Two Tor zero-days disclosed, more to come

guest · Jul 30, 2020

Two Tor zero-days disclosed, more to come
A security researcher has published details about two Tor zero-days and promises to release three more
July 30, 2020
https://www.zdnet.com/article/two-tor-zero-days-disclosed-more-to-come/

Over the past week, a security researcher has published technical details about two vulnerabilities impacting the Tor network and the Tor browser.

In blog posts last week and today, Dr. Neal Krawetz said he was going public with details on two zero-days after the Tor Project has repeatedly failed to address multiple security issues he reported throughout the past years.
The researcher also promised to reveal at least three more Tor zero-days, including one that can reveal the real-world IP address of Tor servers.
Click to expand...

THE FIRST TOR ZERO-DAY
In a blog post dated July 23, the researcher described how companies and internet service providers could block users from connecting to the Tor network by scanning network connections for "a distinct packet signature" that is unique to Tor traffic.

The packet could be used as a way to block Tor connections from initiating and effectively ban Tor altogether -- an issue that oppressive regimes are very likely to abuse.
THE SECOND TOR ZERO-DAY
Earlier today, in a blog post shared with ZDNet, Dr. Krawetz disclosed a second issue. This one, like the first, allows network operators to detect Tor traffic.

However, while the first zero-day could be used to detect direct connections to the Tor network (to Tor guard nodes), the second one can be used to detect indirect connections.
Click to expand...

DISSATISFACTION TOWARDS THE TOR PROJECT'S SECURITY STANCE
The reason why Dr. Krawetz is publishing these zero-days is that he believes the Tor Project does not take the security of its networks, tools, and users seriously enough.
The security researcher cites previous incidents when he tried to report bugs to the Tor Project only to be told that they were aware of the issue, working on a fix, but never actually deploying said fix.
Click to expand...

mirimir · Jul 31, 2020

FYI: https://news.ycombinator.com/item?id=23929312

The general HN consensus is that these are not really zero-days.

Log in or Sign up

Two Tor zero-days disclosed, more to come

guest Guest

mirimir Registered Member

Log in or Sign up

Two Tor zero-days disclosed, more to come

guest Guest

mirimir Registered Member

Useful Searches