0

Recently I came across an article regarding Tor. According to article

there is speculation that the uncovered malware was used by a law enforcement agency to harvest the IP addresses of users of several hidden services hosted by Freedom Hosting.

I use Tor regularly in my windows machine. How can I protect myself from this kind of vulnerability?

Improve this question

4 Answers 4

Reset to default
6

The vulnerability was in the bundled Firefox browser. It has since been patched, so updating it would fix the problem.

In general, there are several ways to protect yourself:

  • Update Tor Bundle to the latest version, which isn't vulnerable to this specific attack.
  • Enable NoScript globally, and only whitelist sites when you've FULLY checked that they're not serving dodgy JS. Remember that FH got popped, so all FH sites were infected.
  • Always keep your OS, AV, firewall, apps, etc. up to date.
  • Install EMET and configure it to provide additional protection against exploits.
  • Do your browsing in an isolated session, e.g. in a VM or via Sandboxie, in order to minimise the risk of future exploits. This won't stop you from being identified via out-of-Tor comms, but it helps prevent your box from being popped.
Improve this answer
2
  • Something I like with the last version of Avast is that there is a Software Updater module. This module make sure you do not have outdated software.
    – null
    Aug 8, 2013 at 20:30
  • No need for 3rd party bloatware - the Tor bundle automatically alerts you when there are new updates available.
    – Polynomial
    Aug 15, 2013 at 22:52
4

The vulnerability in question isn't in Tor, it's in older versions of Firefox (version 17.0 and older). The exploit is installed on certain compromised Tor .onion sites, and it should only affect you if you're using an old version of Firefox.

How is this related to the Tor Browser Bundle itself? Tor Browser Bundle was using an old version of Firefox which had that vulnerability. To protect yourself, simply download a the latest version of Tor Browser Bundle.

Aside from the that, just keep your operating system, AV software, and general applications updated all the time.

Improve this answer
5
  • ...And switch JavaScript off.
    – Deer Hunter
    Aug 8, 2013 at 13:32
  • @DeerHunter Or, a better idea, whitelist JavaScript.
    – Adi
    Aug 8, 2013 at 14:05
  • @Svetlana, whitelisting an FH hosted site would still have exposed someone to this particular vulnerability. It was the site itself that was compromised, not some random third party advertiser or other linked-in JavaScript.
    – John Deters
    Aug 8, 2013 at 17:27
  • @JohnDeters Well, guess what. Almost every website out there has useful features in JavaScript. Disabling JavaScript means hindering usability, and hindering usability leads to bad security. The solution isn't disabling JavaScript. Also, by whitelisting I meant whitelisting the scripts you trust. (NoScript can do that).
    – Adi
    Aug 8, 2013 at 17:31
  • @Svetlana, sorry, I didn't mean to offend. First, Tor anonymity is not always necessary for general browsing. It's for a dissident to protect himself or herself from retaliation, or a source to reveal secrets to a news reporter. They don't need to use sites with heavy JavaScript to accomplish those tasks. Second, I use NoScript to whitelist sites, but if the site you trust IS the site that attacks you, (as was this case) the whitelist will betray you.
    – John Deters
    Aug 8, 2013 at 17:41
2

A good thing to do is to block any kind of scripts while you are surfing using the Tor-bundle. Don't forget to keep your software up to date!

A better solution if you don't want to replace windows is setting up a virtual machine for example that runs Tails. The advantage of this is that it is isolated from your primary system.

Regarding your question you can't protect yourself from this kind of attacks! You can't protect yourself against 0-Day exploits:

13:50 Tor Browser Bundle users who installed or manually updated after June 26 are safe from the exploit, according to the Tor Project’s new security advisory on the hack.

The only thing you can do is update the software on a regular basis or audit the software that you are using by yourself to make sure its secure.

Improve this answer
0

Study the advice you can learn from https://panopticlick.eff.org on how your browser can be uniquely fingerprinted. Then, as you make changes to protect yourself, you will better understand how and why certain choices can reveal your identity.

We could give you a checklist, but it would be out of date as soon as the next exploit is revealed.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .