Windows DRM-Protected Files Used To Decloak Tor Browser Users (bleepingcomputer.com)

An anonymous reader writes from a report via BleepingComputer: Downloading and trying to open Windows DRM-protected multimedia files can deanonymize Tor Browser users and reveal their real IP addresses, security researchers from Hacker House have warned. On Windows, multimedia files encoded with special Microsoft SDK will automatically open an IE window and access a URL to check the file's license. Since this request is sent outside of the Tor Browser and without user interaction, this can be used to ping law enforcement servers and detect the user's real IP address and other details. For example, law enforcement could host properly signed DRM-protected files on sites pretending to host child pornography. When a user would try to view the file, the DRM multimedia file would use Internet Explorer to ping a server belonging to the law enforcement agency. The same tactic can also be used to target ISIS militants trying to view propaganda videos, illegal drug and weapons buyers trying to view video product demos, political dissidents viewing news videos, and more. A video of the attack is available here.

Comments

Umm... just WMVs?

[speedplane]

So opening an WMV in windows media and phone-home to a server... couldn't the same be done with Adobe reader and PDFs? Or with countless pieces of software out there?

Quick Workaround

[gavron]

1. Determine which TOR-nodes you're talking to. (Netstat or Ethereal)
2. Remove default route through your ISPs router
3. Add specific routes to the /32s the TOR-nodes are on through the ISP router

Traffic routed through TOR will work fine.
Traffic going outside of TOR will fail except for the local network (your home or office LAN).

E

Re:Not Tor Problems!

[jonwil]

They aren't using it to watch entertainment videos. They are going to underground web sites (child porn, drugs, weapons etc) and being tricked into viewing a video put there by law enforcement that is designed to phone home in this way.

Re:I'm ok with this behavior in those use cases

[Anonymous Coward]

"First they came for the kiddy fiddlers, and no one objected..." Then a month from now, the FBI is ordered to embed these bugs in videos of services at mosques, and videos of anti-Trump protests, and videos of CNN interviews, and seed them all around the internet to build The Bigly List of Brown People and Dissenters.

In the Bush era, I would have laughed this off as a slippery slope argument. In present times, knowing what Snowden has taught us and watching the current political climate, I don't see it as a laughing matter.

Re:Ask OS makers next?

[Anonymous Coward]

Next? There's a high likelihood this is already happening in Windows 10. Every time you open a file, Windows 10 is sending unknown "telemetry" back to the mother ship. Those Windows Defender and Microsoft Security Essentials updates you get every day? They're hash lists. You can bet your ass those lists contain more than just virus signatures, and matches are being recorded somewhere.

Re:WMP Settings

[The-Ixian]

I was thinking the same thing. I always uncheck all those boxes when I launch WMP for the first time.

Though really, I don't think I have launched WMP in years... why bother when you have VLC?

VLC is associated with all of the file media file types that Windows knows about so is the DRM laden WMV (or whatever) able to call WMP explicitly when you launch it? I don't think that is how it works. Even if it did, if you have never run WMP before, you will get the first run dialog which has the option you mention plain as day as a checkbox.

Seems like this tracking mechanism is to catch total morons.