Slashdot Mirror
TorMoil Vulnerability Leaks Real IP Address From Tor Browser Users; Security Update Released (bleepingcomputer.com)
Catalin Cimpanu, reporting for BleepingComputer: The Tor Project has released a security update for the Tor Browser on Mac and Linux to fix a vulnerability that leaks users' real IP addresses. The vulnerability was spotted by Filippo Cavallarin, CEO of We Are Segment, an Italian company specialized in cyber-security and ethical hacking. Cavallarin privately reported the issue -- which he codenamed TorMoil -- to the Tor Project last week. Tor Project developers worked with the Firefox team (Tor Browser is based on the Firefox browser) to release a fix. Today, the Tor team released version 7.0.9 to address the vulnerability. Tor Browser 7.0.9 is only available for Mac and Linux users. Tor Browser on Windows is not affected.
Boy, is that a change for once.
But, on a more serious note, as the summary said, Tor browser on windows is not affected. But, as the summary did not say, Tor Browser on TAILS is also not affected.
So, grab an ISO for TAILS 3.12, liveboot it in a VM and keep Tor Browsing away...
*** Suerte a todos y Feliz dia!
?there?
People should be careful if depending on this for anything safety critical.
The German spy agency BND developed a system to monitor the Tor network and warned federal agencies that its anonymity is ineffective“.
There are lots of others reasons to treat it with caution. Won't dig up all the links, but this is a real high priority target for security agenies.
you must be very stupid to don't realize that a server needs a IP address to send information to a client. there's no way you can hide. tor is a myth and you all must die.
This is my surprised face. Anyway, I'm going to take a wild guess people in oppressively governed areas aren't using Macs but they probably are using Linux so this sucks. I hope it doesn't lead to any arrests or raids.
Unless you have a good idea what you are doing in configuring your system yourself is probably unwise if you need the protection of Tor. It's not entirely clear to me, but I don't think there has been a single vulnerability which would have impacted my setup and I don't think Tails has been impacted by any major issue either. At the end of the day these underlying tools are huge and not designed for anonymity and privacy. Which means everything has to be cordoned off at the lowest of levels. I trust Tor is being analysed thoroughly because it is a high profile target. It's much easier to secure smaller bits of code. I don't trust Firefox. It's got a lot of eyes on it, but it is also a huge code base. In the most secure setup a compromise of even the operating system at the end of the day should not result in a leak. However such setups are tricky and involve removal of web cams, microphones, wireless cards, execution on systems that don't spy on you, and have middle components (router-like devices) running the bare minimum of components segregating off what can't be secured from what can be (ie the code on the router-like device from that code which can't be the desktop operating system, firefox, etc).
This is the last safe Tails, forget all of the rest.
https://www.sendspace.com/file/yz3r12
Same as here. https://kickass.cd/tails-1-4-1-tor-tt12109343.html
CORRECT HASH: c7bf55250ca7a7ad897fd219af6ef3d4768be54fb3e2537abb3da8f7f4ed8913
Later versions were compromised by the US gov. (You would think NSA but it was CIA.) Snowden and all that. The build tools are compromised and so is tails.boum.org now. Don't ever expect it not to be either.
On Android/iOS check out Zom. You can run it through Orbot too.