Deep down the certificate pinning rabbit hole of "Tor Browser Exposed"

lotuseclat79 · Sep 16, 2016

Deep down the certificate pinning rabbit hole of "Tor Browser Exposed".

I spent a decent portion of my day looking into the claim by the Tor-Fork
developer that you could get cross-platform RCE on Tor Browser if you're
able to both MitM a connection and forge a single TLS certificate for
addons.mozilla.org. This is well within the capability of any decently
resourced nation-state. Definitely read @movrcx's write-up first to see his
claim. It's here:https://hackernoon.com/tor-browser-exposed-anti-privacy-
implantation-at-mass-scale-bd68e9eb1e95#.vh1a04yxy

Instead of making you read a whole lot to find out the issue, I'll give you
the bottom line up front (BLUF): Firefox uses its own static key pinning
method for it's own Mozilla certs instead of using HPKP. The enforcement of
the static method appears to be much weaker than the HPKP method and is
flawed to the point that it is bypassable in this attack scenario. The bug
appears to be fixed as of the September 4th nightly build of Firefox but is
obviously still unpatched in both the current production versions of
Firefox and Tor Browser. I'm posting about this publically now instead of
waiting because @movrcx's post still shows how to take advantage of these
flaws even if it doesn't describe (and he didn't know at the time) exactly
how and why it bypassed certificate pinning.
Click to expand...

-- Tom

TheWindBringeth · Sep 16, 2016

Thanks for bringing that to our attention here!

compleo · Sep 16, 2016

The 1st 2 links in the article yields a 404 error.

J_L · Sep 16, 2016

compleo said: ↑

The 1st 2 links in the article yields a 404 error.
Click to expand...

Many of the links were split by new lines. For example, this should be the full URL of the first 2 links:
https://hackernoon.com/tor-browser-...ntation-at-mass-scale-bd68e9eb1e95#.vh1a04yxy

compleo · Sep 16, 2016

J_L said: ↑

Many of the links were split by new lines. For example, this should be the full URL of the first 2 links:
https://hackernoon.com/tor-browser-...ntation-at-mass-scale-bd68e9eb1e95#.vh1a04yxy
Click to expand...

Thanks,but that's odd.

lotuseclat79 · Sep 22, 2016

Bug that hit Firefox and Tor browsers was hard to spot—now we know why

The curious case of Firefox's (now fixed) certificate pinning failure
Click to expand...

-- Tom

mirimir · Sep 22, 2016

Well, there's really no need to install addons in Tor browser. And Tor Project has consistently recommended against it.

Log in or Sign up

Deep down the certificate pinning rabbit hole of "Tor Browser Exposed"

lotuseclat79 Registered Member

TheWindBringeth Registered Member

compleo Registered Member

J_L Registered Member

compleo Registered Member

lotuseclat79 Registered Member

mirimir Registered Member

Members

Useful Searches