Tor advises users to ditch Windows after anonymity-busting attack

Jos

Posts: 3,073   +97
Staff

The Tor Project has issued a critical security advisory telling users of the onion router network to stop using Windows and switch to "live" systems if they want to remain anonymous online. The warning comes on the heels of a recently discovered attack that exploited a vulnerability on the Windows build of Firefox 17 ESR (Extended Support Release), a version of the browser customized to view websites using TOR.

The malicious code in question doesn’t download any executables to a victims’ computer or tries to steal any login data. Rather, it uses Javascript to collect the hostname and MAC address of a person's computer, exactly the exact kind of data that Tor users are hoping to keep private while surfing the Internet.

Interestingly, after reverse engineering the code, researcher Vlad Tsyrklevich found that the identifying information was being sent to a server in Washington D.C., leading him to conclude that the FBI or another law enforcement agency is behind the attack. And while the malware may have played an important role taking down one of the largest child porn rings on the planet, it’s also capable of identifying other people using Tor.

The latter is particularly prevalent among journalists as well as civil and human rights activists working in politically unstable regions of the world, though there are many other legitimate uses for it too.

People using Linux and OS X were not affected in this case, but that doesn't mean they couldn't be targeted in the future. Aside from recommending live-CD versions of Linux and OS X as alternatives, the advisory also asks users to update to the latest Tor browser bundle, and consider disabling Javascript altogether. Disabling JavaScript will reduce your vulnerability to similar attacks, but can also make some websites unusable.

Permalink to story.

 
Now that Steam is on Linux, ditching Windows isn't so hard. However the transition likely won't be smooth as there are still lots of driver issues. Once you iron out those issues, it's clear skies ahead.
 
Who wants to bet that the 'guvment', didn't slip Mozilla a few well worded emails that 'asked' them to install this back door..
 
@ davislane1 : I don't think there are many Apple fans on Techspot. Besides that OSX / iOS are closed source, so they're in the same boat as Windows. Better to go with Linux (rooted Android with custom rom for phones/tablets, and pick a Linux distribution you like for PC).

However, this article talks about using JavaScript to pull the hostname/mac address. Which is clearly a type of vulnerability that can happen in any operating system on any browser (short of disabling js and all plugins). Which is why they're recommending using a "live" os (static os running off a cd / usb)...
 
No driver issues on Linux Mint. Not sure what you are talking about, can you be more specific or are you just trolling?
 
Since I don't use the Tor network, technically he wasn't talking to me. And even if I was using Tor, if he thinks I would use this as a reason to ditch Windows, he must be on crack.
 
Are there really people out there still using Firefox 6 versions behind, AND who use TOR? :S We should track them down and make them upgrade...
 
Steam on Linux doesn't equal decent game support on Linux yet. There is a very long way to go before Linux cracks decent levels of modern game support.
 
Steam on Linux doesn't equal decent game support on Linux yet. There is a very long way to go before Linux cracks decent levels of modern game support.
I'm keeping my eye on Linux library of games on Steam. The biggest majority of games in the library are not worth playing in my opinion. The rest are not my type of games.

People talk about Windows 8 App store lacking in quality apps, and that in my opinion is exactly what has kept Linux from gaining desktop popularity.
 
"No driver issues on Linux Mint. Not sure what you are talking about, can you be more specific or are you just trolling?"

Seriously? We're not on consoles here where everyone is running the same hardware. I don't think you know what drivers are... I chose not to elaborate as not to scare people away from Linux. If you read beyond this point, a word of caution, I've had a little to drink, and I tend to ramble. Well:

It is common knowledge that Linux OSes have to cope with driver issues. Hardware manufacturers focus on drivers for mainstream OSes. Recently more of them have been releasing drivers for Linux luckily. However without being open source, they need the masses to test them, otherwise issues remain.

In the last decade, I have installed a Linux distribution on nearly two dozen different computers. Easily seventy five percent have had a driver issue, while most were annoyances and did not prevent using the OS. The main issues that have come up:

A decade ago I was still on a 56k modem, no matter the Linux distribution (or computer), it was impossible to get it working. Only certain modems worked for people as there were drivers for those specifically. Eventually I learned the solution was to buy a USB 56k modem. And luckily no one is on 56k any more, so that issue essentially resolved itself (without the need to buy a USB modem).

After that the most annoying issue was getting ATI cards to work. While I had success on a few computers, it did cause enough frustration that I raged and installed Windows on others.

To skip ahead, a more recent issue that had me tearing my hair out was trying to get my discrete graphics working on my laptop a few years ago. Eventually I managed to get the ATI graphics working, but was unable to switch between them and the Intel graphics to save battery life while not gaming. While I know now there has been progress, it still requires googling and following instructions that most people are simply not capable of.

Now skipping ahead another few years, I decided to give Ubuntu 12.04 a shot. Which I had ruled out until Steam was released on Linux. With my 3770k, 16gb, 240ssd, gtx690, z77, I burnt a dvd and popped it in the drive.

First issue, the monitor turns off. So having had a similar issue in the past, I edited grub and added nomodeset. Voila I get about 5 seconds further before the screen freezes. Upon googling I discover it is an issue with my motherboard. I then added libata.atapi_passthru16=0 to grub. Sweet I successfully install Ubuntu. I properly edit grub to include the "libata..." line. Reboot to be sure all is well.

The desktop loads at my proper 2560x1440 resolution. Great I thought, it recognized my graphics card. I check additional drivers, however nothing is selected. I figured lets just try Steam and see if I can play a game before messing with drivers. I install Steam, login, the store page begins to load, then lightdm crashes and I am at the login screen. I switched to gdm, same problem. I google the issue, sure enough it is because of the default graphics driver (Nouveau).

So I install the latest Nvidia driver via Additional Drivers, to which it actually recognized my card. After rebooting I am back at the monitor turning off. More googling has come up empty. Removing, reinstalling all Nvidia drivers, removing Nouveau, blacklisting Nouveau, setting up xorg.conf, following 20 different guides, no solution yet. I am able to return to Nouveau at least to use my computer at the proper resolution, but no gaming yet.

Tonight I tried the latest Fedora for fun, same issue.

I am done with Windows due to the recent revelations (which we all 'knew' but without proof were happy to remain ignorant). I will figure out a solution, the problem is that the majority of people will return to what they're comfortable with when they run into small issues like these. I am not a Linux expert, not even close, and anyone switching to Linux for the first time knows less than me... Anyways, enough rambling. /bye
 
"No driver issues on Linux Mint. Not sure what you are talking about, can you be more specific or are you just trolling?"

Seriously? We're not on consoles here where everyone is running the same hardware. I don't think you know what drivers are... I chose not to elaborate as not to scare people away from Linux. If you read beyond this point, a word of caution, I've had a little to drink, and I tend to ramble. Well:

It is common knowledge that Linux OSes have to cope with driver issues. Hardware manufacturers focus on drivers for mainstream OSes. Recently more of them have been releasing drivers for Linux luckily. However without being open source, they need the masses to test them, otherwise issues remain.

In the last decade, I have installed a Linux distribution on nearly two dozen different computers. Easily seventy five percent have had a driver issue, while most were annoyances and did not prevent using the OS. The main issues that have come up:

A decade ago I was still on a 56k modem, no matter the Linux distribution (or computer), it was impossible to get it working. Only certain modems worked for people as there were drivers for those specifically. Eventually I learned the solution was to buy a USB 56k modem. And luckily no one is on 56k any more, so that issue essentially resolved itself (without the need to buy a USB modem).

After that the most annoying issue was getting ATI cards to work. While I had success on a few computers, it did cause enough frustration that I raged and installed Windows on others.

To skip ahead, a more recent issue that had me tearing my hair out was trying to get my discrete graphics working on my laptop a few years ago. Eventually I managed to get the ATI graphics working, but was unable to switch between them and the Intel graphics to save battery life while not gaming. While I know now there has been progress, it still requires googling and following instructions that most people are simply not capable of.

Now skipping ahead another few years, I decided to give Ubuntu 12.04 a shot. Which I had ruled out until Steam was released on Linux. With my 3770k, 16gb, 240ssd, gtx690, z77, I burnt a dvd and popped it in the drive.

First issue, the monitor turns off. So having had a similar issue in the past, I edited grub and added nomodeset. Voila I get about 5 seconds further before the screen freezes. Upon googling I discover it is an issue with my motherboard. I then added libata.atapi_passthru16=0 to grub. Sweet I successfully install Ubuntu. I properly edit grub to include the "libata..." line. Reboot to be sure all is well.

The desktop loads at my proper 2560x1440 resolution. Great I thought, it recognized my graphics card. I check additional drivers, however nothing is selected. I figured lets just try Steam and see if I can play a game before messing with drivers. I install Steam, login, the store page begins to load, then lightdm crashes and I am at the login screen. I switched to gdm, same problem. I google the issue, sure enough it is because of the default graphics driver (Nouveau).

So I install the latest Nvidia driver via Additional Drivers, to which it actually recognized my card. After rebooting I am back at the monitor turning off. More googling has come up empty. Removing, reinstalling all Nvidia drivers, removing Nouveau, blacklisting Nouveau, setting up xorg.conf, following 20 different guides, no solution yet. I am able to return to Nouveau at least to use my computer at the proper resolution, but no gaming yet.

Tonight I tried the latest Fedora for fun, same issue.

I am done with Windows due to the recent revelations (which we all 'knew' but without proof were happy to remain ignorant). I will figure out a solution, the problem is that the majority of people will return to what they're comfortable with when they run into small issues like these. I am not a Linux expert, not even close, and anyone switching to Linux for the first time knows less than me... Anyways, enough rambling. /bye

I got to admit, I didnt read your whole article. I wont call it a comment because its so long. I have spent the last 4 years transitioning from Windows to Linux (I am a Windows Engineer by trade) and I have installed a linux OS on around 30 machines (Friends, family, my own) and not once, have I had driver issues. Oh wait I stand corrected, in Ubuntu 13.04 they updated a driver that stopped my HDMI working. One patch later and it was fixed.

Its worth noting that Linux has had significantly more input in the last few years from Intel and NVidia thanks to Valve, and things have improved considerably because of this.

Linux is not what it used to be. It is FAR more user friendly these days. e.g. you don't need to be a tech guru to use it. Linux has replaced Windows in around 8 households, and I haven't had one complaint.
 
To the guest who wrote that wall of text:

Divvet may not have read your entire article, but I did. And I must say... Cool story, bro. (y)
 
Actually they are trying to change the blame. From what I understand Tor had Java disabled in the browser by default and recently re-enabled it by default to make things easier for users but in turn it was JAVA not Windows that allowed this attack. The most recent build of TOR has java disabled again. So don't blame windows...blame yourselves (TOR) for allowing Java ( Security Nightmare ) by default.
 
Actually they are trying to change the blame. From what I understand Tor had Java disabled in the browser by default and recently re-enabled it by default to make things easier for users but in turn it was JAVA not Windows that allowed this attack. The most recent build of TOR has java disabled again. So don't blame windows...blame yourselves (TOR) for allowing Java ( Security Nightmare ) by default.
Wasn't it javascript that was exploited? Not java?
 
Back