CSS line-height identifies platform

There are lots of ways to identify the Tor Browser. User-Agent string, limited time resolution, no media, etc. Assume you know it is the Tor Browser. Can you tell what platform? NOTE: This assumption is well within the scope of the Tor Browser. The Tor Browser does not hide the fact that it is th...

Tor: Linux TBB SFTP URI allows local IP disclosure

Browsing to a simple URL to an sftp URI allows bypasses socks proxy for DNS and browsing. Tested on a clean install of Ubuntu 16.04 with TBB 7.0.2 4097d43aa0be86ae3fe43ec8f3ac5394 download from https://www.torproject.org/dist/torbrowser/7.0.2/tor-browser-linux64-7.0.2en-US.tar.xz POC: Navigate to...

Design/Logic Flaw

debian/tor.init in the Debian tor0.2.9.11-1deb9u1 package for Tor was designed to execute aa-exec from the standard system pathname if the apparmor package is installed, but implements this incorrectly with a wrong assumption that the specific pathname would remain the same forever, which allows...

UBUNTU-CVE-2017-11565

debian/tor.init in the Debian tor0.2.9.11-1deb9u1 package for Tor was designed to execute aa-exec from the standard system pathname if the apparmor package is installed, but implements this incorrectly with a wrong assumption that the specific pathname would remain the same forever, which allows...

CVE-2017-11565

debian/tor.init in the Debian tor0.2.9.11-1deb9u1 package for Tor was designed to execute aa-exec from the standard system pathname if the apparmor package is installed, but implements this incorrectly with a wrong assumption that the specific pathname would remain the same forever, which allows...

CVE-2017-11565

debian/tor.init in the Debian tor0.2.9.11-1deb9u1 package for Tor was designed to execute aa-exec from the standard system pathname if the apparmor package is installed, but implements this incorrectly with a wrong assumption that the specific pathname would remain the same forever, which allows...

DEBIAN-CVE-2017-11565

debian/tor.init in the Debian tor0.2.9.11-1deb9u1 package for Tor was designed to execute aa-exec from the standard system pathname if the apparmor package is installed, but implements this incorrectly with a wrong assumption that the specific pathname would remain the same forever, which allows...

CVE-2017-11565

debian/tor.init in the Debian tor0.2.9.11-1deb9u1 package for Tor was designed to execute aa-exec from the standard system pathname if the apparmor package is installed, but implements this incorrectly with a wrong assumption that the specific pathname would remain the same forever, which allows...

CVE-2017-11565

debian/tor.init in the Debian tor0.2.9.11-1deb9u1 package for Tor was designed to execute aa-exec from the standard system pathname if the apparmor package is installed, but implements this incorrectly with a wrong assumption that the specific pathname would remain the same forever, which allows...

CVE-2017-11565

The CVE concerns the Debian Tor package (tor.init in tor_0.2.9.11-1~deb9u1) where the init script attempts to run aa-exec via the system pathname when AppArmor is installed, but makes an incorrect assumption that the pathname is invariant, allowing bypass of AppArmor protections. Affected compone...

Tor: [Android org.torproject.android] Possible to force list of bridges

Do the following thing from ADB to emulate the activity start: adb am start -n org.torproject.android/.OrbotMainActivity -a android.intent.action.VIEW -d bridge://xxx Or create a malware app with the following code: java Intent intent = new Intent"android.intent.action.VIEW";...