Monthly Archives: April 2015

Now available for Linux, Mac OS X, and Windows

Tor Browser 4.0.6

The Tor Project, through Mike Perry, had the pleasure of announcing the immediate availability for download of the sixth maintenance release of the Tor Browser Bundle 4.0 software for GNU/Linux, Mac OS X, and Microsoft Windows operating systems.

According to the release notes, Tor Browser 4.0.6 is now based on the upstream Mozilla Firefox 31.6.0 ESR (Extended Support Release) web browser, updates the OpenSSL component to version 1.0.1m, as well as the meek tool to version 0.16.

A new release for the stable Tor Browser is available from the Tor Browser Project page and also from our distribution directory, says Mike Perry. Tor Browser 4.0.6 is based on Firefox ESR 31.6.0, which features important security updates to Firefox.

The release announcement for Tor Browser Bundle 4.0.6 also contains an important note for users of the Mac OS X operating system, as this is the last release of the web browser that will run on 32-bit version of OS X.

While those who run Mac OS X 10.8 (Mountain Lion) or later will be automatically switched to the 64-bit version of the upcoming Tor Browser 4.5, which is set to be released sometime this month, users of Mac OS X 10.6 and 10.7 will have to manually update. The transition is expected to be as smooth as possible.

Download Tor Browser Bundle 4.0.6 for Linux, Mac OS X, and Windows right now from Softpedia. The Tor Project also released the fifth Alpha release of the forthcoming Tor Browser Bundle 4.5 web browser, the next major release of the software, which includes a great number of new features, numerous bugfixes, as well as countless improvements.

See the article here:
Tor Browser 4.0.6 Is Now Available for Download, Based on ...

Too many onion circuits can spoil the server, thanks to a Tor hidden service vulnerability.

Aurich Lawson / Thinkstock

The operator of an underground marketplace hosted within the Tor network has reported a flaw in Tor that he claims is being used for an ongoing denial of service attack on the site.

The problem, which is similar to one reported by another hidden site operator in December on the Tor mailing list, allows attackers to conduct a denial of service attack against hidden sites by creating a large number of simultaneous connections, or "circuits," via Tor, overwhelming the hidden service's ability to respond.

The problem is still under review, but it appears to be related to abuse of the "introduce" message in the Tor Hidden Services protocol, which is used to negotiate the connection between the client and the hidden server. By sending multiple "introduce" requests to the same hidden service, an attacker could make the targeted server create multiple circuits (paths over the Tor network used for the session), eating the server's available CPU and network resources and making it inaccessible to users.

An individual associated with Middle Earth, one of the hidden sites targeted by the denial of service attacks, posted to reddit's "darknet markets" subreddit earlier this week to apologize for the long downtime associated with the attack. Using the reddit account name MEMGandalf, he claimed "Middle Earth and Agora are the focus of the most serious attack TOR has ever seen." He additionally reported that Middle Earth's operator had reported the flaw to Tor. (The bug report was opened under the name "alberto.") The attack raised the server's processor load to 100 percent utilization.

While the problem has been reproduced by at least one Tor developer, short-term fixes proposed to prevent the attacks have, thus far, not panned out. A number of long-term fixes have been proposed that require substantial changes to Tor's Hidden Services Protocol implementation, including the use of dedicated bridges to connect larger hidden sites to Tor (part of Tor's Proposal 188, first put forward in 2012 by Tor co-founder and developer Roger Dingledine in June 2012).

There was also a number of Tor client-related security patches pushed out this weeklargely triggered by a critical "safety hazard" alert from Mozilla for Firefox, Firefox Extended Support Release, and the Thunderbird mail client. Both the Tor Browser Bundle and Tails live-bootable operating system were updated to fix problems in the Mozilla browser engine used across all the projects. Because of problems in how the browser engine handled memory safety, "we presume that with enough effort at least some of these (flaws) could be exploited to run arbitrary code," the Mozilla team noted in the alert.

The Tor Browser Bundle and the Tor browser in Tails both use Firefox ESR as their code base. In theory, the flaws could be exploited to run script within a browser session that could be used to launch an attack against the browser by loading code to memory outside the browser's context. Now that the flaw has been made public, Tor and the Tails project are urging users to update their software as soon as possible.

The latest Tails release also fixes more problems in OpenSSL, the open-source crypto kit that was the source of last year's Heartbleed bug. A set of problems in OpenSSL that could have caused memory corruption and software crashes found in the Debian distribution of Linux were patched in mid-March; Tails is based on Debian, and these fixes were rolled into the latest bootable distribution.

See the rest here:
Bugs in Tor network used in attacks against underground markets