DigiCert Considering Certs for Hidden Services

News broke last week that Facebook had built a hidden services version of its social network available to users browsing anonymously via the Tor Project’s proxy service. Unlike any .onion domain before it, Facebook’s would be verified by a legitimate digital signature, signed and issued by...

Facebook Creates .Onion Site; Now Accessible Via Tor Network

UPDATE – This story has been updated with commentary from the Tor Project. Facebook announced today that the social network will now be directly available to users as a Tor hidden service. The Tor Project is an Internet-traffic anonymization service that relays user traffic through a number of...

'The Pirate Bay' Co-Founder Found Guilty in Denmark's Largest Hacking Case

The co-founder of The Pirate Bay torrent site Gottfrid Svartholm Warg Anakata and his 21-year-old Danish co-defendant have been found guilty by a Danish court of hacking into systems operated by American IT giant CSC and illegally downloading files. It was the biggest hacking case ever conducted ...

Intelligence Insiders Disclose Bug Information With Tor

The executive director of the Tor Project told the BBC that U.S. and U.K. intelligence agencies are in an internal cat and mouse game, with one faction trying to break the anonymity network, and another one sharing bugs anonymously with Tor developers. Andrew Leman, in an extensive...

tor -- traffic confirmation attack

The Tor Project reports: Tor before 0.2.4.23 and 0.2.5 before 0.2.5.6-alpha maintains a circuit after an inbound RELAYEARLY cell is received by a client, which makes it easier for remote attackers to conduct traffic-confirmation attacks by using the pattern of RELAY and RELAYEARLY cells as a mean...

Firefox onreadystatechange Event DocumentViewerImpl Use After Free

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core'...

How To Remove File Metadata

How To Remove File Metadata For those of you who want to remove file metadata from any shared data, you can use existing document or image editor software which typically have built-in metadata editing capability. In this tutorial, we will introduce a standalone metadata cleaner tool which is...

Siemens Update on Heartbleed Patches in ICS, SCADA

Industrial control equipment manufacturer Siemens has produced a security update that mitigates the OpenSSL Heartbleed vulnerability in its eLAN systems and now its WinCC OA supervisory control and data acquisition SCADA software as well. The company is continuing to work on patches to resolve th...

Tor Blacklisting Exit Nodes Vulnerable to Heartbleed Bug

The Tor Project has begun blacklisting exit nodes vulnerable to the Heartbleed vulnerability in OpenSSL. Researcher Collin Mulliner, with the Systems Security Lab at Northeastern University in Boston, published the results of an experiment he conducted using a publicly disclosed Heartbleed...

Malicious iOS Tor Browser in Apple App Store

An iOS Tor Browser hosted for download on Apple’s notoriously restrictive App Store is reportedly a fake. Worse yet, not only is the application said to be illegitimate, but also allegedly malicious. According to a support ticket opened by a Tor Project volunteer operating under the handle Phobos...

Anonymity Tool Tor gains more than 1.2 Million new users since NSA PRISM scandal

Since Snowden came forward with details about the NSA's PRISM program in June, web users concerned about online privacy are increasingly turning toward privacy tools to protect their online data. U.S. Government project PRISM allows the government to tap phone calls, email, and web browsing of an...

Tor Users Should Leave Insecure Windows Operating System

In a critical security advisory issued over the weekend, the Tor Project told its users that they should seriously consider migrating away from Microsoft’s Windows operating system and disabling JavaScript. The Tor Project security advisory was a response to revelations on Sunday that an attack h...

tor -- guard discovery

The Tor Project reports: Disable middle relay queue overfill detection code due to possible guard discovery attack...

[AttackVector Linux] Linux distro for anonymized penetration based on Kali and TAILS

AttackVector Linux is a new distribution for anonymized penetration and security. It is based on Kali and TAILS, which are both based on Debian. While Kali requires a modified kernel for network drivers to use injection and so forth, the Tor Project's TAILS is designed from the bottom up for...

Memory Bug Fixed in Tor Client

The Tor Project has fixed a flaw in its anonymization and privacy software that leaked information from memory on some machines running Tor that could give an attacker access to sensitive information stored in the cache. The issue was caused by the way that some compilers handle a specific functi...

DEBIAN-CVE-2012-4922

The tortimegm function in common/util.c in Tor before 0.2.2.39, and 0.2.3.x before 0.2.3.22-rc, does not properly validate time values, which allows remote attackers to cause a denial of service assertion failure and daemon exit via a malformed directory object, a different vulnerability than...

Cyberoam advisory

Vulnerability in Cyberoam DPI devices 30 Jun 2012 CVE-2012-3372 =================================================================== Cyberoam make a range of DPI devices http://www.cyberoamworks.com/ which are capable of intercepting SSL connections. In common with all such devices, in order to...

CVE-2012-3372 : Traffic Interception Vulnerability found in Cyberoam

Traffic Interception Vulnerability found in Cyberoam The TOR team have discovered a fake certificate in the wild. The certificate, issued by a US company called Cyberoam, was used in an attempt to trick a user in Jordan into believing that her/his connection to the TOR website, was private and...

Tor Warns of Firefox Bug That Threatens User Privacy

The developers at the Tor Project are warning users about a serious flaw in Firefox that’s included the latest version of the Tor Browser Bundle that could enable an attacker to gather information about the servers a victim is using, poking a hole in the privacy and anonymity that Tor is designed...

[SECURITY] Fedora 15 Update: mozilla-https-everywhere-2.0.3-2.fc15

HTTPS Everywhere is a Firefox extension produced as a collaboration between The Tor Project and the Electronic Frontier Foundation. It encrypts your communications with a number of major websites. Many sites on the web offer some limited support for encryption over HTTPS, but make it difficult to...